Edit tour

Windows Analysis Report
xxImTScxAq.exe

Overview

General Information

Sample name:	xxImTScxAq.exe renamed because original name is a hash value
Original sample name:	c6938e6c34b9124099c93dec5f9487c7.exe
Analysis ID:	1540859
MD5:	c6938e6c34b9124099c93dec5f9487c7
SHA1:	e6270c7c2948665c0e0c2cefd498740e1beb9ffd
SHA256:	8516ea0af2d90490f0c657e87a92a91b7606ac94f010a46e57b1f3dcb426e678
Tags:	64exe
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Found API chain indicative of debugger detection

Javascript uses Websockets

Machine Learning detection for sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to create an SMB header

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found decision node followed by non-executed suspicious APIs

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTML page contains hidden javascript code

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Uses Microsoft's Enhanced Cryptographic Provider

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

xxImTScxAq.exe (PID: 7456 cmdline: "C:\Users\user\Desktop\xxImTScxAq.exe" MD5: C6938E6C34B9124099C93DEC5F9487C7)

conhost.exe (PID: 7464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7516 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7560 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7588 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7604 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7636 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7652 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7680 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 7696 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 7712 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 7732 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 7752 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 7772 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7788 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7816 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7832 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7884 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7904 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7932 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 7948 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 7964 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 7980 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 7996 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 8028 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 8044 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 8072 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 8088 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 8116 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 8132 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 8160 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 8180 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 7244 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 1660 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 6488 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

chrome.exe (PID: 6388 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://discord.gg/privatecommunity MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 400 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1976,i,17008637015188082442,6516935950602150034,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7528 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4968 --field-trial-handle=1976,i,17008637015188082442,6516935950602150034,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7540 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 --field-trial-handle=1976,i,17008637015188082442,6516935950602150034,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: xxImTScxAq.exe

ReversingLabs: Detection: 34%

Machine Learning detection for sample

Source: xxImTScxAq.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729A9F6D strtol,strchr,strchr,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strchr,_strdup,CertOpenStore,GetLastError,free,free,CryptStringToBinaryA,CertFindCertificateInStore,fopen,fseek,ftell,fseek,malloc,fread,fclose,malloc,MultiByteToWideChar,PFXImportCertStore,free,free,GetLastError,CertFindCertificateInStore,GetLastError,CertCloseStore,CertCloseStore,calloc,CertFreeCertificateContext,fclose,free,CertFreeCertificateContext,free,calloc,	0_2_00007FF6729A9F6D
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729C6420 GetLastError,CreateFileA,GetLastError,GetFileSizeEx,GetLastError,malloc,ReadFile,strstr,strstr,CryptQueryObject,CertAddCertificateContextToStore,CertFreeCertificateContext,GetLastError,GetLastError,GetLastError,CloseHandle,free,	0_2_00007FF6729C6420
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729AC1F0 CryptAcquireContextA,CryptCreateHash,	0_2_00007FF6729AC1F0
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729A9330 memset,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF6729A9330
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729A9260 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,	0_2_00007FF6729A9260
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729AC240 CryptHashData,	0_2_00007FF6729AC240
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729AC250 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF6729AC250
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729C5B00 CertOpenStore,GetLastError,CertCreateCertificateChainEngine,GetLastError,CertGetCertificateChain,GetLastError,CertGetNameStringA,malloc,CertFindExtension,CryptDecodeObjectEx,CertGetNameStringA,CertFindExtension,CryptDecodeObjectEx,CertFreeCertificateChainEngine,CertCloseStore,CertFreeCertificateChain,CertFreeCertificateContext,	0_2_00007FF6729C5B00
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729CEF60 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF6729CEF60
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729CCE70 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	0_2_00007FF6729CCE70

Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: -----BEGIN PUBLIC KEY-----		0_2_00007FF67298F110
Source: xxImTScxAq.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: C:\Users\user\Desktop\xxImTScxAq.exe

Code function: mov dword ptr [rbp+04h], 424D53FFh

0_2_00007FF6729B8B30

Phishing

Javascript uses Websockets

Source: https://discord.com/invite/privatecommunity

HTTP Parser: !function(){if(null!=window.websocket){if(function(n){try{var o=localstorage.getitem(n);return null==o?null:json.parse(o)}catch(n){return null}}("token")&&!window.__overlay__){var n=null!=window.discordnative||null!=window.require?"etf":"json",o=window.global_env.gateway_endpoint+"/?encoding="+n+"&v="+window.global_env.api_version;null!=window.discordnative&&void 0!==window.uint8array&&void 0!==window.textdecoder?o+="&compress=zstd-stream":void 0!==window.uint8array&&(o+="&compress=zlib-stream"),console.log("[fast connect] "+o+", encoding: "+n+", version: "+window.global_env.api_version);var e=new websocket(o);e.binarytype="arraybuffer";var i=date.now(),w={open:!1,identify:!1,gateway:o,messages:[]};e.onopen=function(){console.log("[fast connect] connected in "+(date.now()-i)+"ms"),w.open=!0},e.onclose=e.onerror=function(){window._ws=null},e.onmessage=function(n){w.messages.push(n)},window._ws={ws:e,state:w}}}}()

Source: https://discord.com/invite/privatecommunity

HTTP Parser: Base64 decoded: 1729754135.000000

Source: unknown	HTTPS traffic detected: 13.107.246.51:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.0.5:443 -> 192.168.2.7:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.7:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.7:50126 version: TLS 1.2

Source: xxImTScxAq.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\Loader Valorant Aim\x64\Release\EpicGames.pdb source: xxImTScxAq.exe

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 66MB

Source: global traffic

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 58Content-Type: application/x-www-form-urlencoded

Source: Joe Sandbox View	IP Address: 162.159.136.232 162.159.136.232
Source: Joe Sandbox View	IP Address: 162.159.138.232 162.159.138.232
Source: Joe Sandbox View	IP Address: 104.26.0.5 104.26.0.5

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50

Source: C:\Users\user\Desktop\xxImTScxAq.exe

Code function: 0_2_00007FF672981560 rand,rand,rand,SetConsoleTitleA,_invalid_parameter_noinfo_noreturn,GetConsoleWindow,GetWindowLongPtrA,SetWindowLongPtrA,SetLayeredWindowAttributes,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A,??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z,URLDownloadToFileA,system,system,Sleep,exit,URLDownloadToFileA,system,system,Sleep,exit,_invalid_parameter_noinfo_noreturn,

0_2_00007FF672981560

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /privatecommunity HTTP/1.1Host: discord.ggConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /invite/privatecommunity HTTP/1.1Host: discord.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/69646.2af8e3f2e60b2cca1cbf.css HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/webMinimal.183cbc8427e6b143ce21.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/sentry.d30fc24f50e5e3e76b3e.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/sentry.d30fc24f50e5e3e76b3e.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=CPvS493CNwvgbpM&MD=v1L4F4AC HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/webMinimal.183cbc8427e6b143ce21.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/591980d24607547de30a.css HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/2917679ca8a08c390036.css HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/8234e0a75aa9afb205bd.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/b21c5111a12372139409.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/8bd8143eff37936894aa.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/452d7be36bf4b23241bd.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/48a594e29497835802fe.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/f5b8aa3411dfc24ff2e6.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /api/v9/experiments?with_guild_experiments=true HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Super-Properties: eyJvcyI6IldpbmRvd3MiLCJicm93c2VyIjoiQ2hyb21lIiwiZGV2aWNlIjoiIiwic3lzdGVtX2xvY2FsZSI6ImVuLVVTIiwiYnJvd3Nlcl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2IiwiYnJvd3Nlcl92ZXJzaW9uIjoiMTE3LjAuMC4wIiwib3NfdmVyc2lvbiI6IjEwIiwicmVmZXJyZXIiOiIiLCJyZWZlcnJpbmdfZG9tYWluIjoiIiwicmVmZXJyZXJfY3VycmVudCI6IiIsInJlZmVycmluZ19kb21haW5fY3VycmVudCI6IiIsInJlbGVhc2VfY2hhbm5lbCI6InN0YWJsZSIsImNsaWVudF9idWlsZF9udW1iZXIiOjMzODU0MCwiY2xpZW50X2V2ZW50X3NvdXJjZSI6bnVsbH0=X-Context-Properties: eyJsb2NhdGlvbiI6IkFjY2VwdCBJbnZpdGUgUGFnZSJ9X-Debug-Options: bugReporterEnabledsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Discord-Timezone: America/New_YorkX-Discord-Locale: en-USsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/ac625b77a0bab0ee72df.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/29a63f12209c956d9204.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/55ad931ed92a15c15709.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/5067a2ec1b24a6de868c.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/assets/ac625b77a0bab0ee72df.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/1f7f046253c197b5a419.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/ac625b77a0bab0ee72df.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/29a63f12209c956d9204.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/a6f6204cd40c3c5f5c14.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/assets/ac625b77a0bab0ee72df.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/d67c5e680608266a1f63.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /api/v9/experiments?with_guild_experiments=true HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/55ad931ed92a15c15709.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/1bab9b095996b8d024ce.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/assets/ac625b77a0bab0ee72df.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/d86788be99e870993214.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/5067a2ec1b24a6de868c.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/a14c32460cf87caa605c.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/94ec0c2b39908933eed3.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/1f7f046253c197b5a419.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/36e086bbcea2eace814d.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/6df906184440a6461f5c.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/fdc71c23d09e18e94ce2.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/89b7ddebcacbe8dfbd3a.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/ea8b2ed5e609f40e7f7b.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/af6b8f380faee0e9f47d.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/6674c18c2e4160ceca2d.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/bd0ab83c61025d7c7000.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/b8160243347055e1f278.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/05bd1eb5dea5ee3387f4.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/2597d11c1e039607373e.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/a5ec2b74d0cc337d4481.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/5430e9964fe8364e084d.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/ab03f7053698d417194c.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/410a2166a48c9e482e2a.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/9017b7062734e72bb476.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/af5116b1db004acbdb8b.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/ba88bbd1342d3f000e33.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/a6f6204cd40c3c5f5c14.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/d67c5e680608266a1f63.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/1bab9b095996b8d024ce.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/d86788be99e870993214.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/a14c32460cf87caa605c.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/94ec0c2b39908933eed3.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/bd0ab83c61025d7c7000.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000Range: bytes=162802-162802If-Range: "3b74671903d935a08dc04acef440c188"
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js? HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/6df906184440a6461f5c.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/36e086bbcea2eace814d.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/fdc71c23d09e18e94ce2.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/89b7ddebcacbe8dfbd3a.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/bd0ab83c61025d7c7000.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000Range: bytes=162802-168788If-Range: "3b74671903d935a08dc04acef440c188"
Source: global traffic	HTTP traffic detected: GET /assets/ea8b2ed5e609f40e7f7b.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/af6b8f380faee0e9f47d.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/6674c18c2e4160ceca2d.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/b8160243347055e1f278.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/1222195a37d6dd10994e.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/05bd1eb5dea5ee3387f4.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/2597d11c1e039607373e.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/a5ec2b74d0cc337d4481.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/5430e9964fe8364e084d.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/c1b53be672aac192a996.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /api/v9/invites/privatecommunity?with_counts=true&with_expiration=true HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Super-Properties: eyJvcyI6IldpbmRvd3MiLCJicm93c2VyIjoiQ2hyb21lIiwiZGV2aWNlIjoiIiwic3lzdGVtX2xvY2FsZSI6ImVuLVVTIiwiYnJvd3Nlcl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2IiwiYnJvd3Nlcl92ZXJzaW9uIjoiMTE3LjAuMC4wIiwib3NfdmVyc2lvbiI6IjEwIiwicmVmZXJyZXIiOiIiLCJyZWZlcnJpbmdfZG9tYWluIjoiIiwicmVmZXJyZXJfY3VycmVudCI6IiIsInJlZmVycmluZ19kb21haW5fY3VycmVudCI6IiIsInJlbGVhc2VfY2hhbm5lbCI6InN0YWJsZSIsImNsaWVudF9idWlsZF9udW1iZXIiOjMzODU0MCwiY2xpZW50X2V2ZW50X3NvdXJjZSI6bnVsbH0=X-Fingerprint: 1298907770543669269.3mKIt_b3e6cjNLa98gAmbtR2lvUX-Debug-Options: bugReporterEnabledsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Discord-Timezone: America/New_YorkX-Discord-Locale: en-USsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/410a2166a48c9e482e2a.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/ab03f7053698d417194c.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/9017b7062734e72bb476.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/af5116b1db004acbdb8b.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/ba88bbd1342d3f000e33.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js? HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/ecff74bf4394e6e58dd1.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000; cf_clearance=WAotb24SXfv5tMKii.BOUvfJ3IaKCvfQ3MTtHpCEMRM-1729754152-1.2.1.1-2qBWsm.ssgn2crWBdcDxBnsiDQOMwU9fU8OyXSvkXc4eUDceDMcczvFc_QdHmN3pMUVVZn0a4XqYDzAzP41p67yiklCEcA.PNS5nGSCp8mZR3VLwmtUFr0y5_azxWyzLb6_S1ZwPfChne.pN2VcNtqUTveFZTIM.3ee2_thzzwQR6inlbIp8tqiTuHdixAT1Fp9Dljxr0vD_j8anXSMgsbKnzIvrW6Zw8XlN.v4pqEtZ5M9VwwSz7ZLkMyJjg0PfuUl0xfvprO8fN9KNY42yC6MECtk113PnB7oqhiHiLuQ287FnBOGFYrLmFYW9bvtQvS7cRjBokb2fOn4EOuaSAS6mYaQ_Q38R_psLDe6YXlvKp_0GJbX3_1FsbxEF38wp
Source: global traffic	HTTP traffic detected: GET /assets/914a97ac83e173c66dd7.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000; cf_clearance=WAotb24SXfv5tMKii.BOUvfJ3IaKCvfQ3MTtHpCEMRM-1729754152-1.2.1.1-2qBWsm.ssgn2crWBdcDxBnsiDQOMwU9fU8OyXSvkXc4eUDceDMcczvFc_QdHmN3pMUVVZn0a4XqYDzAzP41p67yiklCEcA.PNS5nGSCp8mZR3VLwmtUFr0y5_azxWyzLb6_S1ZwPfChne.pN2VcNtqUTveFZTIM.3ee2_thzzwQR6inlbIp8tqiTuHdixAT1Fp9Dljxr0vD_j8anXSMgsbKnzIvrW6Zw8XlN.v4pqEtZ5M9VwwSz7ZLkMyJjg0PfuUl0xfvprO8fN9KNY42yC6MECtk113PnB7oqhiHiLuQ287FnBOGFYrLmFYW9bvtQvS7cRjBokb2fOn4EOuaSAS6mYaQ_Q38R_psLDe6YXlvKp_0GJbX3_1FsbxEF38wp
Source: global traffic	HTTP traffic detected: GET /api/v9/auth/location-metadata HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Super-Properties: eyJvcyI6IldpbmRvd3MiLCJicm93c2VyIjoiQ2hyb21lIiwiZGV2aWNlIjoiIiwic3lzdGVtX2xvY2FsZSI6ImVuLVVTIiwiYnJvd3Nlcl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2IiwiYnJvd3Nlcl92ZXJzaW9uIjoiMTE3LjAuMC4wIiwib3NfdmVyc2lvbiI6IjEwIiwicmVmZXJyZXIiOiIiLCJyZWZlcnJpbmdfZG9tYWluIjoiIiwicmVmZXJyZXJfY3VycmVudCI6IiIsInJlZmVycmluZ19kb21haW5fY3VycmVudCI6IiIsInJlbGVhc2VfY2hhbm5lbCI6InN0YWJsZSIsImNsaWVudF9idWlsZF9udW1iZXIiOjMzODU0MCwiY2xpZW50X2V2ZW50X3NvdXJjZSI6bnVsbH0=X-Fingerprint: 1298907770543669269.3mKIt_b3e6cjNLa98gAmbtR2lvUX-Debug-Options: bugReporterEnabledsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Discord-Timezone: America/New_YorkX-Discord-Locale: en-USsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000; cf_clearance=WAotb24SXfv5tMKii.BOUvfJ3IaKCvfQ3MTtHpCEMRM-1729754152-1.2.1.1-2qBWsm.ssgn2crWBdcDxBnsiDQOMwU9fU8OyXSvkXc4eUDceDMcczvFc_QdHmN3pMUVVZn0a4XqYDzAzP41p67yiklCEcA.PNS5nGSCp8mZR3VLwmtUFr0y5_azxWyzLb6_S1ZwPfChne.pN2VcNtqUTveFZTIM.3ee2_thzzwQR6inlbIp8tqiTuHdixAT1Fp9Dljxr0vD_j8anXSMgsbKnzIvrW6Zw8XlN.v4pqEtZ5M9VwwSz7ZLkMyJjg0PfuUl0xfvprO8fN9KNY42yC6MECtk113PnB7oqhiHiLuQ287FnBOGFYrLmFYW9bvtQvS7cRjBokb2fOn4EOuaSAS6mYaQ_Q38R_psLDe6YXlvKp_0GJbX3_1FsbxEF38wp
Source: global traffic	HTTP traffic detected: GET /assets/bd0ab83c61025d7c7000.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/jsd/r/8d782d30f89d28ab HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /api/v9/invites/privatecommunity?with_counts=true&with_expiration=true HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /icons/1230227842877620359/a_75aa56a5faded73ac41ce0fac1e7d74c.webp?size=64 HTTP/1.1Host: cdn.discordapp.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /splashes/1230227842877620359/04b58b5d8c863962ccdac305e5ee1269.jpg?size=1280 HTTP/1.1Host: cdn.discordapp.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v9/auth/location-metadata HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/b9995525a52dc58aecf5.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/0e5029fd9cd4812b6712.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/23a7a3fd6624342117bf.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/assets/591980d24607547de30a.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000; cf_clearance=WAotb24SXfv5tMKii.BOUvfJ3IaKCvfQ3MTtHpCEMRM-1729754152-1.2.1.1-2qBWsm.ssgn2crWBdcDxBnsiDQOMwU9fU8OyXSvkXc4eUDceDMcczvFc_QdHmN3pMUVVZn0a4XqYDzAzP41p67yiklCEcA.PNS5nGSCp8mZR3VLwmtUFr0y5_azxWyzLb6_S1ZwPfChne.pN2VcNtqUTveFZTIM.3ee2_thzzwQR6inlbIp8tqiTuHdixAT1Fp9Dljxr0vD_j8anXSMgsbKnzIvrW6Zw8XlN.v4pqEtZ5M9VwwSz7ZLkMyJjg0PfuUl0xfvprO8fN9KNY42yC6MECtk113PnB7oqhiHiLuQ287FnBOGFYrLmFYW9bvtQvS7cRjBokb2fOn4EOuaSAS6mYaQ_Q38R_psLDe6YXlvKp_0GJbX3_1FsbxEF38wp
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/0e5029fd9cd4812b6712.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/23a7a3fd6624342117bf.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/favicon.ico HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000; cf_clearance=WAotb24SXfv5tMKii.BOUvfJ3IaKCvfQ3MTtHpCEMRM-1729754152-1.2.1.1-2qBWsm.ssgn2crWBdcDxBnsiDQOMwU9fU8OyXSvkXc4eUDceDMcczvFc_QdHmN3pMUVVZn0a4XqYDzAzP41p67yiklCEcA.PNS5nGSCp8mZR3VLwmtUFr0y5_azxWyzLb6_S1ZwPfChne.pN2VcNtqUTveFZTIM.3ee2_thzzwQR6inlbIp8tqiTuHdixAT1Fp9Dljxr0vD_j8anXSMgsbKnzIvrW6Zw8XlN.v4pqEtZ5M9VwwSz7ZLkMyJjg0PfuUl0xfvprO8fN9KNY42yC6MECtk113PnB7oqhiHiLuQ287FnBOGFYrLmFYW9bvtQvS7cRjBokb2fOn4EOuaSAS6mYaQ_Q38R_psLDe6YXlvKp_0GJbX3_1FsbxEF38wp
Source: global traffic	HTTP traffic detected: GET /assets/b9995525a52dc58aecf5.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /icons/1230227842877620359/a_75aa56a5faded73ac41ce0fac1e7d74c.webp?size=64 HTTP/1.1Host: cdn.discordapp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=SY_o2GQjCa7P6M65HjS6nfyxSusLMYv25YeCyzija5A-1729754153-1.0.1.1-l3wjUvH2coKivFD5J3xWsQ_nKbIU2kTzcmmmxWXAJO9df4HZLFHpHCfe1NnF7HBvtmbj7h4RMSWABvpuP0xceA; _cfuvid=N3hSCcd22CvTL40joaijMAXO8_KzV082cK5kPMv_Kpg-1729754153792-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /splashes/1230227842877620359/04b58b5d8c863962ccdac305e5ee1269.jpg?size=1280 HTTP/1.1Host: cdn.discordapp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=vYLHNw.Nz.0egFC2INHCSuGtuirBXKQw7UpSDG3INu0-1729754153-1.0.1.1-Ap2RZI8IDbwOFVhgXHCTob2kpWdEYQE5tUfKta3vnbvJDTMDgSP90Ywy71ATHT_gAjrwpjOZkf7obA1ehSPppw; _cfuvid=Qk1IYigV6O_ediK9fjTO.shSJpxD1tKQmrssHt5Ldoo-1729754153890-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/favicon.ico HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=CPvS493CNwvgbpM&MD=v1L4F4AC HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: keyauth.win
Source: global traffic	DNS traffic detected: DNS query: discord.gg
Source: global traffic	DNS traffic detected: DNS query: discord.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn.discordapp.com

Source: unknown

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 58Content-Type: application/x-www-form-urlencoded

Source: xxImTScxAq.exe	String found in binary or memory: http://185.101.104.122/aimhvibronkz.exe
Source: xxImTScxAq.exe	String found in binary or memory: http://185.101.104.122/aimhvibronkz.exeC:
Source: xxImTScxAq.exe	String found in binary or memory: http://185.101.104.122/aimsemhvibronkz.exe
Source: xxImTScxAq.exe	String found in binary or memory: http://185.101.104.122/aimsemhvibronkz.exeC:
Source: chromecache_153.39.dr, chromecache_183.39.dr	String found in binary or memory: http://discord.gg/fortnite).
Source: chromecache_169.39.dr	String found in binary or memory: https://cdn.discordapp.com/splashes/1230227842877620359/04b58b5d8c863962ccdac305e5ee1269.jpg?size=51
Source: xxImTScxAq.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: xxImTScxAq.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com
Source: chromecache_153.39.dr, chromecache_183.39.dr	String found in binary or memory: https://discord.com/
Source: chromecache_153.39.dr, chromecache_183.39.dr	String found in binary or memory: https://discord.com/blog/important-policy-updates)
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=ar
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=bg
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=cs
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=da
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=de
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=el
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=en-GB
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=en-US
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=es-419
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=es-ES
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=fi
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=fr
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=he
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=hi
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=hr
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=hu
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=id
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=it
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=ja
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=ko
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=lt
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=nl
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=no
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=pl
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=pt-BR
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=ro
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=ru
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=sv-SE
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=th
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=tr
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=uk
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=vi
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=zh-CN
Source: chromecache_169.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=zh-TW
Source: xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270B2C000.00000004.00000020.00020000.00000000.sdmp, xxImTScxAq.exe, 00000000.00000003.1409587782.0000027270B87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunity
Source: xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270B59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunity-0
Source: xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270B59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunity4
Source: xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270B2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunityCC
Source: xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270B59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunityE
Source: xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270B59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunityg
Source: xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270B59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunityn
Source: xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270B59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunityp
Source: xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270B59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunityrosoft
Source: chromecache_169.39.dr	String found in binary or memory: https://discordapp.com
Source: xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270B2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/
Source: xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270B2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/acenv4
Source: xxImTScxAq.exe, 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmp, xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270B2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/
Source: xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270B2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/T;.CM
Source: chromecache_153.39.dr, chromecache_183.39.dr	String found in binary or memory: https://support.discord.com/hc/en-us/articles/4410339366295-Paid-Services-Terms).
Source: chromecache_153.39.dr, chromecache_183.39.dr	String found in binary or memory: https://twitter.com/discord).

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855

Source: unknown	HTTPS traffic detected: 13.107.246.51:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.0.5:443 -> 192.168.2.7:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.7:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.7:50126 version: TLS 1.2

Source: C:\Users\user\Desktop\xxImTScxAq.exe

Code function: 0_2_00007FF6729CCE70 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,

0_2_00007FF6729CCE70

Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF67299F5C0	0_2_00007FF67299F5C0
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF672981560	0_2_00007FF672981560
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF672997CF0	0_2_00007FF672997CF0
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729969B0	0_2_00007FF6729969B0
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729989B0	0_2_00007FF6729989B0
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729A9F6D	0_2_00007FF6729A9F6D
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729A5410	0_2_00007FF6729A5410
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF672993360	0_2_00007FF672993360
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729BD250	0_2_00007FF6729BD250
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF67297D280	0_2_00007FF67297D280
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF67297976B	0_2_00007FF67297976B
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729A28C0	0_2_00007FF6729A28C0
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF672999870	0_2_00007FF672999870
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729C15E0	0_2_00007FF6729C15E0
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF672990630	0_2_00007FF672990630
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729AC600	0_2_00007FF6729AC600
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729B9550	0_2_00007FF6729B9550
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729C05B0	0_2_00007FF6729C05B0
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF67297958D	0_2_00007FF67297958D
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF67297AC2D	0_2_00007FF67297AC2D
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF67297EBA0	0_2_00007FF67297EBA0
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729A7CF0	0_2_00007FF6729A7CF0
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729889C0	0_2_00007FF6729889C0
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729B4A20	0_2_00007FF6729B4A20
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729C5B00	0_2_00007FF6729C5B00
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729AA035	0_2_00007FF6729AA035
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729AA02C	0_2_00007FF6729AA02C
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF672971000	0_2_00007FF672971000
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF67297DE10	0_2_00007FF67297DE10
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729CEEF0	0_2_00007FF6729CEEF0
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729CCE70	0_2_00007FF6729CCE70

Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: String function: 00007FF672998EB0 appears 35 times
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: String function: 00007FF6729D0266 appears 47 times
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: String function: 00007FF672990270 appears 70 times
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: String function: 00007FF672983060 appears 49 times
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: String function: 00007FF67299A360 appears 33 times
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: String function: 00007FF67299A2D0 appears 37 times
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: String function: 00007FF672998DE0 appears 46 times
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: String function: 00007FF67299A440 appears 34 times
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: String function: 00007FF672995B20 appears 322 times
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: String function: 00007FF6729959A0 appears 377 times

Source: classification engine

Classification label: mal60.phis.evad.winEXE@87/170@18/11

Source: C:\Users\user\Desktop\xxImTScxAq.exe

Code function: 0_2_00007FF672982670 GetLastError,_errno,FormatMessageA,strchr,_errno,_errno,GetLastError,SetLastError,

0_2_00007FF672982670

Source: C:\Users\user\Desktop\xxImTScxAq.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7464:120:WilError_03

Source: xxImTScxAq.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\xxImTScxAq.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: xxImTScxAq.exe

ReversingLabs: Detection: 34%

Source: xxImTScxAq.exe

String found in binary or memory: iphlpapi.dllif_nametoindexkernel32LoadLibraryExA\/AddDllDirectory0123456789abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ(nil)(nil)I32I64%ld.%ld$@

Source: unknown	Process created: C:\Users\user\Desktop\xxImTScxAq.exe "C:\Users\user\Desktop\xxImTScxAq.exe"
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://discord.gg/privatecommunity
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1976,i,17008637015188082442,6516935950602150034,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4968 --field-trial-handle=1976,i,17008637015188082442,6516935950602150034,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 --field-trial-handle=1976,i,17008637015188082442,6516935950602150034,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://discord.gg/privatecommunity	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1976,i,17008637015188082442,6516935950602150034,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4968 --field-trial-handle=1976,i,17008637015188082442,6516935950602150034,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 --field-trial-handle=1976,i,17008637015188082442,6516935950602150034,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\xxImTScxAq.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1A66AEDC-93C3-4ACC-BA96-08F5716429F7}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\xxImTScxAq.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Access\Capabilities\UrlAssociations

Jump to behavior

Source: xxImTScxAq.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: xxImTScxAq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: xxImTScxAq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: xxImTScxAq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: xxImTScxAq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: xxImTScxAq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: xxImTScxAq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: xxImTScxAq.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: xxImTScxAq.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\Loader Valorant Aim\x64\Release\EpicGames.pdb source: xxImTScxAq.exe

Source: xxImTScxAq.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: xxImTScxAq.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: xxImTScxAq.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: xxImTScxAq.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: xxImTScxAq.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\xxImTScxAq.exe

Code function: 0_2_00007FF672998690 GetModuleHandleA,GetProcAddress,strpbrk,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,malloc,GetSystemDirectoryA,LoadLibraryA,free,

0_2_00007FF672998690

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro

Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\xxImTScxAq.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-47665

Source: C:\Users\user\Desktop\xxImTScxAq.exe

API coverage: 4.3 %

Source: xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270BBC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}E
Source: xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270BBC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270BBC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270B2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\xxImTScxAq.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-47332

Source: C:\Users\user\Desktop\xxImTScxAq.exe

Code function: 0_2_00007FF6729D0118 memset,GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF6729D0118

Source: C:\Users\user\Desktop\xxImTScxAq.exe

Code function: 0_2_00007FF6729D0118 memset,GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF6729D0118

Source: C:\Users\user\Desktop\xxImTScxAq.exe

Code function: 0_2_00007FF672998690 GetModuleHandleA,GetProcAddress,strpbrk,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,malloc,GetSystemDirectoryA,LoadLibraryA,free,

0_2_00007FF672998690

Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729CFA24 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6729CFA24
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729CFD7C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6729CFD7C
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729CFF24 SetUnhandledExceptionFilter,	0_2_00007FF6729CFF24

Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://discord.gg/privatecommunity	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior

Source: C:\Users\user\Desktop\xxImTScxAq.exe

Code function: 0_2_00007FF6729CFF94 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6729CFF94

Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729A4A90 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,memcmp,closesocket,closesocket,closesocket,closesocket,	0_2_00007FF6729A4A90
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729BB520 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF6729BB520
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729BB780 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF6729BB780
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF672997660 memset,strncmp,strncmp,strchr,htons,atoi,htons,htons,bind,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	0_2_00007FF672997660
Source: C:\Users\user\Desktop\xxImTScxAq.exe	Code function: 0_2_00007FF6729B4A20 calloc,strchr,strncpy,strchr,strncpy,strchr,strtoul,strchr,strtoul,getsockname,WSAGetLastError,free,WSAGetLastError,memcpy,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,free,	0_2_00007FF6729B4A20

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Windows Service	1 Windows Service	1 Masquerading	OS Credential Dumping	1 System Time Discovery	1 Exploitation of Remote Services	12 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 DLL Side-Loading	1 Disable or Modify Tools	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Native API	Login Hook	1 Extra Window Memory Injection	11 Process Injection	NTDS	4 System Information Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Extra Window Memory Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
xxImTScxAq.exe	34%	ReversingLabs	Win64.Trojan.Generic
xxImTScxAq.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://curl.haxx.se/docs/http-cookies.html	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
discord.gg	162.159.135.234	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	unknown
s-part-0023.t-0009.t-msedge.net	13.107.246.51	true	false	unknown
keyauth.win	104.26.0.5	true	false	unknown
discord.com	162.159.136.232	true	false	unknown
cdn.discordapp.com	162.159.135.233	true	false	unknown
www.google.com	172.217.18.4	true	false	unknown
time.windows.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://discord.com/assets/9017b7062734e72bb476.svg	false	unknown
https://discord.com/assets/5067a2ec1b24a6de868c.js	false	unknown
https://discord.com/assets/a5ec2b74d0cc337d4481.svg	false	unknown
https://discord.com/assets/ea8b2ed5e609f40e7f7b.js	false	unknown
https://discord.com/assets/23a7a3fd6624342117bf.svg	false	unknown
https://a.nel.cloudflare.com/report/v4?s=j%2Bvd4db%2FnJKCksUnQfxjBqA4P2wy21wAjR7kq6JYdLd%2FTbNxOzyMaYLuPY17E8B%2FD%2F%2BiDYDVFjxhoHe1BcFjfFi%2ByBAYR84%2FDXlHVVAubpNZo4eIyM3Ue30CgBVX	false	unknown
https://discord.com/assets/1f7f046253c197b5a419.js	false	unknown
https://discord.com/assets/5430e9964fe8364e084d.svg	false	unknown
https://discord.com/assets/ecff74bf4394e6e58dd1.woff2	false	unknown
https://discord.com/assets/d86788be99e870993214.js	false	unknown
https://discord.com/assets/1222195a37d6dd10994e.woff2	false	unknown
https://discord.gg/privatecommunity	false	unknown
https://discord.com/assets/af5116b1db004acbdb8b.svg	false	unknown
https://discord.com/assets/webMinimal.183cbc8427e6b143ce21.js	false	unknown
https://discord.com/assets/f5b8aa3411dfc24ff2e6.woff2	false	unknown
https://discord.com/assets/af6b8f380faee0e9f47d.js	false	unknown
https://discord.com/assets/c1b53be672aac192a996.woff2	false	unknown
https://discord.com/cdn-cgi/challenge-platform/h/g/jsd/r/8d782d30f89d28ab	false	unknown
https://discord.com/assets/sentry.d30fc24f50e5e3e76b3e.js	false	unknown
https://discord.com/assets/914a97ac83e173c66dd7.woff2	false	unknown
https://discord.com/assets/591980d24607547de30a.css	false	unknown
https://discord.com/api/v9/auth/location-metadata	false	unknown
https://a.nel.cloudflare.com/report/v4?s=rXgeSYZAVWwqyspdqjayEeD%2FrdE7MaQTNibYc%2B%2FFbgAWaA1ygQiyKoTuc%2BItTmAHM7Hp%2F9sJw%2FD7fh1kIJLpeqmRTReGybe1ulExOS2I7MClAadhIUValMv3SckZ	false	unknown
https://discord.com/assets/8234e0a75aa9afb205bd.woff2	false	unknown
https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css	false	unknown
https://cdn.discordapp.com/icons/1230227842877620359/a_75aa56a5faded73ac41ce0fac1e7d74c.webp?size=64	false	unknown
https://discord.com/api/v9/science	false	unknown
https://discord.com/assets/b21c5111a12372139409.woff2	false	unknown
https://discord.com/assets/89b7ddebcacbe8dfbd3a.js	false	unknown
https://discord.com/assets/b8160243347055e1f278.js	false	unknown
https://cdn.discordapp.com/splashes/1230227842877620359/04b58b5d8c863962ccdac305e5ee1269.jpg?size=1280	false	unknown
https://discord.com/assets/2597d11c1e039607373e.svg	false	unknown
https://discord.com/assets/2917679ca8a08c390036.css	false	unknown
https://discord.com/assets/410a2166a48c9e482e2a.svg	false	unknown
https://discord.com/assets/94ec0c2b39908933eed3.js	false	unknown
https://discord.com/assets/a6f6204cd40c3c5f5c14.js	false	unknown
https://discord.com/assets/a14c32460cf87caa605c.js	false	unknown
https://discord.com/invite/privatecommunity	true	unknown
https://discord.com/assets/05bd1eb5dea5ee3387f4.js	false	unknown
https://a.nel.cloudflare.com/report/v4?s=CA%2F%2Bv3h9XolPW3KUjjrqt6DE54DE1USdEfaul%2FKmv4xzDrAFstRY%2B0I2PIW74OZhyq0Ac0LBBNlVfeKOh%2BPeNW3LwopfihI3DOxFwT4z0b7Mk34mTPfvg6cJirNW	false	unknown
https://discord.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js?	false	unknown
https://discord.com/assets/0e5029fd9cd4812b6712.svg	false	unknown
https://discord.com/assets/8bd8143eff37936894aa.woff2	false	unknown
https://discord.com/assets/6df906184440a6461f5c.js	false	unknown
https://discord.com/assets/55ad931ed92a15c15709.js	false	unknown
https://discord.com/assets/452d7be36bf4b23241bd.woff2	false	unknown
https://discord.com/assets/d67c5e680608266a1f63.js	false	unknown
https://discord.com/assets/ab03f7053698d417194c.svg	false	unknown
https://discord.com/assets/fdc71c23d09e18e94ce2.js	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.101.104.122/aimsemhvibronkz.exeC:	xxImTScxAq.exe	false		unknown
https://twitter.com/discord).	chromecache_153.39.dr, chromecache_183.39.dr	false		unknown
https://discordapp.com	chromecache_169.39.dr	false		unknown
https://discord.com/invite/privatecommunity?locale=ko	chromecache_169.39.dr	true		unknown
https://discord.com/	chromecache_153.39.dr, chromecache_183.39.dr	false		unknown
http://185.101.104.122/aimhvibronkz.exe	xxImTScxAq.exe	false		unknown
https://curl.haxx.se/docs/http-cookies.html#	xxImTScxAq.exe	false		unknown
https://discord.com/invite/privatecommunity?locale=es-419	chromecache_169.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=ar	chromecache_169.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=ro	chromecache_169.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=ja	chromecache_169.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=ru	chromecache_169.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=bg	chromecache_169.39.dr	true		unknown
https://keyauth.win/api/1.2/T;.CM	xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270B2C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://discord.gg/privatecommunityrosoft	xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270B59000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://discord.gg/privatecommunityCC	xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270B2C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://keyauth.win/api/1.2/	xxImTScxAq.exe, 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmp, xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270B2C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.discord.com/hc/en-us/articles/4410339366295-Paid-Services-Terms).	chromecache_153.39.dr, chromecache_183.39.dr	false		unknown
https://discord.com	chromecache_169.39.dr	false		unknown
https://discord.com/invite/privatecommunity?locale=uk	chromecache_169.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=pt-BR	chromecache_169.39.dr	true		unknown
https://keyauth.win/api/1.1/acenv4	xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270B2C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://discord.com/blog/important-policy-updates)	chromecache_153.39.dr, chromecache_183.39.dr	false		unknown
https://discord.com/invite/privatecommunity?locale=el	chromecache_169.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=th	chromecache_169.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=cs	chromecache_169.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=da	chromecache_169.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=tr	chromecache_169.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=zh-CN	chromecache_169.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=de	chromecache_169.39.dr	true		unknown
https://discord.gg/privatecommunity-0	xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270B59000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://discord.gg/fortnite).	chromecache_153.39.dr, chromecache_183.39.dr	false		unknown
https://discord.com/invite/privatecommunity?locale=lt	chromecache_169.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=en-GB	chromecache_169.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=zh-TW	chromecache_169.39.dr	true		unknown
https://discord.gg/privatecommunityn	xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270B59000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://discord.gg/privatecommunityp	xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270B59000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://discord.gg/privatecommunityg	xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270B59000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://curl.haxx.se/docs/http-cookies.html	xxImTScxAq.exe	false	URL Reputation: safe	unknown
https://discord.com/invite/privatecommunity?locale=en-US	chromecache_169.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=vi	chromecache_169.39.dr	true		unknown
http://185.101.104.122/aimsemhvibronkz.exe	xxImTScxAq.exe	false		unknown
http://185.101.104.122/aimhvibronkz.exeC:	xxImTScxAq.exe	false		unknown
https://discord.com/invite/privatecommunity?locale=nl	chromecache_169.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=fi	chromecache_169.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=sv-SE	chromecache_169.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=no	chromecache_169.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=fr	chromecache_169.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=es-ES	chromecache_169.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=id	chromecache_169.39.dr	true		unknown
https://discord.gg/privatecommunity4	xxImTScxAq.exe, 00000000.00000002.1430687305.0000027270B59000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.159.136.232	discord.com	United States	13335	CLOUDFLARENETUS	false
162.159.138.232	unknown	United States	13335	CLOUDFLARENETUS	false
104.26.0.5	keyauth.win	United States	13335	CLOUDFLARENETUS	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
162.159.135.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
162.159.135.234	discord.gg	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
162.159.129.233	unknown	United States	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.7
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540859
Start date and time:	2024-10-24 09:14:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	47
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	xxImTScxAq.exe renamed because original name is a hash value
Original Sample Name:	c6938e6c34b9124099c93dec5f9487c7.exe
Detection:	MAL
Classification:	mal60.phis.evad.winEXE@87/170@18/11
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 43 Number of non-executed functions: 224
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.101.57.9, 142.250.186.163, 74.125.71.84, 142.250.185.174, 34.104.35.123, 199.232.210.172, 142.250.186.42, 142.250.185.234, 216.58.212.138, 142.250.185.106, 216.58.206.42, 172.217.16.202, 142.250.185.202, 142.250.185.74, 172.217.16.138, 142.250.184.202, 216.58.206.74, 142.250.186.138, 172.217.18.10, 142.250.186.106, 142.250.185.138, 142.250.186.170, 142.250.184.227, 142.250.181.238
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, otelrules.azureedge.net, twc.trafficmanager.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, update.googleapis.com, azureedge-t-prod.trafficmanager.net, clients.l.google.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: xxImTScxAq.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.136.232	S23UhdW5DH.exe	Get hash	malicious	LummaC, Glupteba, SmokeLoader, Socks5Systemz, Stealc	Browse	discord.com/administrator/index.php
162.159.138.232	SecuriteInfo.com.Win32.MalwareX-gen.3620.22364.exe	Get hash	malicious	Unknown	Browse
	S_code_runner.ps1	Get hash	malicious	Unknown	Browse
	cr_asm3.ps1	Get hash	malicious	Unknown	Browse
	cr_asm.ps1	Get hash	malicious	Unknown	Browse
	VvPrGsGGWH.exe	Get hash	malicious	AsyncRAT, XWorm	Browse
	xK44OOt7vD.exe	Get hash	malicious	Unknown	Browse
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse
	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse
	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse
104.26.0.5	vjlICWbvGT.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.7613.15918.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.27133.15456.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.7443.30781.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.FileRepMalware.12632.12594.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.27133.15456.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.16492.21964.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.11163.24254.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.DropperX-gen.5372.31408.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
keyauth.win	SecuriteInfo.com.Win64.MalwareX-gen.7613.15918.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.31663.10814.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	SecuriteInfo.com.Win64.MalwareX-gen.27133.15456.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.7443.30781.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.11163.24254.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	SecuriteInfo.com.FileRepMalware.12632.12594.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.7613.15918.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	SecuriteInfo.com.Win64.MalwareX-gen.31663.10814.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	SecuriteInfo.com.Win64.MalwareX-gen.27133.15456.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.7443.30781.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
discord.gg	SecuriteInfo.com.Win64.MalwareX-gen.18133.14409.exe	Get hash	malicious	Discord Rat	Browse	162.159.130.234
	EUOgPjsBTC.exe	Get hash	malicious	Unknown	Browse	162.159.135.234
	SecuriteInfo.com.Win64.MalwareX-gen.20317.810.exe	Get hash	malicious	Unknown	Browse	162.159.134.234
	SecuriteInfo.com.Win64.Evo-gen.30154.6249.exe	Get hash	malicious	Unknown	Browse	162.159.134.234
	BX7yRz7XqF.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	162.159.135.234
	jKSjtQ8W7O.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	162.159.135.234
	U7TJ7Rq13y.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	162.159.133.234
	Sv6eQZzG0Z.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	162.159.135.234
	https://bafybeihwopeeamsw6gk3vbg3wbftvt3n2qngbzo5a4hlnpvlv4hc3vvmyy.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse	162.159.136.234
	http://bafybeid2klgyiphng6ifws5s35aor57wfi3so6koe2w4ggoacn6gqghegm.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse	162.159.135.234
s-part-0023.t-0009.t-msedge.net	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.51
	https://s.id/closingdocview67111111	Get hash	malicious	HTMLPhisher	Browse	13.107.246.51
	https://www.google.co.nz/url?q=nL206935ZEtyvV206935l&sa=t&url=amp/%69%70%66%6F%78%2E%63%6F%2E%75%6B%2F%70%61%67%65%73%2F%74%68%61%6E%6B%73%2E%68%74%6D%6C#cnlhbi5zcGVuY2VyQHVzLnlhemFraS5jb20=	Get hash	malicious	HTMLPhisher	Browse	13.107.246.51
	https://www.filemail.com/t/cFCAI9C4	Get hash	malicious	HtmlDropper	Browse	13.107.246.51
	gtIVRm5dHl.htm	Get hash	malicious	Unknown	Browse	13.107.246.51
	Ypp1MuoIa1.exe	Get hash	malicious	SmokeLoader	Browse	13.107.246.51
	SecuriteInfo.com.Trojan.GenericKD.74130302.3751.22654.exe	Get hash	malicious	Unknown	Browse	13.107.246.51
	file.exe	Get hash	malicious	IcedID	Browse	13.107.246.51
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.51
	https://www.guidedtrack.com/programs/53o12sc/run	Get hash	malicious	Unknown	Browse	13.107.246.51

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	vjlICWbvGT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	BT-036016002U_RFQ 014-010-02024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3
	Orden de Compra No. 78986756565344657.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	188.114.96.3
	VM2ICvV5qQ.pdf	Get hash	malicious	Unknown	Browse	104.17.24.14
	EL-25-536_40005512_Le Cuivre_23102024.vbe	Get hash	malicious	GuLoader	Browse	104.21.70.11
	OUTSTANDING PAYMENT STATUS 01199241024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	PO-008847332.xlam.xlsx	Get hash	malicious	Unknown	Browse	104.21.53.112
	RFQ_64182MR_PDF.R00.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
CLOUDFLARENETUS	vjlICWbvGT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	BT-036016002U_RFQ 014-010-02024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3
	Orden de Compra No. 78986756565344657.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	188.114.96.3
	VM2ICvV5qQ.pdf	Get hash	malicious	Unknown	Browse	104.17.24.14
	EL-25-536_40005512_Le Cuivre_23102024.vbe	Get hash	malicious	GuLoader	Browse	104.21.70.11
	OUTSTANDING PAYMENT STATUS 01199241024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	PO-008847332.xlam.xlsx	Get hash	malicious	Unknown	Browse	104.21.53.112
	RFQ_64182MR_PDF.R00.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
CLOUDFLARENETUS	vjlICWbvGT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	BT-036016002U_RFQ 014-010-02024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3
	Orden de Compra No. 78986756565344657.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	188.114.96.3
	VM2ICvV5qQ.pdf	Get hash	malicious	Unknown	Browse	104.17.24.14
	EL-25-536_40005512_Le Cuivre_23102024.vbe	Get hash	malicious	GuLoader	Browse	104.21.70.11
	OUTSTANDING PAYMENT STATUS 01199241024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	PO-008847332.xlam.xlsx	Get hash	malicious	Unknown	Browse	104.21.53.112
	RFQ_64182MR_PDF.R00.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	VM2ICvV5qQ.pdf	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.51 20.12.23.50
	https://email.sg.on24event.com/ls/click?upn=u001.7kf5QUY4LGF7Fzt7LGE4bbPPsSPtBC4KXSPVJqWhtiFImaGOc8X-2FzF8FDlXshHtRJ6TIRZ6EeMzJLIlgf-2Fs2kSJOxf8XTG62Elbh9rqy-2FQ2QNZGXB54Mkq5upaOHB9GHJaF-2B3b4F-2FMyEt0RGHLDpLKRhLl9mxjPD0y5Swi37OTA-3DOBST_mhsMQQwIM9hexyWqOlUPbBh1Ydv5cYoDRZfJchLEEeKy4ZjgP9CBDSdvgDFEefqBVXHw4Mv6KQHsP3gT468tApWXvWK-2FeXhqGfYYlnX46U5WmntG47XCU85W-2B7YcCKnv6RkyD-2BGsL6eKQti9UGCTMQ9mNlYRCUnfVenBdKFDHBLCSg5nmfwfVylxfV1LsL0vuEyDgr8SC57Mq-2BhfexPfdy0Rg72muov-2F70SqaHW8j0XfAmx9zQy8hYRRlnIIGbyzjoQcdYcq0btsMQpdS6jNo-2BNvozXopiqu0Jz-2B-2B25Gyoj-2FyIelIDkNiGA84aUyGyfbMNmoNmmLB38ufi9uQKhxSQ-3D-3D	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.51 20.12.23.50
	FedEx Shipping Document_pdf.html	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.51 20.12.23.50
	MV EAGLE EYE RFQ-92008882920-PDF.vbs	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.51 20.12.23.50
	Urgent Quotation documents One Pdf.vbs	Get hash	malicious	AgentTesla	Browse	184.28.90.27 13.107.246.51 20.12.23.50
	Circular_no_088_Annexure_pdf.html	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 13.107.246.51 20.12.23.50
	RTGS_UCB_DCCB_docx.html	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 13.107.246.51 20.12.23.50
	https://t.co/yXelyYqHRk	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.51 20.12.23.50
	http://jedox-couriers.com/5g/domain.php/domain..html?#infoland@hdel.co.kr	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 13.107.246.51 20.12.23.50
	https://linkednnn.weebly.com/	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.51 20.12.23.50
3b5074b1b5d032e5620f69f9f700ff0e	vjlICWbvGT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	BT-036016002U_RFQ 014-010-02024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.0.5
	EL-25-536_40005512_Le Cuivre_23102024.vbe	Get hash	malicious	GuLoader	Browse	104.26.0.5
	OUTSTANDING PAYMENT STATUS 01199241024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.0.5
	scan_doc20241024.vbs	Get hash	malicious	Remcos	Browse	104.26.0.5
	RFQ_64182MR_PDF.R00.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.26.0.5
	FedEx Shipping Document_pdf.html	Get hash	malicious	Unknown	Browse	104.26.0.5
	Urgent Quotation documents One Pdf.vbs	Get hash	malicious	AgentTesla	Browse	104.26.0.5
	WBPWLAj09q.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.26.0.5
	Adeleidae.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.26.0.5

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	87973
Entropy (8bit):	5.125806607183933
Encrypted:	false
SSDEEP:	1536:f0kGwo/3g1MGEN6UCSQyYHhU58xxfrDX/5CF+gD58G3LpV9H5B7va:f0kGDZc
MD5:	E05640582E20F17E0F1797160B67DCD4
SHA1:	DCB27383F5836437E5433C7CCB5981E94826EE00
SHA-256:	E9DEEBCC271633C282AB3FE440CE81A196ECE4F402804FE8940030F98C563475
SHA-512:	60CDDA59E85FDED81B351614DAF3D40B30F939F7F8D9B586F516165699822E8F07F344CDD3709DCF6ADA350C725330DF26B6947322F154AB54D02C5AF3AAD71B
Malicious:	false
URL:	https://discord.com/assets/b9995525a52dc58aecf5.svg
Preview:	<svg width="1440" height="900" viewBox="0 0 1440 900" preserveAspectRatio="xMinYMin slice" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#a)"><g clip-path="url(#b)"><path d="M1440 0H0v900h1440V0Z" fill="url(#c)"/><path d="M1440 0H435.551v620.81H1440V0Z" fill="url(#d)"/><path d="M1440 341.601H484.351v558.38H1440v-558.38Z" fill="url(#e)"/><path d="M1440 0H427.5v690.995H1440V0Z" fill="url(#f)"/><path d="M787.663 810.02c330.987-141.179 530.547-416.834 445.727-615.692C1148.57-4.53 811.492-51.288 480.502 89.891 149.512 231.07-50.048 506.725 34.772 705.583c84.821 198.858 421.901 245.616 752.891 104.437Z" fill="url(#g)"/><path d="M1024.18 825.565c290.6-123.952 456.96-386.723 371.57-586.916-85.39-200.193-390.19-261.999-680.792-138.047-290.602 123.952-456.959 386.724-371.569 586.917 85.389 200.193 390.19 261.998 680.791 138.046Z" fill="url(#h)"/><path d="M673.907 771.815c264.238-112.707 429.363-319.136 368.823-461.073-60.538-141.936-323.823-165.631-588.061-52.924C190.431 370.5

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3146
Entropy (8bit):	4.484082045212369
Encrypted:	false
SSDEEP:	48:C4LO/K7oWBkomgBkRzd0kJBJkI8JkINGD/dYk2kahkzd/FnLgkpmZ5ZOE83VCn:RO/IS53JBJbKbN4WQbMRZmEAI
MD5:	81084FF5A27B6E6FF487E479C37D1660
SHA1:	81A274F69A1358F85715A0FEA227730D795CB353
SHA-256:	075DE1D6EA4FB470197A88BA371F60F70B819B250CB5AF8BD6A4794B1A9CA4A1
SHA-512:	CCCD00A5C013B130BE0A8466F903F7EEE9306518DFAA8758849027EBC1829EA2A6B7516E4D2070B110A12EC7EB559E3B75D256AD1B07BE3FD8595C0E430DC0D5
Malicious:	false
URL:	https://discord.com/assets/ba88bbd1342d3f000e33.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 90 59.19">. <defs>. <style>. .cls-1{fill:#6a94ff}.cls-2{fill:#a9c7ff}.cls-3{fill:#202225}. </style>. </defs>. <g id=".._2" data-name=".. 2">. <g id="Layer_1" data-name="Layer 1">. <path class="cls-1" d="M89.59 19.89 84.93 8.38a5.51 5.51 0 0 0-7.19-3l-5.67 2.25A12.42 12.42 0 0 0 56 .91L45.48 5.16c-1.84 4.11-5.48 9.72-11.59 9.52a8.55 8.55 0 0 1-5.51-2.13c-.12-.11-.24-.22-.34-.33l-12.66 5.13a12.42 12.42 0 0 0-6.9 16l-5 2A5.52 5.52 0 0 0 .4 42.61l4.67 11.51a5.51 5.51 0 0 0 7.18 3l5.64-2.28A12.43 12.43 0 0 0 32 58.28l40.54-16.44a12.43 12.43 0 0 0 7.73-12.22l6.28-2.54a5.52 5.52 0 0 0 3.04-7.19ZM11.65 52.94a2.76 2.76 0 0 1-3.59-1.52l-3.63-9A2.76 2.76 0 0 1 6 38.87l4-1.65 5.69 14.07ZM22.33 39.6a3.72 3.72 0 1 1 2.06-4.85 3.71 3.71 0 0 1-2.06 4.85Zm33.36-1.55-11.77 4.77A10.61 10.61 0 0 1 30.11 37l-3.33-8.23A4 4 0 0 1 29 23.56l23.31-9.44a4 4 0 0 1 5.18 2.19l3.63 9a9.8 9.8 0 0 1-5.43 12.74ZM67.49 21a3.73 3.73 0 1 1

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2058
Entropy (8bit):	4.614306214221163
Encrypted:	false
SSDEEP:	48:CVHe7HtOty0VulV1/8CXP0Cjek7aj4clug9ai:iANEyxx8UPTXaj4cogIi
MD5:	E1349377226366F95F85AB9EAC4586D3
SHA1:	9A3A00B6E6AB0A240363F4E4DB2F5288227FF76B
SHA-256:	2CA673A9914A35A230469A8A0FD6B4DB293B236DEA391633B53339AFE577A92E
SHA-512:	7C16967D1960CDE4914F71B6FE347A7764AAED42366A87920597D225F3874B5B34A00C5089564BEBF0A919C419049DB99B27128CC81BC28A1492460FD199F9E7
Malicious:	false
URL:	https://discord.com/assets/a5ec2b74d0cc337d4481.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 45 45" xml:space="preserve">. <defs>. <clipPath id="a" clipPathUnits="userSpaceOnUse">. <path d="M0 36h36V0H0v36Z"/>. </clipPath>. <mask id="b">. <g>. <rect x="0" y="0" width="100" height="100" fill="white" />. <path d="M11.708 29.849a1.296 1.296 0 1 0-2.591-.001 1.296 1.296 0 0 0 2.591 0" fill="black"/>. </g>. </mask>. </defs>. <g>. <g>. <g clip-path="url(#a)" transform="matrix(1.25 0 0 -1.25 0 45)" mask="url(#b)">. <g>. <path d="M12.75 18.25c1.226-2.195 1.855 1.361 9.313 2.625 7.457 1.264 13.728-4.454 13.859-5.413C36.053 14.504 31.474 6 26.459 6h-15.71C6.607 6 3.727 13.224 6.75 17.438c0 0 4.5 3.5 6 .812" fill="white"/>. </g>. <g>. <path d="M13.008 17.864C8.02 10.927 6.968 6 10.75 6c-4.142 0-6.577 6.187-4.468 11.031.463 1.064 1.758 2.492 1.758 2.492l4.18.008c.162-.32.598-1.366.79-1.667" fill="white"/>. </g>. <g>. <path d

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13325)
Category:	dropped
Size (bytes):	13374
Entropy (8bit):	5.33229367944175
Encrypted:	false
SSDEEP:	192:c9jPMDYeG0dPbPDjzw4WDhiElYrskCLdHWQBC7dr1m+8LBpDtOnyUotvLfQE2u:c9jPMRLjZ0usbxwdr1QBpDtOy3JT
MD5:	D0C788B157FF96A2DD902C97BFC889F6
SHA1:	6CDE0BD611B34B15CA15437CA5AC4F77DE01ADA8
SHA-256:	05A00FBAFFC4A7254C9B631FF0E81BE546DC275BE1D6F992C36849222D0B73F7
SHA-512:	170615E3DE829D517662BE32C762B76B013163FA040C2EEDF89C865A9CEE1CEEDA7EE305BE27CD3A724832571A94B5A26FB3BB9D9A1D1C5386081F206A1E1436
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["78187"],{526988:function(t,n,r){var e=r(354848),o=r(938507),i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not a function")}},24033:function(t,n,r){var e=r(622281),o=String,i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not an object")}},953326:function(t,n,r){var e=r(299623),o=r(980855),i=r(49693),u=function(t){return function(n,r,u){var c,f=e(n),a=i(f),s=o(u,a);if(t&&r!=r){for(;a>s;)if((c=f[s++])!=c)return!0}else for(;a>s;s++)if((t\|\|s in f)&&f[s]===r)return t\|\|s\|\|0;return!t&&-1}};t.exports={includes:u(!0),indexOf:u(!1)}},332916:function(t,n,r){var e=r(581031),o=e({}.toString),i=e("".slice);t.exports=function(t){return i(o(t),8,-1)}},381740:function(t,n,r){var e=r(740362),o=r(666061),i=r(347722),u=r(97131);t.exports=function(t,n,r){for(var c=o(n),f=u.f,a=i.f,s=0;s<c.length;s++){var p=c[s];!e(t,p)&&!(r&&e(r,p))&&f(t,p,a(n,p))}}},251069:function(t,n,r){var e=r

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 64x64, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	1066
Entropy (8bit):	7.8048030316845365
Encrypted:	false
SSDEEP:	24:w0Hm4yTnGeVfIFHU9HFbYMdL36oSMkKwzSwgvyQfpbfzu:w0Hm4AxWFHYeMZ36oSMS2wgpnu
MD5:	BD7895F71FAD6D9263981408ECCB3EF2
SHA1:	0DECC92425C58B121B6117B90EBFC89DE7397B8C
SHA-256:	927248AC3A7C831DC3DB7E45CEA4A7112F5BA02309227DDE46454F07CF773DB8
SHA-512:	CE7EBDA208426FBFC7E1A3F00ADD50A3944543385D6D2F0F29C1ABFB1653A1C8539D32C8C41FCA0BA6D71F9C65E09D21C6ADE661CD3719D5E7FF4A372FF0A32F
Malicious:	false
URL:	https://cdn.discordapp.com/icons/1230227842877620359/a_75aa56a5faded73ac41ce0fac1e7d74c.webp?size=64
Preview:	RIFF"...WEBPVP8 .........@.@.>m..F$"..0......l....z..0?K.w....y.s..............S.?......h.....2>......j..{+....`...D. .........&...!..5w.8.S..VH.:b...-l..A_.......NVl0e..t..Q4hl..tCv...cB.&H......0`.>.]..(.n<6L]u.....M...%WN...>.......".../a .7FT.X..-.:....?.6Z[oO=^.==.).............y...Cn.}..0.fh.3.a....=k....O.^J4'..W."W....'...0.3.~.H..=....CT..W.kTVm.1.D.Rx6@.J..<.]~{4..h....u.42P........6vk.S...eF..fL..!..t0zO..h..Z....B....t.e..w:.......)...._.`E..-r..'"O.D..N.e.u..vp@...dd.............H.$.C.........c...ay.....I,c.2i..a.s.H...&..<:.3..!../..............?...rb"..9..r.q..g.{..E.A.].Rk.y..p[%..m.E]._m.........\....."<S.?......^........qU...L......4LE.q...?......E.n.p%5.54...f....5...g]...'...O....S.>+..DM4o.=.=.....[..5b..9...?y..cF.b...1..+.y...o.}.......>T=..........I....uc........^.....yT0...=#..i{....i..M1;...i.....g...3...g.~.].;.....0.Na......0.F....G.....&.[.+..>\|...9=..P......I.A.R.bT....8...C^q.N.....e;[..bm.{}.[P.y...

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	24565
Entropy (8bit):	6.000976601202208
Encrypted:	false
SSDEEP:	384:xakxHbO0x9ipfSEuH44B445H44Q544Aq44Q4P44ZF944Q4Q4424Qb444nxWl444p:xZxH5ripqEuH44B445H44Q544Aq44Q4+
MD5:	EC2C34CADD4B5F4594415127380A85E6
SHA1:	E7E129270DA0153510EF04A148D08702B980B679
SHA-256:	128E20B3B15C65DD470CB9D0DC8FE10E2FF9F72FAC99EE621B01A391EF6B81C7
SHA-512:	C1997779FF5D0F74A7FBB359606DAB83439C143FBDB52025495BDC3A7CB87188085EAF12CC434CBF63B3F8DA5417C8A03F2E64F751C0A63508E4412EA4E7425C
Malicious:	false
Preview:	............ .h...F... .... .........00.... ..%..V......... ..$...:..(....... ..... ..........................................dX2.dX..dW..dW..dX..dX..dX..dX2.........................dW..dW..dX..eX..eX..eX..eX..eX..eX..dW..dW..dW..............dW..dX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eW..........dW..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eW......dX2.dW..eX..eX..\|q......eX..eX..eX..eX......\|q..eX..eX..eX..eX2.dW..eX..eX..........................................eX..eX..eW..dW..eX..eX..........................................eX..eX..dW..dW..eX..eX..............eX..........eX..............eX..eX..dW..dW..eX..eX..........................................eX..eX..dW..dW..eX..eX..~s..................................~s..eX..eX..dW..dW..eX..eX..eX..................................eX..eX..eX..dW..dX2.eX..eX..eX..h[..........{p..{p..........h[..eX..eX..dW..eW2.....dX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eW..........eX..dX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eW..e

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21762)
Category:	dropped
Size (bytes):	21811
Entropy (8bit):	5.462655463719556
Encrypted:	false
SSDEEP:	384:f1bjtqrVapZjquHCWnJcJhcby8XziQBy6HUKVMov5hHKs80K:JjtOVaJDnJcPc+EWQ8EM65RR8l
MD5:	0FBB77D1B69F18DF0FDCF836DE1C4106
SHA1:	E8CE4037B97732809F1E1BF24992959C678F2118
SHA-256:	279E49A00A41A18545CF319B5A8B571FD48CFCC4B78A361BBE75A33CE7A4F71A
SHA-512:	F73E3B25561D0D3307C7DD9D505F84101897CFA70737D757AED8D95BDC6A2CE116FD114674DD0BBE666AABE2176B0EEF150A5D4EE2C7C3CCE815A5CA73215D03
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["71984"],{772425:function(t,r,n){var e=n(933676),o=n(938507),i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not a constructor")}},603528:function(t,r,n){var e=n(838957),o=TypeError;t.exports=function(t,r){if(e(r,t))return t;throw o("Incorrect invocation")}},212036:function(t){t.exports="undefined"!=typeof ArrayBuffer&&"undefined"!=typeof DataView},192291:function(t,r,n){var e,o,i,u=n(212036),f=n(325008),a=n(161581),c=n(354848),s=n(622281),y=n(740362),p=n(974971),h=n(938507),v=n(251069),d=n(859209),g=n(4340),l=n(838957),A=n(144748),w=n(276321),x=n(641236),b=n(457507),T=n(644659),E=T.enforce,I=T.get,R=a.Int8Array,m=R&&R.prototype,O=a.Uint8ClampedArray,M=O&&O.prototype,F=R&&A(R),U=m&&A(m),_=Object.prototype,L=a.TypeError,B=x("toStringTag"),C=b("TYPED_ARRAY_TAG"),S="TypedArrayConstructor",P=u&&!!w&&"Opera"!==p(a.opera),V=!1,N={Int8Array:1,Uint8Array:1,Uint8ClampedArray:1,Int16Array:2,U

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (12394)
Category:	downloaded
Size (bytes):	12443
Entropy (8bit):	5.622820681358379
Encrypted:	false
SSDEEP:	192:KO87cE+wCFgcmzFFLiMx+vomnNST2kYLAZVeOhRido3ARvVppn8pZl:KO6cE+wCFgFLGvomNSBYL1eROY
MD5:	1FB8462302F6FBB9323F187505F5393F
SHA1:	B1FE31671174AA0BC7DFBFCC942AEFBFCBDB55BA
SHA-256:	CBFC3F32A1493FB38FD92BE4BC61035CB4948B6CF91AE5CC0038006AC753EA98
SHA-512:	22B96DA64E536EE01CDC30946AF83FCA8BF939A41443C8E9F7E7D296388FC94E3BED12E1FCE20B7E5E31E7611B1DC4CE235DBD1B3B61CC4A6F77350749C86BFF
Malicious:	false
URL:	https://discord.com/assets/a14c32460cf87caa605c.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["95393"],{392459:function(e){e.exports="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 66 38' width='66' height='38'%3E%3Crect x='0' y='0' width='66' height='38' style='fill: rgb(0, 0, 0); stroke: rgb(0, 0, 0);'%3E%3C/rect%3E%3C/svg%3E"},850259:function(e){e.exports="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='6.122 5.864 259 50' width='259' height='50'%3E%3Cpath fill='%23000000' fill-rule='evenodd' d='M 68.122 11.864 L 192.122 11.864 C 193.779 11.864 195.122 13.207 195.122 14.864 L 195.122 28.864 C 195.122 30.521 193.779 31.864 192.122 31.864 L 68.122 31.864 C 66.465 31.864 65.122 30.521 65.122 28.864 L 65.122 14.864 C 65.122 13.207 66.465 11.864 68.122 11.864 Z M 68.122 35.864 L 262.122 35.864 C 263.779 35.864 265.122 37.207 265.122 38.864 L 265.122 48.864 C 265.122 50.521 263.779 51.864 262.122 51.864 L 68.122 51.864 C 66.465 51.864 65.122 50.521 6

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	168789
Entropy (8bit):	5.612789333447181
Encrypted:	false
SSDEEP:	1536:lvVvKVPI1oqgO/usjA1vkY0JCxf7UG/9rHUQNbsbkb5a05VGOEc2+hzuy6fvxO7a:uVPIgPvEc7N/9rNhbYy6w7XvXcZ
MD5:	3B74671903D935A08DC04ACEF440C188
SHA1:	7B2C8D8AE72E5E2DA1BA4440722810565E11084C
SHA-256:	4AC4D0F31456B9D1741A52E5C54089952219E0C2287D83B81F12C94468DB3B03
SHA-512:	7F465558B1D640EEC9639921A70C0C0A9AE8BD7F95D0EE098B0553A7B84C5B983A9140FA48C45453FD8E39FAB7188000A2A0628300C4CEF9FE3F2742C20F1C62
Malicious:	false
URL:	https://discord.com/assets/bd0ab83c61025d7c7000.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["41315"],{863942:function(e,t,n){var s=n(22092);(0,n(192291).exportTypedArrayStaticMethod)("from",n(12367),s)},70519:function(e){e.exports="/assets/76a4af59aa173c519461.svg"},806848:function(e){e.exports="/assets/6183fdc13d8046fd5bda.svg"},512266:function(e){e.exports="/assets/a2d51a24d014f52f83a6.png"},105020:function(e){e.exports="/assets/89ea0e62d0f8ffa67a17.svg"},211095:function(e){e.exports="/assets/86755fd1deda5cb45518.svg"},640356:function(e){e.exports="/assets/3880dc73d6be9d91ef36.svg"},515695:function(e){e.exports="/assets/450a761db3bfe89ca9b9.png"},892235:function(e){e.exports="/assets/48f03d965f1e82275006.svg"},375673:function(e){e.exports="/assets/3cf7f333e815240d3294.svg"},73962:function(e){e.exports="/assets/ed7318a94c14ce41d11d.svg"},689411:function(e){e.exports="/assets/831c999494cb5e095eae.svg"},2984:function(e){e.exports="/assets/0e5029fd9cd4812b6712.svg"},575703:function(e){e.exports=

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20669)
Category:	dropped
Size (bytes):	20718
Entropy (8bit):	5.5874718820742
Encrypted:	false
SSDEEP:	384:C4bQLjJHzjDcPDvYcJG9SAcksEi4aim6pvnVETji:DbQtjorYqG9e426PEa
MD5:	A2754ACCDA171158F8F581AD49DFBB9C
SHA1:	F619D690525B7ECA8BF70B9C24CBC58A3E092F1F
SHA-256:	606458816E822D1D0904C62D1E90C1595419CD92377055C63812BA63E00C3CDB
SHA-512:	F752422F8DE3B430832E43758F4C117D0D1FFB863CEDB95AA354635CC82DCC73F1371DA51626FFD76345D600970338DA4A2CD8F10739445C0123D990BD732CD5
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["25788"],{533307:function(e,t,n){let i;var s=n(544891),r=n(570140),l=n(728345),o=n(812206),a=n(625128),d=n(335131),u=n(669079),c=n(981631),_=n(474936);async function E(e){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1],n=arguments.length>2&&void 0!==arguments[2]&&arguments[2];r.Z.dispatch({type:"GIFT_CODE_RESOLVE",code:e});try{let i=await (0,u.bT)(e,t,n);if(null!=i.application_id&&i.application_id!==_.CL){let e=o.Z.getApplication(i.application_id);if(null==e)try{await l.ZP.fetchApplication(i.application_id)}catch(e){}}if(i.application_id===c.XAJ)try{await (0,d.jr)(i.sku_id)}catch(e){}return r.Z.dispatch({type:"GIFT_CODE_RESOLVE_SUCCESS",giftCode:i}),{giftCode:i}}catch(t){throw r.Z.dispatch({type:"GIFT_CODE_RESOLVE_FAILURE",code:e,error:t}),t}}i=n(775644).Z,t.Z={resolveGiftCode:E,async fetchUserGiftCodesForSKU(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:null;r.Z.dispatch

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	137
Entropy (8bit):	4.7861988241054
Encrypted:	false
SSDEEP:	3:t6WH7W+IjSKcvUVYEo0LvDmJS4RKb5KVErcHNDPqdcJqGrqL0:t6AbzUOC3mc4slmNDiiAe
MD5:	7D883BA72B5DBC0229F5D1980205EE34
SHA1:	678BDA23DF97E8B9C3B15E71C41E7B215D043F22
SHA-256:	53A0F1F10860A6E4CF9BD3B4949C5DDE68888DBC96BA0DA1020C5958EFC214A5
SHA-512:	E040F62517C951A0AB2ABC5038F22456E5862166E2A2346345464B9C4B63271CFBD1220BB14D2C39D7FACFD008848ACE682420F1EFE9F4F29265D7177A3C7E16
Malicious:	false
Preview:	<svg fill="none" height="12" viewBox="0 0 12 12" width="12" xmlns="http://www.w3.org/2000/svg"><path d="m5 2h2v8h-2z" fill="#fff"/></svg>

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2701)
Category:	dropped
Size (bytes):	2750
Entropy (8bit):	5.460366645013334
Encrypted:	false
SSDEEP:	48:F0fzk02vWrc1AKTMSTEcr9rTOLBsmPBo/6XgpdgwrIsi5dEk+MQwq2kWkGRv6hvr:ek02hfMXcKs+lXyisi5CkiPrWk+Ch/Ew
MD5:	390A7AB1F964AA8CB1B87DD13732C3BC
SHA1:	CEA52AC6FA0CDF49A18D51C8CD8A5C4FB52DEAC9
SHA-256:	BEDD382930BA4E10DFA902BF833195911F82E754223441446E9D7CC45B01110F
SHA-512:	4B799488E35C5B933E9B1BA6AB335E2EAD6D625D3DC1FEC19DD80F48B9B7996171BEC24513095F3F1BAA9C8B7675FA4E527B763AEED26B69273BF2DCED014D3F
Malicious:	false
Preview:	(()=>{"use strict";var t={137920:function(t,r,n){var e,i;n.d(r,{J:function(){return u},z:function(){return e}}),(i=e\|\|(e={}))[i.NONE=0]="NONE",i[i.SOCIAL=1]="SOCIAL",i[i.CASUAL=2]="CASUAL",i[i.COMPETITIVE=3]="COMPETITIVE",i[i.CREATIVE=4]="CREATIVE",i[i.VERY_HARDCORE=5]="VERY_HARDCORE";let u={0:"NONE",4:"NONE",1:"CASUAL",2:"CASUAL",3:"COMPETITIVE",5:"COMPETITIVE"}},945124:function(t,r,n){n.d(r,{y:function(){return i}});var e=n(137920);function i(t,r){let n=0;return null!=r.games&&(n+=2r.games.filter(r=>t.games.includes(r)).length),null!=r.playstyle&&(r.playstyle===t.playstyle?n+=2:e.J[t.playstyle]===e.J[r.playstyle]&&(n+=1)),null!=r.traits&&(n+=2Array.from(r.traits).filter(r=>t.traits.includes(r)).length),n}},866762:function(t,r,n){n(312677);var e=n(945124);self.addEventListener("message",t=>{var r,n;let{data:{unsortedClans:i,id:u,criteria:o}}=t;let a=(r=i,n=o,r.map(t=>({...t,affinity:(0,e.y)(t,n)})).sort((t,r)=>{var i,u;let o=null!==(i=r.affinity)&&void 0!==i?i:(0,e.y)(r,n);return o-

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	113
Entropy (8bit):	4.460750616283363
Encrypted:	false
SSDEEP:	3:YGKjl8jwDEYRrajpHV+wJ6ARORzACDEYkayjY6v:YGKjDRrajpHV9LorMcE
MD5:	30B15D37E2F2C6C09F35BCC56B64571A
SHA1:	A5566ADA13410C39A4059BEC0FF59D51316D89CD
SHA-256:	BE58D93E5BC2C48B3FB9C87BD7140109630195E84CCE67701FCCABCF5256BFE0
SHA-512:	EE8E8192B3120D7A2FC9DCE3585D87FAAF689B2E03046C8B7F533FE3CBA408BF0E8614CA2AACD6ED21A206B4B461ECA507D5B38D01839CA9AC5B93971D1F7B10
Malicious:	false
URL:	https://discord.com/api/v9/auth/location-metadata
Preview:	{"consent_required":false,"country_code":"US","promotional_email_opt_in":{"required":false,"pre_checked":false}}.

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	1108
Entropy (8bit):	5.359578028959659
Encrypted:	false
SSDEEP:	24:Y74WU4bejvfkjyDEfXgAh/4ACjsY384W9iiex4grjh:Y741gerKyDEfbftY384Swx4UN
MD5:	E2CD13D6C4B1EF7E464FD22FBC18BA56
SHA1:	478AC70BFFF328092BC4A88898AD5ECB7232AB23
SHA-256:	B48B77DEC8C7D5A0953A7F8F06E363884387239A5A3BF9B9BD63945B68FE3A2B
SHA-512:	53F927063C760D199A8A11733AF3CB821C53BEF30EFAF4D113970CDE2AA6791E1FBED06EB947A707CC4316CAFA799CAE1B88A00280C05C6AE89BBF48C3B84A4C
Malicious:	false
URL:	https://discord.com/api/v9/invites/privatecommunity?with_counts=true&with_expiration=true
Preview:	{"type":0,"code":"privatecommunity","expires_at":null,"guild":{"id":"1230227842877620359","name":"\ud835\udc0f\ud835\udc11\ud835\udc08\ud835\udc15\ud835\udc00\ud835\udc13\ud835\udc04 \ud835\udc12\ud835\udc13\ud835\udc0e\ud835\udc11\ud835\udc04 \ud83d\udd10","splash":"04b58b5d8c863962ccdac305e5ee1269","banner":"0ada4913f44d405e7a85ad7d492c34fd","description":null,"icon":"a_75aa56a5faded73ac41ce0fac1e7d74c","features":["BANNER","PRIVATE_THREADS","ROLE_ICONS","THREE_DAY_THREAD_ARCHIVE","MEMBER_PROFILES","ENABLED_MODERATION_EXPERIENCE_FOR_NON_COMMUNITY","ANIMATED_BANNER","SOUNDBOARD","COMMUNITY","ANIMATED_ICON","NEWS","INVITE_SPLASH","VANITY_URL","SEVEN_DAY_THREAD_ARCHIVE"],"verification_level":4,"vanity_url_code":"privatecommunity","nsfw_level":0,"nsfw":false,"premium_subscription_count":56},"guild_id":"1230227842877620359","channel":{"id":"1230229306408697856","type":0,"name":"\ud83c\udf10\u30fb\ud835\udc12\ud835\udc08\ud835\udc13\ud835\udc04-\ud835\udc0f\ud835\udc11\ud835\udc08\ud835\ud

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 39424, version 2.66
Category:	downloaded
Size (bytes):	39424
Entropy (8bit):	7.995696618521677
Encrypted:	true
SSDEEP:	768:RtWd6RsrMjeX+oUMPzo4niAVyynUFTyEatQHzV2h2TzpLJD5JoswdZB:/y6RsbDRzookyncNMQHzAALRovL
MD5:	7F63813838E283AEA62F1A68EF1732C2
SHA1:	C855806CB7C3CC1D29546E3E6446732197E25E93
SHA-256:	440AD8B1449985479BC37265E9912BBF2BF56FE9FFD14709358A8E9C2D5F8E5B
SHA-512:	AAEA9683EB6C4A24107FC0576EB68E9002ADB0C58D3B2C88B3F78D833EB24CECDD9FF5C20DABE7438506A44913870A1254416E2C86EC9ACBBCC545BF40EA6D48
Malicious:	false
URL:	https://discord.com/assets/ecff74bf4394e6e58dd1.woff2
Preview:	wOF2..............\|`.......B..........................Z.. .`..P..B..W.....,..U.6.$..`..r.. ..n..F..5[.V...n.<..j.......n....G...T...asj...nV..W........L6.0...U+.....5.M3gx..j.Ic.&..- ...<"....r..N(B..0..2`..(TI0\|.N..n`..W..b....\|.gX....={...S\..C...J...._.RY..dR...\.>.Z...yG.F.9.i...vn..!F.U....1.-u.....Z.S...k....0\|..2.$D..<L..E.....H.p.....]..Lu.......t.2..Mq.B.+..r}.....&XBU/...T."..?U'T.2....\|J]...!....C2e.\I..PQ-+s.....5..G.?b.,`. )....s..A........)..z.".U.=....".M..m...c...HQs..Q...]..bE...8..d8.C233..p..l.&"C../%2R......s.$..@....1....J]U.....w..G0.....l..X......L.......z...)rD../...r.LC.T.$A. .. A.Y!.6...It....jG.t..w./...y.X..;......~_..[...^9'.B...#..Ol.....f....F.b....g?...x.-.....i.-Kx...U.k.JG..6.q:..1.a....?....f......m.....K3...4=UK....t...o..s.Dm.9.n./.._K..JSM...T...3.H........6"3...w..>.Kb.g..............F@..E.R.+%<G..U.\|6.....(S..MRt...zy.O..#P..........X.t.uj...s....#z..F...X..U.5.cT).Q...Y....pa.z.

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 187596, version 2.459
Category:	downloaded
Size (bytes):	187596
Entropy (8bit):	7.998767209907151
Encrypted:	true
SSDEEP:	3072:K0d28YLkf9Vu/DwPCe7XSk5tMaLtI70HVGkQdd7gOnhXfCdFJYC7Ofrgm6ME+y8L:vw8YLkf9Vu/DoXHtMaJI84kQn7gOd6d+
MD5:	E55012627A8F6E7203B72A8DE730C483
SHA1:	4C43B88403EC9C3053D74B4C502BCAF99F594C57
SHA-256:	8390503760C8F26556001A28E7D95E4A237A4780E7CEEEBF0853CE252FDE4BA8
SHA-512:	05BFB6311B7F78F8F85E43F3C9C87447138237B8897C68EFFA4C877509296F0A7252070F8BBA79C6561FF91C6759058F0DA5A10C1DB19C1FF0443FEE49BF62A5
Malicious:	false
URL:	https://discord.com/assets/914a97ac83e173c66dd7.woff2
Preview:	wOF2...............P...j..................................v.`..:..... ....6.$...@...D.. ......\..[.H........{....5....q..eH...Z...x.v..%U....6.~..9 ..Z..v6.(.L.....g.=l..d.....q4....................y..^~...i...LA.j...y "..@p.9.A...(.O,....B.X%O.J.....O.h.`.A..3.-.6.....I......30.Fs.....N.%h..~.8.7...(...Pkq.{...+..$..\k?^@.z>...3.....>r..W....3.nk..Oz.g.F!.v...!...m..".). .u`........._EU....d!...]#.`..}..KsP.]=.k..).N...DE....#Ae......h'..9.V.....N.6.....w....zA%A.. G.G.J1.@..{ym.....Cx......D+UE...:..x.\|r\|fG..0iX..31O/..\..\|...b-.&yIq..].".6].N..!u...5..hG.k..x.Z..Mr.6@2).t..v......T....2<XA.m.c..-....P.g;...H.p....v..0..:.nR.u.~........!..c..-!4..S.J1p....D...z..%......_..,.2..h....W..{..'A..(....9.<...z!B.&.B2....}.(.!$.{./.....K.v7...#..#~.u...b;....2.}0dV.$.y.?.=.....T%`..+........h.Gi\.S.2..G.Y.fp..h..`.9.I..D..G_.OU.<r.<.0.A}..J.2....i..b..4.....Z;..V:+....;......S!..............1..T....0.^bE..Z\|N}..<.....Y..O..>+.ss.y .......~....t...9$.m

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9310)
Category:	downloaded
Size (bytes):	9359
Entropy (8bit):	5.630050363226493
Encrypted:	false
SSDEEP:	192:fcLtSa9QY4Cg9OcfTp1tOxyoZA0ab0KPqO2Lk2mMATw2DxnE7LoT:6WCQdfTLteyoZA0ab0KPqO2Lp+w2DxEo
MD5:	52287A03A33104E4E3508B67501DB130
SHA1:	B131FDFAA0259B1226B6EDF3BF5820C60A25FCAB
SHA-256:	A690D620CF44F9CAEF92F4943B977D45EF082F2280D16B7D6EE3B76157812310
SHA-512:	F4C83E10C7FB93CAA7F0B183D49DEFC53D21B8CC7CABAAD79ED36974F53DF01F87D45CF3452F7F3C2BF86168D3DC488296C6EA57279B4A2CDC083A2747AD97BE
Malicious:	false
URL:	https://discord.com/assets/af6b8f380faee0e9f47d.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["4775"],{292824:function(t){t.exports="/assets/00fe8a6557e204eb9503.svg"},231239:function(t,e,n){var r=n(990547),i=n(283693),l=n(570140),u=n(573261),o=n(981631);e.Z={signup:(t,e)=>u.Z.post({url:o.ANM.HUB_WAITLIST_SIGNUP,body:{email:t,school:e},trackedActionData:{event:r.NetworkActionNames.HUB_WAITLIST_SIGNUP,properties:t=>{var e;let n=!1,r=null==t?void 0:null===(e=t.body)\|\|void 0===e?void 0:e.email_domain;return null!=r&&(n=-1!==r.split(".").indexOf("edu")),(0,i.iG)({is_edu_email:n})}}}),sendVerificationEmail:async(t,e,n)=>(await u.Z.post({url:o.ANM.HUB_EMAIL_VERIFY_SEND,body:{email:t,guild_id:n,allow_multiple_guilds:e,use_verification_code:!0},trackedActionData:{event:r.NetworkActionNames.HUB_EMAIL_VERIFY_SEND,properties:t=>{var e;let n=null==t?void 0:null===(e=t.body)\|\|void 0===e?void 0:e.has_matching_guild;return(0,i.iG)({has_matching_guild:n})}}})).body,async verify(t){if(null!=t)try{var e;let n=awa

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	109613
Entropy (8bit):	5.4029332021931715
Encrypted:	false
SSDEEP:	1536:fCBKa1oPP8sGolumyOSsN5VYpLUBDL2QPidmHTRWisxpLAkF+d10J:qB9C81a5YpL5kl9sxpTa10J
MD5:	80F500D4D0495E5C74E9B92CBC26F088
SHA1:	A2C3F68D87AD8F793935FA7B8D05A0A2D635C4E0
SHA-256:	407002AD3FD8CF26EF02A802DD0D4DB7BFF395D8C22F5F8580CA6CE65A797238
SHA-512:	500C40BF257E7F4098B3B64CEDD49D8612FAF8B254CF496019C5B579C784A416F466C6BAC174B5317A663071E736C2DF82D22E6A7F88AF664BC421A974ABDF59
Malicious:	false
URL:	https://discord.com/assets/55ad931ed92a15c15709.js
Preview:	(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["63288"],{473452:function(e,t){"use strict";t.Z=function(e){for(var t,n=e.length,o=n^n,r=0;n>=4;)t=(65535&(t=255&e.charCodeAt(r)\|(255&e.charCodeAt(++r))<<8\|(255&e.charCodeAt(++r))<<16\|(255&e.charCodeAt(++r))<<24))1540483477+(((t>>>16)1540483477&65535)<<16),t^=t>>>24,o=(65535&o)1540483477+(((o>>>16)1540483477&65535)<<16)^(t=(65535&t)1540483477+(((t>>>16)1540483477&65535)<<16)),n-=4,++r;switch(n){case 3:o^=(255&e.charCodeAt(r+2))<<16;case 2:o^=(255&e.charCodeAt(r+1))<<8;case 1:o^=255&e.charCodeAt(r),o=(65535&o)1540483477+(((o>>>16)1540483477&65535)<<16)}return o^=o>>>13,o=(65535&o)1540483477+(((o>>>16)1540483477&65535)<<16),((o^=o>>>15)>>>0).toString(36)}},230371:function(e,t){"use strict";t.Z=function(e){var t={};return function(n){return void 0===t[n]&&(t[n]=e(n)),t[n]}}},184826:function(e,t){"use strict";t.Z=function(e){function t(e,t,o){var r=t.trim().split(h);t=r;var i=r.length,a=e.length;switch(a){case

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 960x540, components 3
Category:	downloaded
Size (bytes):	33094
Entropy (8bit):	7.662961138741444
Encrypted:	false
SSDEEP:	384:lgO9OMfES6EqMU9mmYJIbvXWQGA7DC5QC1QP9HfPt6r5esdEiExCbli1zqlYlBaJ:lJU5zGQswlE1TEx8kzqloBYA8R
MD5:	7E3C950F6514CEAEC263944BB6149A6B
SHA1:	D60A06B2724156F2C808648E8B5D8D543D93B084
SHA-256:	2CFA6F333D5A195FDFC244B2F3FBEDBAC858071EEC196BCA300808BAC20BF273
SHA-512:	AF8A05BDB2900D7D06D782309340941C4A0C6623F60F672AD4342A474F17CC76A987584D7EEB8D64D8960D6126A7A9FDB3E847D70DE8BD06C6BBAC24F6851D77
Malicious:	false
URL:	https://cdn.discordapp.com/splashes/1230227842877620359/04b58b5d8c863962ccdac305e5ee1269.jpg?size=1280
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..Z(...(...E...ZE....Z(...(...O.?AKI.G.(.h...(...).U..........(...(..o.~....O...(...(...(..^....^......(...(...#.....~....(...(...._.-!.ZZ.(...(...F...KH.t.)h...(...(..^....^......(...(...#.....~....(...(...._.-!.Z.Z(...(...F...KH.t.(.h...(...(...E...ZE...Z.(...(...O.?AKI.G.)h...(...(..U..........(...(..o.~....O...(...(...E...ZE....Z(...(...O.?AKI.G.(.h...(...).U.........

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (12394)
Category:	dropped
Size (bytes):	12443
Entropy (8bit):	5.622820681358379
Encrypted:	false
SSDEEP:	192:KO87cE+wCFgcmzFFLiMx+vomnNST2kYLAZVeOhRido3ARvVppn8pZl:KO6cE+wCFgFLGvomNSBYL1eROY
MD5:	1FB8462302F6FBB9323F187505F5393F
SHA1:	B1FE31671174AA0BC7DFBFCC942AEFBFCBDB55BA
SHA-256:	CBFC3F32A1493FB38FD92BE4BC61035CB4948B6CF91AE5CC0038006AC753EA98
SHA-512:	22B96DA64E536EE01CDC30946AF83FCA8BF939A41443C8E9F7E7D296388FC94E3BED12E1FCE20B7E5E31E7611B1DC4CE235DBD1B3B61CC4A6F77350749C86BFF
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["95393"],{392459:function(e){e.exports="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 66 38' width='66' height='38'%3E%3Crect x='0' y='0' width='66' height='38' style='fill: rgb(0, 0, 0); stroke: rgb(0, 0, 0);'%3E%3C/rect%3E%3C/svg%3E"},850259:function(e){e.exports="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='6.122 5.864 259 50' width='259' height='50'%3E%3Cpath fill='%23000000' fill-rule='evenodd' d='M 68.122 11.864 L 192.122 11.864 C 193.779 11.864 195.122 13.207 195.122 14.864 L 195.122 28.864 C 195.122 30.521 193.779 31.864 192.122 31.864 L 68.122 31.864 C 66.465 31.864 65.122 30.521 65.122 28.864 L 65.122 14.864 C 65.122 13.207 66.465 11.864 68.122 11.864 Z M 68.122 35.864 L 262.122 35.864 C 263.779 35.864 265.122 37.207 265.122 38.864 L 265.122 48.864 C 265.122 50.521 263.779 51.864 262.122 51.864 L 68.122 51.864 C 66.465 51.864 65.122 50.521 6

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1131565
Entropy (8bit):	5.877306362220961
Encrypted:	false
SSDEEP:	12288:BMrA+2Uf/GNe5hxEhraL6OFn7RcYxUgRHp09/V+KtlzJ/871zWUjEG6T7b:BMrZ5fyXvOFn7RfdHp0FV+vzWUoG2
MD5:	4F8F7AC8F509D88D00832626B0034B06
SHA1:	1EB4AA922A3585CF75D1D327456BE75C2D5B7691
SHA-256:	75121705F4F16884C3A4B4E8823088807C10D215EEFB26A8188B8421D8A13D91
SHA-512:	62F992FC3F9C3B1FFA50ECC096C8A117E9B855C4856A9D5413BB9B2EE93A44038D67D097E14CDECABF6E07538A1E1156A78718645272E9496F75B005A4B2A009
Malicious:	false
Preview:	(()=>{var e={654861:function(e,t,r){e=r.nmd(e);var n=function(e){"use strict";var t=s(9007199254740992),r="0123456789abcdefghijklmnopqrstuvwxyz",a="function"==typeof BigInt;function _(e,t,r,n){return void 0===e?_[0]:void 0!==t?10!=+t\|\|r?Y(e,t,r,n):F(e):F(e)}function o(e,t){this.value=e,this.sign=t,this.isSmall=!1}function E(e){this.value=e,this.sign=e<0,this.isSmall=!0}function i(e){this.value=e}function c(e){return -9007199254740992<e&&e<9007199254740992}function s(e){return e<1e7?[e]:e<1e14?[e%1e7,Math.floor(e/1e7)]:[e%1e7,Math.floor(e/1e7)%1e7,Math.floor(e/1e14)]}function l(e){u(e);var r=e.length;if(r<4&&0>g(e,t))switch(r){case 0:return 0;case 1:return e[0];case 2:return e[0]+1e7e[1];default:return e[0]+(e[1]+1e7e[2])*1e7}return e}function u(e){for(var t=e.length;0===e[--t];);e.length=t+1}function I(e){for(var t=Array(e),r=-1;++r<e;)t[r]=0;return t}function R(e){return e>0?Math.floor(e):Math.ceil(e)}function N(e,t){var r,n,a=e.length,_=t.length,o=Array(a),E=0;for(n=0;n<_;n++)E=(r=

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11498)
Category:	downloaded
Size (bytes):	11547
Entropy (8bit):	5.654551838352384
Encrypted:	false
SSDEEP:	192:632FaInJkXD9sQex9Wlp4JG+xyhyTBwFRAD0C+eN1Z0:632UK2XD9sQex9Wj4JG+xS0yba0
MD5:	AC6CE4E7FF5F746693AB549F03BE7ADE
SHA1:	2A3F2AFB8955C4218FDE52112D6F2E0E96CBD666
SHA-256:	233B97D0C0F688815243BCED54A8E2B633F60622B8704676F1E7C8F3051E19A1
SHA-512:	6F9EFF5DBC54D96955A801E0BB5A15E08989A8569018C223E0A079BFA03CAB090ADB545A5145EE934B848D2DF677493EF90E8A42D801817A4EA9BCBFC16F5DCD
Malicious:	false
URL:	https://discord.com/assets/fdc71c23d09e18e94ce2.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["90628"],{231443:function(e){e.exports="/assets/e04bcb7316f7205e85fb.svg"},74830:function(e){e.exports="/assets/23a7a3fd6624342117bf.svg"},206818:function(e){e.exports="/assets/17a91e9b4e7eb3921ed5.svg"},73117:function(e,s,n){e.exports=n.p+"39b91170d9f2309e4c5e.mov"},988868:function(e,s,n){e.exports=n.p+"15aad6b83736f221e23b.mp4"},554355:function(e){e.exports="/assets/fb70c6325a7d728cb6d0.png"},991989:function(e,s,n){e.exports=n.p+"48ad19e80083bee682d2.webm"},787462:function(e,s,n){e.exports=n.p+"a476863d4f441618840f.mov"},635507:function(e,s,n){e.exports=n.p+"87c3abd90e246db4b38a.mp4"},470794:function(e){e.exports="/assets/7df11a68a272724be266.png"},886777:function(e,s,n){e.exports=n.p+"b235c36699192662a3fe.webm"},588705:function(e,s,n){n.d(s,{R:function(){return f}}),n(411104);var t=n(200651),a=n(192379),l=n(442837),r=n(481060),i=n(388905),u=n(686546),o=n(925329),c=n(372769),m=n(726745),d=n(973616),I=

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20669)
Category:	downloaded
Size (bytes):	20718
Entropy (8bit):	5.5874718820742
Encrypted:	false
SSDEEP:	384:C4bQLjJHzjDcPDvYcJG9SAcksEi4aim6pvnVETji:DbQtjorYqG9e426PEa
MD5:	A2754ACCDA171158F8F581AD49DFBB9C
SHA1:	F619D690525B7ECA8BF70B9C24CBC58A3E092F1F
SHA-256:	606458816E822D1D0904C62D1E90C1595419CD92377055C63812BA63E00C3CDB
SHA-512:	F752422F8DE3B430832E43758F4C117D0D1FFB863CEDB95AA354635CC82DCC73F1371DA51626FFD76345D600970338DA4A2CD8F10739445C0123D990BD732CD5
Malicious:	false
URL:	https://discord.com/assets/94ec0c2b39908933eed3.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["25788"],{533307:function(e,t,n){let i;var s=n(544891),r=n(570140),l=n(728345),o=n(812206),a=n(625128),d=n(335131),u=n(669079),c=n(981631),_=n(474936);async function E(e){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1],n=arguments.length>2&&void 0!==arguments[2]&&arguments[2];r.Z.dispatch({type:"GIFT_CODE_RESOLVE",code:e});try{let i=await (0,u.bT)(e,t,n);if(null!=i.application_id&&i.application_id!==_.CL){let e=o.Z.getApplication(i.application_id);if(null==e)try{await l.ZP.fetchApplication(i.application_id)}catch(e){}}if(i.application_id===c.XAJ)try{await (0,d.jr)(i.sku_id)}catch(e){}return r.Z.dispatch({type:"GIFT_CODE_RESOLVE_SUCCESS",giftCode:i}),{giftCode:i}}catch(t){throw r.Z.dispatch({type:"GIFT_CODE_RESOLVE_FAILURE",code:e,error:t}),t}}i=n(775644).Z,t.Z={resolveGiftCode:E,async fetchUserGiftCodesForSKU(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:null;r.Z.dispatch

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 64x64, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	1066
Entropy (8bit):	7.8048030316845365
Encrypted:	false
SSDEEP:	24:w0Hm4yTnGeVfIFHU9HFbYMdL36oSMkKwzSwgvyQfpbfzu:w0Hm4AxWFHYeMZ36oSMS2wgpnu
MD5:	BD7895F71FAD6D9263981408ECCB3EF2
SHA1:	0DECC92425C58B121B6117B90EBFC89DE7397B8C
SHA-256:	927248AC3A7C831DC3DB7E45CEA4A7112F5BA02309227DDE46454F07CF773DB8
SHA-512:	CE7EBDA208426FBFC7E1A3F00ADD50A3944543385D6D2F0F29C1ABFB1653A1C8539D32C8C41FCA0BA6D71F9C65E09D21C6ADE661CD3719D5E7FF4A372FF0A32F
Malicious:	false
Preview:	RIFF"...WEBPVP8 .........@.@.>m..F$"..0......l....z..0?K.w....y.s..............S.?......h.....2>......j..{+....`...D. .........&...!..5w.8.S..VH.:b...-l..A_.......NVl0e..t..Q4hl..tCv...cB.&H......0`.>.]..(.n<6L]u.....M...%WN...>.......".../a .7FT.X..-.:....?.6Z[oO=^.==.).............y...Cn.}..0.fh.3.a....=k....O.^J4'..W."W....'...0.3.~.H..=....CT..W.kTVm.1.D.Rx6@.J..<.]~{4..h....u.42P........6vk.S...eF..fL..!..t0zO..h..Z....B....t.e..w:.......)...._.`E..-r..'"O.D..N.e.u..vp@...dd.............H.$.C.........c...ay.....I,c.2i..a.s.H...&..<:.3..!../..............?...rb"..9..r.q..g.{..E.A.].Rk.y..p[%..m.E]._m.........\....."<S.?......^........qU...L......4LE.q...?......E.n.p%5.54...f....5...g]...'...O....S.>+..DM4o.=.=.....[..5b..9...?y..cF.b...1..+.y...o.}.......>T=..........I....uc........^.....yT0...=#..i{....i..M1;...i.....g...3...g.~.].;.....0.Na......0.F....G.....&.[.+..>\|...9=..P......I.A.R.bT....8...C^q.N.....e;[..bm.{}.[P.y...

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	139
Entropy (8bit):	4.710597482771287
Encrypted:	false
SSDEEP:	3:t6WH7W+lFAATcvdnmFFSDDmJS4RKb5KGMXf/FGc8qQAGrqLW:t6Abli/m03mc4sldMX9QAw
MD5:	72A8B168AD2C7EEA7B2559B5690C7695
SHA1:	85E4F43154EA713C832BA27128A33EB7B2A7CF7A
SHA-256:	1F988D1AD4AB163D61A584254C07D75F3241EB6380BF48BF7D8F981E13C092CD
SHA-512:	11BCB1A3623B97C9DD2F22D0389B3CA05AB4F99596DE5D07C50C1FC83F7532D8C20B58379C54C38F503D86D8C2CAF52AF3B35FFCCDC4750089ABAF86C1C5294E
Malicious:	false
URL:	https://discord.com/assets/2597d11c1e039607373e.svg
Preview:	<svg fill="none" height="8" viewBox="0 0 8 8" width="8" xmlns="http://www.w3.org/2000/svg"><circle cx="4" cy="4" r="4" fill="#fff"/></svg>.

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	180
Entropy (8bit):	4.921485085907038
Encrypted:	false
SSDEEP:	3:t6WH7W+ZacvTnARcLnkDmJS4RKb5KVErcHYWNTWi7eLFOyTIXGUNfHFQJJqGrqL0:t6AbZ/Ikn4mc4slmYWBWzLRI2ylQJAe
MD5:	B1D4C5E276E3AAA8EC41E6014DD572B2
SHA1:	B5B63A8B35223277D75C79B2AABD8221FDA383EB
SHA-256:	7CF5996F7AB483BD985B3DE5BFBCF50A2B22A7B473E8011E5C993D9830AF9D12
SHA-512:	8E4C954D96FBDA407E87FA65859FE758FC83F2DA0C6D7C07824926BFB0BCDF4F40DE057C5DD1D7EE0890C5287D2ED2EC8FDEFBDF317B46FE222339894E0A559B
Malicious:	false
URL:	https://discord.com/assets/5430e9964fe8364e084d.svg
Preview:	<svg fill="none" height="9" viewBox="0 0 6 9" width="6" xmlns="http://www.w3.org/2000/svg"><path d="m0 2.83912v3.32176l3 2.83912 3-2.83912v-3.32176l-3-2.83912z" fill="#fff"/></svg>

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	137
Entropy (8bit):	4.7861988241054
Encrypted:	false
SSDEEP:	3:t6WH7W+IjSKcvUVYEo0LvDmJS4RKb5KVErcHNDPqdcJqGrqL0:t6AbzUOC3mc4slmNDiiAe
MD5:	7D883BA72B5DBC0229F5D1980205EE34
SHA1:	678BDA23DF97E8B9C3B15E71C41E7B215D043F22
SHA-256:	53A0F1F10860A6E4CF9BD3B4949C5DDE68888DBC96BA0DA1020C5958EFC214A5
SHA-512:	E040F62517C951A0AB2ABC5038F22456E5862166E2A2346345464B9C4B63271CFBD1220BB14D2C39D7FACFD008848ACE682420F1EFE9F4F29265D7177A3C7E16
Malicious:	false
URL:	https://discord.com/assets/ab03f7053698d417194c.svg
Preview:	<svg fill="none" height="12" viewBox="0 0 12 12" width="12" xmlns="http://www.w3.org/2000/svg"><path d="m5 2h2v8h-2z" fill="#fff"/></svg>

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2058
Entropy (8bit):	4.614306214221163
Encrypted:	false
SSDEEP:	48:CVHe7HtOty0VulV1/8CXP0Cjek7aj4clug9ai:iANEyxx8UPTXaj4cogIi
MD5:	E1349377226366F95F85AB9EAC4586D3
SHA1:	9A3A00B6E6AB0A240363F4E4DB2F5288227FF76B
SHA-256:	2CA673A9914A35A230469A8A0FD6B4DB293B236DEA391633B53339AFE577A92E
SHA-512:	7C16967D1960CDE4914F71B6FE347A7764AAED42366A87920597D225F3874B5B34A00C5089564BEBF0A919C419049DB99B27128CC81BC28A1492460FD199F9E7
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 45 45" xml:space="preserve">. <defs>. <clipPath id="a" clipPathUnits="userSpaceOnUse">. <path d="M0 36h36V0H0v36Z"/>. </clipPath>. <mask id="b">. <g>. <rect x="0" y="0" width="100" height="100" fill="white" />. <path d="M11.708 29.849a1.296 1.296 0 1 0-2.591-.001 1.296 1.296 0 0 0 2.591 0" fill="black"/>. </g>. </mask>. </defs>. <g>. <g>. <g clip-path="url(#a)" transform="matrix(1.25 0 0 -1.25 0 45)" mask="url(#b)">. <g>. <path d="M12.75 18.25c1.226-2.195 1.855 1.361 9.313 2.625 7.457 1.264 13.728-4.454 13.859-5.413C36.053 14.504 31.474 6 26.459 6h-15.71C6.607 6 3.727 13.224 6.75 17.438c0 0 4.5 3.5 6 .812" fill="white"/>. </g>. <g>. <path d="M13.008 17.864C8.02 10.927 6.968 6 10.75 6c-4.142 0-6.577 6.187-4.468 11.031.463 1.064 1.758 2.492 1.758 2.492l4.18.008c.162-.32.598-1.366.79-1.667" fill="white"/>. </g>. <g>. <path d

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17413)
Category:	dropped
Size (bytes):	17462
Entropy (8bit):	5.594711522541062
Encrypted:	false
SSDEEP:	384:iwLnWOUnUuyMNps0HHHsglNzUxBAAdTRIZWiv/XB2kZYP:BLQne0P5UxMXB2kSP
MD5:	3B98C1EF9293D482A5099FDB6984946F
SHA1:	6FEFA9D8FF6B2DB16B5EC2ED5922DA0AE6187448
SHA-256:	A76F75BF6294EEA278F82522810ACBC3BCFA9290006F57746AD79BCA3615AD66
SHA-512:	CE9915807ADC42ECAF18D254091B31BD65CE9A29AF38820ACCC2A5D38BC8AA329471AE1E7F404B6F8D0F85CC643B3616863A70D0E3EA1B8C569AC64A5E889C54
Malicious:	false
Preview:	(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["15812"],{884835:function(t,e,r){"use strict";var o=r(311596);function n(){}function i(){}i.resetWarningCache=n,t.exports=function(){function t(t,e,r,n,i,a){if(a!==o){var u=Error("Calling PropTypes validators directly is not supported by the `prop-types` package. Use PropTypes.checkPropTypes() to call them. Read more at http://fb.me/use-check-prop-types");throw u.name="Invariant Violation",u}}function e(){return t}t.isRequired=t;var r={array:t,bigint:t,bool:t,func:t,number:t,object:t,string:t,symbol:t,any:t,arrayOf:e,element:t,elementType:t,instanceOf:e,node:t,objectOf:e,oneOf:e,oneOfType:e,shape:e,exact:e,checkPropTypes:i,resetWarningCache:n};return r.PropTypes=r,r}},639519:function(t,e,r){t.exports=r(884835)()},311596:function(t){"use strict";t.exports="SECRET_DO_NOT_PASS_THIS_OR_YOU_WILL_BE_FIRED"},58615:function(t,e,r){var o=r(338091);function n(t){this.mode=o.MODE_8BIT_BYTE,this.data=t}n.prototype={getLength:fu

Chrome Cache Entry: 150

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 179380, version 2.459
Category:	downloaded
Size (bytes):	147988
Entropy (8bit):	7.998735982512995
Encrypted:	true
SSDEEP:	3072:IkairG/VFWmVX/55KB+fV6ZNTJuvdeDsYaZQ9aFftKn/zfRoJC1NTuGo5m5Ss9fK:5aD/VEIXs+fVSNTJ8deoYabFftK/VosK
MD5:	1DC43A99DB81695E2BF2FE2009C8784B
SHA1:	F4D945EA6EF2D0F8DACCD476DD7A53991109D89F
SHA-256:	7D9C3EB37F14983430DB8FF9D6965578834588887C17F3EECA754B15E51E2EA9
SHA-512:	732C664C3A3CB12C25623947AC0743C64666E7DAA97E6E09EC6F636006E1706EC6C873FD3BBCBBB0A9CEDE0291E4D2112C5BB790E701BA841030959E8CC7C9C8
Malicious:	false
URL:	https://discord.com/assets/48a594e29497835802fe.woff2
Preview:	wOF2...............L...Q..............................F...v.`..:.....$....6.$...@...D.. ..Z...\..[lI..<....rs.J.....H.H.G..Lc6.X.......2....1...B...d5.a..1......_(.D..&v.......[...Q=..................K........w'.,yl.`.1x0.Ya..B..Ph..6m.D....kE.B`.zG4...%+..!.J......j.z.......Z.F....~....V.m5...\|Xc.eG.x}C.....[U2..:oZ..b..0j.B......9.w.....Z.:..e.t...7...6\O...5e.KUNU9.P....-W./......A.y..E.#N.........ui@.'.m..~.d.Q..vpBv.+p..9.l...Sb..s%...^2.....Z].\|......=,.....@....^...5..w.6.a.2...$...[v..A..sG.t....T..L..~....H4..&#....]...W..].V.....Pt....o.Y.....T../..qS....c.O(<..-'P.9s.../.t..G .........o..b....83.^"K......J+..z^2x.L.../=Ts.....]E.....s)Y...y...g...$....da.......lA...y..<-KoEP>..I.....T.\I...d75.M...0..q.F.....&......<~..k7.(.}Q.%.q.<...{..9..0>d.VV..ze...I.<..4M.s.$....k....L ..H.B....2e".3..+..]<..m..4...J.......7r....e...KT..7{:.A2..\|...l..m.bS...S+.B..CQ/.d-..;r.>.....=B.o.....!).[..2......a6.q4ak.^..kyk\|.L....{.~..f1..L1..

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7679)
Category:	downloaded
Size (bytes):	7728
Entropy (8bit):	5.087323529198084
Encrypted:	false
SSDEEP:	96:wgSRVk6Wg8lh4Nrviiv1aWPRkDhTt9qwqSBtxCMNMRV0IBSAMD9C+m+rmxARJx3t:RSRVmriLDPRkxtRJxNMRV0IZdSL9ilfA
MD5:	1C6B9D0AD743762986197AE0E81874C1
SHA1:	EABACE4131BA74B108FC891EA843B4F85B218808
SHA-256:	2D739091F602476FCF261435B48A1FAFCE2533564FFF0549D27B47E341B4DCBF
SHA-512:	74FDE9F8997087BB107ED5DDC3A4A37BD24793CAAD605FBDCDD54E9D18AF8F44D0C0E92FB2259AA936BD1B20D5537441EF39D9A7F066323911436184B0138111
Malicious:	false
URL:	https://discord.com/assets/d67c5e680608266a1f63.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["75492"],{849146:function(t,e,n){var r=function(){if("undefined"!=typeof Map)return Map;function t(t,e){var n=-1;return t.some(function(t,r){return t[0]===e&&(n=r,!0)}),n}return function(){function e(){this.__entries__=[]}return Object.defineProperty(e.prototype,"size",{get:function(){return this.__entries__.length},enumerable:!0,configurable:!0}),e.prototype.get=function(e){var n=t(this.__entries__,e),r=this.__entries__[n];return r&&r[1]},e.prototype.set=function(e,n){var r=t(this.__entries__,e);~r?this.__entries__[r][1]=n:this.__entries__.push([e,n])},e.prototype.delete=function(e){var n=this.__entries__,r=t(n,e);~r&&n.splice(r,1)},e.prototype.has=function(e){return!!~t(this.__entries__,e)},e.prototype.clear=function(){this.__entries__.splice(0)},e.prototype.forEach=function(t,e){void 0===e&&(e=null);for(var n=0,r=this.__entries__;n<r.length;n++){var i=r[n];t.call(e,i[1],i[0])}},e}()}(),i="undefined"!

Chrome Cache Entry: 152

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1131565
Entropy (8bit):	5.877306362220961
Encrypted:	false
SSDEEP:	12288:BMrA+2Uf/GNe5hxEhraL6OFn7RcYxUgRHp09/V+KtlzJ/871zWUjEG6T7b:BMrZ5fyXvOFn7RfdHp0FV+vzWUoG2
MD5:	4F8F7AC8F509D88D00832626B0034B06
SHA1:	1EB4AA922A3585CF75D1D327456BE75C2D5B7691
SHA-256:	75121705F4F16884C3A4B4E8823088807C10D215EEFB26A8188B8421D8A13D91
SHA-512:	62F992FC3F9C3B1FFA50ECC096C8A117E9B855C4856A9D5413BB9B2EE93A44038D67D097E14CDECABF6E07538A1E1156A78718645272E9496F75B005A4B2A009
Malicious:	false
URL:	https://discord.com/assets/sentry.d30fc24f50e5e3e76b3e.js
Preview:	(()=>{var e={654861:function(e,t,r){e=r.nmd(e);var n=function(e){"use strict";var t=s(9007199254740992),r="0123456789abcdefghijklmnopqrstuvwxyz",a="function"==typeof BigInt;function _(e,t,r,n){return void 0===e?_[0]:void 0!==t?10!=+t\|\|r?Y(e,t,r,n):F(e):F(e)}function o(e,t){this.value=e,this.sign=t,this.isSmall=!1}function E(e){this.value=e,this.sign=e<0,this.isSmall=!0}function i(e){this.value=e}function c(e){return -9007199254740992<e&&e<9007199254740992}function s(e){return e<1e7?[e]:e<1e14?[e%1e7,Math.floor(e/1e7)]:[e%1e7,Math.floor(e/1e7)%1e7,Math.floor(e/1e14)]}function l(e){u(e);var r=e.length;if(r<4&&0>g(e,t))switch(r){case 0:return 0;case 1:return e[0];case 2:return e[0]+1e7e[1];default:return e[0]+(e[1]+1e7e[2])*1e7}return e}function u(e){for(var t=e.length;0===e[--t];);e.length=t+1}function I(e){for(var t=Array(e),r=-1;++r<e;)t[r]=0;return t}function R(e){return e>0?Math.floor(e):Math.ceil(e)}function N(e,t){var r,n,a=e.length,_=t.length,o=Array(a),E=0;for(n=0;n<_;n++)E=(r=

Chrome Cache Entry: 153

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	14624305
Entropy (8bit):	5.854943527266922
Encrypted:	false
SSDEEP:	196608:r6lXgFXaYzjupIEtYW4sZoymJBkD/skskv:rXXaYzjupIEtYW4sZ9mJBkDks
MD5:	216CB783D60A3E7C57C9D9FFEA99DC3F
SHA1:	C645D044161C447B84CBA1E62FCB018B5A7D6066
SHA-256:	48D0B669FD29BF3D5A6552EBD89B2048FBB6D58F824E8DD1F92772AC5821D716
SHA-512:	54F12CC52FBCAE1DF1575969CD269E75795B6D469B2C5CB0854D5A242A9A460CFBC8A9C9DCBDF4A7B7CEBC9EEC2EFC54A714C9CB6DB68974173DA2AC4E01E84B
Malicious:	false
URL:	https://discord.com/assets/webMinimal.183cbc8427e6b143ce21.js
Preview:	(()=>{var e={385007:function(e,t,n){var r={"./de.jsona":["644753","30244"],"./zh-CN.jsona":["494062","56446"],"./da.jsona":["44867","57387"],"./el.jsona":["581144","55601"],"./tr.jsona":["146878","84385"],"./es-ES.jsona":["872550","45747"],"./hr.jsona":["403530","29924"],"./cs.jsona":["753771","87233"],"./fi.jsona":["554545","7402"],"./es-419.jsona":["39227","59729"],"./ja.jsona":["516722","7728"],"./pt-BR.jsona":["246297","394"],"./ro.jsona":["37190","53269"],"./sv-SE.jsona":["335417","11193"],"./ru.jsona":["809464","12611"],"./vi.jsona":["139107","45576"],"./id.jsona":["492248","77800"],"./it.jsona":["515630","78670"],"./uk.jsona":["167111","58548"],"./lt.jsona":["877749","44754"],"./pl.jsona":["477384","60878"],"./hu.jsona":["107425","98570"],"./nl.jsona":["432763","41588"],"./th.jsona":["182260","49827"],"./bg.jsona":["251927","20575"],"./fr.jsona":["570173","99450"],"./zh-TW.jsona":["592369","30684"],"./hi.jsona":["629869","22732"],"./en-GB.jsona":["569249","99339"],"./ko.jsona":[

Chrome Cache Entry: 154

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	395
Entropy (8bit):	4.646873794844198
Encrypted:	false
SSDEEP:	6:tnrVzUOtumc4slvIl4slvUldboLYPsd9IZI0OuFxMdIr0a/NdpVo4a38n:trVzNtuCHvOdELYPsuI09z9LdYr38n
MD5:	E843C51C0EEC3801B70CAE5C45AD343F
SHA1:	AD735360ECFA829DB9D6C48F1A671A99BFCE1D2A
SHA-256:	F860149A77A53D43396F3AEC9377B9A0DD6C5D84459079C5D393F6343EC253FB
SHA-512:	2AF4816580FD02A2AE107914D967AF966CA97E137434E2668C7A430D34168E150F668AE3A3B005BFF7070D50A0FD89BD0B5A351F5E3DB6F6B167998378308F71
Malicious:	false
URL:	https://discord.com/assets/410a2166a48c9e482e2a.svg
Preview:	<svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M2.9932 7.49727C5.48073 7.49727 7.49727 5.48073 7.49727 2.9932C7.49727 1.84421 7.06704 0.795708 6.35889 0C9.50595 0.188323 12 2.80018 12 5.99456C12 9.31127 9.31127 12 5.99456 12C2.80018 12 0.188323 9.50595 0 6.35889C0.795708 7.06704 1.84421 7.49727 2.9932 7.49727Z" fill="#FFFFFF"/>.</svg>.

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9319)
Category:	dropped
Size (bytes):	9368
Entropy (8bit):	5.515903871543996
Encrypted:	false
SSDEEP:	96:i5FOdCCCb5Ui4C5wOjggHurX0W89VSIFIUpSpWgAUcnNyeVjAZ2dQTK0ne+6ACub:iSbuIAr3gKYa48OwaUDhQDFRtQS
MD5:	484B9F4BDA963A4ADE71A4EB95D2538F
SHA1:	C381C9D9C91D4256D92E2480CB9DF1A0F090F7D6
SHA-256:	EA87CB393653DF89EF7B31DD35BC78C5DBA14B5F5BEC401153A3C51CD566C923
SHA-512:	D18D67D5B5FC1FDBE61C6728B7104A5589837A32D6D20BF59B0405DB4093FBAF3FBF961DBC24158B5C21147945941D75ECBADF264857EAB722C9511F70D0988B
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["84956"],{986197:function(e,t,n){var i=n(990547),o=n(544891),a=n(570140),s=n(881052),r=n(626135),u=n(573261),l=n(545851),g=n(109488),d=n(794099),c=n(981631),m=n(689938);n(135200);t.Z={resetSuggestions:()=>a.Z.dispatch({type:"POMELO_SUGGESTIONS_RESET"}),async fetchSuggestionsRegistration(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:1500;if(!!(0,d.vc)()){a.Z.dispatch({type:"POMELO_SUGGESTIONS_RESET"});try{var n;let i=await o.tn.get({url:c.ANM.POMELO_SUGGESTIONS_UNAUTHED,query:null==e?void 0:{global_name:e},timeout:t});if(i.ok&&(null===(n=i.body)\|\|void 0===n?void 0:n.username)!=null)return a.Z.dispatch({type:"POMELO_REGISTRATION_SUGGESTIONS_SUCCESS",suggestion:i.body,source:e})}catch(e){return}}},async fetchSuggestions(e){if(!!(0,g.P)())try{var t;a.Z.dispatch({type:"POMELO_SUGGESTIONS_FETCH",usernameSuggestionLoading:!0});let n=await o.tn.get({url:c.ANM.POMELO_SUGGESTIONS,timeout:e});if(

Chrome Cache Entry: 156

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	395
Entropy (8bit):	4.646873794844198
Encrypted:	false
SSDEEP:	6:tnrVzUOtumc4slvIl4slvUldboLYPsd9IZI0OuFxMdIr0a/NdpVo4a38n:trVzNtuCHvOdELYPsuI09z9LdYr38n
MD5:	E843C51C0EEC3801B70CAE5C45AD343F
SHA1:	AD735360ECFA829DB9D6C48F1A671A99BFCE1D2A
SHA-256:	F860149A77A53D43396F3AEC9377B9A0DD6C5D84459079C5D393F6343EC253FB
SHA-512:	2AF4816580FD02A2AE107914D967AF966CA97E137434E2668C7A430D34168E150F668AE3A3B005BFF7070D50A0FD89BD0B5A351F5E3DB6F6B167998378308F71
Malicious:	false
Preview:	<svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M2.9932 7.49727C5.48073 7.49727 7.49727 5.48073 7.49727 2.9932C7.49727 1.84421 7.06704 0.795708 6.35889 0C9.50595 0.188323 12 2.80018 12 5.99456C12 9.31127 9.31127 12 5.99456 12C2.80018 12 0.188323 9.50595 0 6.35889C0.795708 7.06704 1.84421 7.49727 2.9932 7.49727Z" fill="#FFFFFF"/>.</svg>.

Chrome Cache Entry: 157

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9310)
Category:	dropped
Size (bytes):	9359
Entropy (8bit):	5.630050363226493
Encrypted:	false
SSDEEP:	192:fcLtSa9QY4Cg9OcfTp1tOxyoZA0ab0KPqO2Lk2mMATw2DxnE7LoT:6WCQdfTLteyoZA0ab0KPqO2Lp+w2DxEo
MD5:	52287A03A33104E4E3508B67501DB130
SHA1:	B131FDFAA0259B1226B6EDF3BF5820C60A25FCAB
SHA-256:	A690D620CF44F9CAEF92F4943B977D45EF082F2280D16B7D6EE3B76157812310
SHA-512:	F4C83E10C7FB93CAA7F0B183D49DEFC53D21B8CC7CABAAD79ED36974F53DF01F87D45CF3452F7F3C2BF86168D3DC488296C6EA57279B4A2CDC083A2747AD97BE
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["4775"],{292824:function(t){t.exports="/assets/00fe8a6557e204eb9503.svg"},231239:function(t,e,n){var r=n(990547),i=n(283693),l=n(570140),u=n(573261),o=n(981631);e.Z={signup:(t,e)=>u.Z.post({url:o.ANM.HUB_WAITLIST_SIGNUP,body:{email:t,school:e},trackedActionData:{event:r.NetworkActionNames.HUB_WAITLIST_SIGNUP,properties:t=>{var e;let n=!1,r=null==t?void 0:null===(e=t.body)\|\|void 0===e?void 0:e.email_domain;return null!=r&&(n=-1!==r.split(".").indexOf("edu")),(0,i.iG)({is_edu_email:n})}}}),sendVerificationEmail:async(t,e,n)=>(await u.Z.post({url:o.ANM.HUB_EMAIL_VERIFY_SEND,body:{email:t,guild_id:n,allow_multiple_guilds:e,use_verification_code:!0},trackedActionData:{event:r.NetworkActionNames.HUB_EMAIL_VERIFY_SEND,properties:t=>{var e;let n=null==t?void 0:null===(e=t.body)\|\|void 0===e?void 0:e.has_matching_guild;return(0,i.iG)({has_matching_guild:n})}}})).body,async verify(t){if(null!=t)try{var e;let n=awa

Chrome Cache Entry: 158

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18134)
Category:	dropped
Size (bytes):	18183
Entropy (8bit):	5.745446950417671
Encrypted:	false
SSDEEP:	384:M7+ek/HNfVFGOSH4vgk+l/HyHOC7CmA5h4m4C2xYtL5c299H0KkBijYpthjDh2P1:g+ek/7VwEgkK/SuC7Cx5G1C2xYtL5c2R
MD5:	CB2E31554EC3CE69856DD70C281A6DB7
SHA1:	53524C140D3B966DFA9ADAF06A1AD062CC5FB9E1
SHA-256:	A4E79A1E245BDE12C9A8FE50342E450213CB0F3002D0453DE8FDEDE75630F2D2
SHA-512:	FB5D9629793FA3A432D955AE2193504445464719C92B7281612DC83912FCF1150A07F2BEDEDADFB102D8FC0D54980B769C933D4D99DEDAD0AFC14E3065ABE6FC
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["10778"],{418757:function(e){e.exports="/assets/b7d1dc6b0746101719c5.png"},494207:function(e){e.exports="/assets/85153fe71873da0f5802.svg"},320440:function(e){e.exports="/assets/4676f063fb9f129e9fdb.svg"},561030:function(e){e.exports="/assets/75c80c4160a66983ae66.svg"},419185:function(e){e.exports="/assets/47e72e6360ce185adab6.svg"},826806:function(e){e.exports="/assets/fb418059f41b569abca4.svg"},123013:function(e){e.exports="/assets/98cacc492d985565ed4f.png"},540909:function(e){e.exports="/assets/2a5176cf2bd0ccdf0e7b.svg"},232454:function(e){e.exports="/assets/ad2027f11792ba8c0e7f.svg"},526916:function(e){e.exports="/assets/f38b6aefa24dc9a54765.svg"},29654:function(e){e.exports="/assets/dde11474b0623b723861.svg"},820160:function(e,s,a){a.d(s,{Z:function(){return L}});var E=a(200651);a(192379);var _=a(481060),t=a(813197),n=a(689938),r=a(510186);function L(e){let{icon:s,onChange:a}=e;return(0,E.jsx)(_.Fo

Chrome Cache Entry: 159

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8074), with no line terminators
Category:	dropped
Size (bytes):	8074
Entropy (8bit):	5.772709955093958
Encrypted:	false
SSDEEP:	192:UUhiSn9SF6a+mJ7TajYHcDMZG5reMqDEc6H5k:39SF6a+mJ7h8DMZOX9Zk
MD5:	8697185D0E40ADE2E41A41AFD95D69E3
SHA1:	0D35D1B6BB4D180ED89E3A4D353939DA0562E182
SHA-256:	D4C66DB40C9872543DCE17A8B5C2B0AF90CBB978EFC55A95A539215971B1D6C9
SHA-512:	7A2262546E9347B4C5AE4B114908477B7C1241767567663918F2996749132722CF1BE0C568FEAC04A21032233C5594EE22455B7E115B0C758EE1B8B6FDEBC1F0
Malicious:	false
Preview:	window._cf_chl_opt={cFPWv:'g'};~function(V,h,i,n,o,s,z,A){V=b,function(c,d,U,e,f){for(U=b,e=c();!![];)try{if(f=-parseInt(U(388))/1+parseInt(U(338))/2(-parseInt(U(391))/3)+-parseInt(U(419))/4+parseInt(U(387))/5+-parseInt(U(402))/6(parseInt(U(379))/7)+parseInt(U(366))/8+-parseInt(U(324))/9*(-parseInt(U(403))/10),f===d)break;else e.push(e.shift())}catch(D){e.push(e.shift())}}(a,586573),h=this\|\|self,i=h[V(343)],n=function(a0,d,e,f){return a0=V,d=String[a0(355)],e={'h':function(D){return D==null?'':e.g(D,6,function(E,a1){return a1=b,a1(315)[a1(412)](E)})},'g':function(D,E,F,a2,G,H,I,J,K,L,M,N,O,P,Q,R,S,T){if(a2=a0,D==null)return'';for(H={},I={},J='',K=2,L=3,M=2,N=[],O=0,P=0,Q=0;Q<D[a2(333)];Q+=1)if(R=D[a2(412)](Q),Object[a2(375)][a2(392)][a2(352)](H,R)\|\|(H[R]=L++,I[R]=!0),S=J+R,Object[a2(375)][a2(392)][a2(352)](H,S))J=S;else{if(Object[a2(375)][a2(392)][a2(352)](I,J)){if(256>J[a2(374)](0)){for(G=0;G<M;O<<=1,P==E-1?(P=0,N[a2(360)](F(O)),O=0):P++,G++);for(T=J[a2(374)](0),G=0;8>G;O=O<<1.02\|1&

Chrome Cache Entry: 160

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13325)
Category:	downloaded
Size (bytes):	13374
Entropy (8bit):	5.33229367944175
Encrypted:	false
SSDEEP:	192:c9jPMDYeG0dPbPDjzw4WDhiElYrskCLdHWQBC7dr1m+8LBpDtOnyUotvLfQE2u:c9jPMRLjZ0usbxwdr1QBpDtOy3JT
MD5:	D0C788B157FF96A2DD902C97BFC889F6
SHA1:	6CDE0BD611B34B15CA15437CA5AC4F77DE01ADA8
SHA-256:	05A00FBAFFC4A7254C9B631FF0E81BE546DC275BE1D6F992C36849222D0B73F7
SHA-512:	170615E3DE829D517662BE32C762B76B013163FA040C2EEDF89C865A9CEE1CEEDA7EE305BE27CD3A724832571A94B5A26FB3BB9D9A1D1C5386081F206A1E1436
Malicious:	false
URL:	https://discord.com/assets/5067a2ec1b24a6de868c.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["78187"],{526988:function(t,n,r){var e=r(354848),o=r(938507),i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not a function")}},24033:function(t,n,r){var e=r(622281),o=String,i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not an object")}},953326:function(t,n,r){var e=r(299623),o=r(980855),i=r(49693),u=function(t){return function(n,r,u){var c,f=e(n),a=i(f),s=o(u,a);if(t&&r!=r){for(;a>s;)if((c=f[s++])!=c)return!0}else for(;a>s;s++)if((t\|\|s in f)&&f[s]===r)return t\|\|s\|\|0;return!t&&-1}};t.exports={includes:u(!0),indexOf:u(!1)}},332916:function(t,n,r){var e=r(581031),o=e({}.toString),i=e("".slice);t.exports=function(t){return i(o(t),8,-1)}},381740:function(t,n,r){var e=r(740362),o=r(666061),i=r(347722),u=r(97131);t.exports=function(t,n,r){for(var c=o(n),f=u.f,a=i.f,s=0;s<c.length;s++){var p=c[s];!e(t,p)&&!(r&&e(r,p))&&f(t,p,a(n,p))}}},251069:function(t,n,r){var e=r

Chrome Cache Entry: 161

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1189139
Entropy (8bit):	5.20676221692586
Encrypted:	false
SSDEEP:	24576:xAexVV4zeUuKevkJHfJytZemXpvyZTQ02JKdmtWCt3nCxhZyUXQ32N4XhKOXAWbF:xAenVOuKevkJHfJytZemXpvyZTQ02JKw
MD5:	7B173AF12AA2176B69D5656709649AB1
SHA1:	C04DB8B7D3EAE3F4EB8CCCF59F71ED924B87E029
SHA-256:	D92469EE3632C38B4562C947419B685A7A13EFF0E3861DCC383A255C389A5F40
SHA-512:	945BE17823D84E2A6E5BB0852B73FD77B0A292EAF13718F94D3AA8008F33B10A9C6007E2ACFFFE970CC10E9A04227C57BADD5B0C3BF0F46F4EAB98E248455561
Malicious:	false
URL:	https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css
Preview:	@keyframes spinner-wandering-cubes_b6db20{25%{transform:translatex(22px)rotate(-90deg)scale(.5)}50%{transform:translatex(22px)translatey(22px)rotate(-180deg)}75%{transform:translatex(0)translatey(22px)rotate(-270deg)scale(.5)}to{transform:rotate(-360deg)}}@keyframes spinner-chasing-dots-rotate_b6db20{to{transform:rotate(360deg)}}@keyframes spinner-chasing-dots-bounce_b6db20{0%,to{transform:scale(0)}50%{transform:scale(1)}}@keyframes spinner-pulsing-ellipsis_b6db20{0%{transform:scale(1);opacity:1}50%{transform:scale(.8);opacity:.3}to{transform:scale(1);opacity:1}}@keyframes spinner-low-motion_b6db20{0%{opacity:1}50%{opacity:.6}to{opacity:1}}@keyframes spinner-spinning-circle-rotate_b6db20{to{transform:rotate(360deg)}}@keyframes spinner-spinning-circle-dash_b6db20{0%{stroke-dasharray:1,200;stroke-dashoffset:0}50%{stroke-dasharray:130,200}to{stroke-dasharray:130,200;stroke-dashoffset:-124}}.spinner_b6db20{display:flex;justify-content:center;align-items:center}.inner_b6db20{position:relati

Chrome Cache Entry: 162

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	87973
Entropy (8bit):	5.125806607183933
Encrypted:	false
SSDEEP:	1536:f0kGwo/3g1MGEN6UCSQyYHhU58xxfrDX/5CF+gD58G3LpV9H5B7va:f0kGDZc
MD5:	E05640582E20F17E0F1797160B67DCD4
SHA1:	DCB27383F5836437E5433C7CCB5981E94826EE00
SHA-256:	E9DEEBCC271633C282AB3FE440CE81A196ECE4F402804FE8940030F98C563475
SHA-512:	60CDDA59E85FDED81B351614DAF3D40B30F939F7F8D9B586F516165699822E8F07F344CDD3709DCF6ADA350C725330DF26B6947322F154AB54D02C5AF3AAD71B
Malicious:	false
Preview:	<svg width="1440" height="900" viewBox="0 0 1440 900" preserveAspectRatio="xMinYMin slice" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#a)"><g clip-path="url(#b)"><path d="M1440 0H0v900h1440V0Z" fill="url(#c)"/><path d="M1440 0H435.551v620.81H1440V0Z" fill="url(#d)"/><path d="M1440 341.601H484.351v558.38H1440v-558.38Z" fill="url(#e)"/><path d="M1440 0H427.5v690.995H1440V0Z" fill="url(#f)"/><path d="M787.663 810.02c330.987-141.179 530.547-416.834 445.727-615.692C1148.57-4.53 811.492-51.288 480.502 89.891 149.512 231.07-50.048 506.725 34.772 705.583c84.821 198.858 421.901 245.616 752.891 104.437Z" fill="url(#g)"/><path d="M1024.18 825.565c290.6-123.952 456.96-386.723 371.57-586.916-85.39-200.193-390.19-261.999-680.792-138.047-290.602 123.952-456.959 386.724-371.569 586.917 85.389 200.193 390.19 261.998 680.791 138.046Z" fill="url(#h)"/><path d="M673.907 771.815c264.238-112.707 429.363-319.136 368.823-461.073-60.538-141.936-323.823-165.631-588.061-52.924C190.431 370.5

Chrome Cache Entry: 163

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3146
Entropy (8bit):	4.484082045212369
Encrypted:	false
SSDEEP:	48:C4LO/K7oWBkomgBkRzd0kJBJkI8JkINGD/dYk2kahkzd/FnLgkpmZ5ZOE83VCn:RO/IS53JBJbKbN4WQbMRZmEAI
MD5:	81084FF5A27B6E6FF487E479C37D1660
SHA1:	81A274F69A1358F85715A0FEA227730D795CB353
SHA-256:	075DE1D6EA4FB470197A88BA371F60F70B819B250CB5AF8BD6A4794B1A9CA4A1
SHA-512:	CCCD00A5C013B130BE0A8466F903F7EEE9306518DFAA8758849027EBC1829EA2A6B7516E4D2070B110A12EC7EB559E3B75D256AD1B07BE3FD8595C0E430DC0D5
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 90 59.19">. <defs>. <style>. .cls-1{fill:#6a94ff}.cls-2{fill:#a9c7ff}.cls-3{fill:#202225}. </style>. </defs>. <g id=".._2" data-name=".. 2">. <g id="Layer_1" data-name="Layer 1">. <path class="cls-1" d="M89.59 19.89 84.93 8.38a5.51 5.51 0 0 0-7.19-3l-5.67 2.25A12.42 12.42 0 0 0 56 .91L45.48 5.16c-1.84 4.11-5.48 9.72-11.59 9.52a8.55 8.55 0 0 1-5.51-2.13c-.12-.11-.24-.22-.34-.33l-12.66 5.13a12.42 12.42 0 0 0-6.9 16l-5 2A5.52 5.52 0 0 0 .4 42.61l4.67 11.51a5.51 5.51 0 0 0 7.18 3l5.64-2.28A12.43 12.43 0 0 0 32 58.28l40.54-16.44a12.43 12.43 0 0 0 7.73-12.22l6.28-2.54a5.52 5.52 0 0 0 3.04-7.19ZM11.65 52.94a2.76 2.76 0 0 1-3.59-1.52l-3.63-9A2.76 2.76 0 0 1 6 38.87l4-1.65 5.69 14.07ZM22.33 39.6a3.72 3.72 0 1 1 2.06-4.85 3.71 3.71 0 0 1-2.06 4.85Zm33.36-1.55-11.77 4.77A10.61 10.61 0 0 1 30.11 37l-3.33-8.23A4 4 0 0 1 29 23.56l23.31-9.44a4 4 0 0 1 5.18 2.19l3.63 9a9.8 9.8 0 0 1-5.43 12.74ZM67.49 21a3.73 3.73 0 1 1

Chrome Cache Entry: 164

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21762)
Category:	downloaded
Size (bytes):	21811
Entropy (8bit):	5.462655463719556
Encrypted:	false
SSDEEP:	384:f1bjtqrVapZjquHCWnJcJhcby8XziQBy6HUKVMov5hHKs80K:JjtOVaJDnJcPc+EWQ8EM65RR8l
MD5:	0FBB77D1B69F18DF0FDCF836DE1C4106
SHA1:	E8CE4037B97732809F1E1BF24992959C678F2118
SHA-256:	279E49A00A41A18545CF319B5A8B571FD48CFCC4B78A361BBE75A33CE7A4F71A
SHA-512:	F73E3B25561D0D3307C7DD9D505F84101897CFA70737D757AED8D95BDC6A2CE116FD114674DD0BBE666AABE2176B0EEF150A5D4EE2C7C3CCE815A5CA73215D03
Malicious:	false
URL:	https://discord.com/assets/a6f6204cd40c3c5f5c14.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["71984"],{772425:function(t,r,n){var e=n(933676),o=n(938507),i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not a constructor")}},603528:function(t,r,n){var e=n(838957),o=TypeError;t.exports=function(t,r){if(e(r,t))return t;throw o("Incorrect invocation")}},212036:function(t){t.exports="undefined"!=typeof ArrayBuffer&&"undefined"!=typeof DataView},192291:function(t,r,n){var e,o,i,u=n(212036),f=n(325008),a=n(161581),c=n(354848),s=n(622281),y=n(740362),p=n(974971),h=n(938507),v=n(251069),d=n(859209),g=n(4340),l=n(838957),A=n(144748),w=n(276321),x=n(641236),b=n(457507),T=n(644659),E=T.enforce,I=T.get,R=a.Int8Array,m=R&&R.prototype,O=a.Uint8ClampedArray,M=O&&O.prototype,F=R&&A(R),U=m&&A(m),_=Object.prototype,L=a.TypeError,B=x("toStringTag"),C=b("TYPED_ARRAY_TAG"),S="TypedArrayConstructor",P=u&&!!w&&"Opera"!==p(a.opera),V=!1,N={Int8Array:1,Uint8Array:1,Uint8ClampedArray:1,Int16Array:2,U

Chrome Cache Entry: 165

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 38156, version 2.66
Category:	downloaded
Size (bytes):	38156
Entropy (8bit):	7.992862818603593
Encrypted:	true
SSDEEP:	768:YLYEgWfC/zlP948Q4NxhBiMwYatzdYZyXSihSZ9ia6UBJlly12m9U:YLYEszTFQyxfiMwYmxYZ1p9ia6U7r4U
MD5:	3D6549BF2F38372C054EAFB93FA358A9
SHA1:	E7A50F91C7EC5D5D896B55FA964F57EE47E11A1B
SHA-256:	8E401B056DC1EB48D44A01407CEB54372BBC44797D3259069CE96A96DFD8C104
SHA-512:	4BDE638A4111B0D056464CE4FD45861208D1669C117E2632768ACD620FCD924AB6384B3133E4BAF7D537872166EB50CA48899B3909D9DBF2A111A7713322FAD4
Malicious:	false
URL:	https://discord.com/assets/c1b53be672aac192a996.woff2
Preview:	wOF2..............\|T.......B............................. .`..P..<..W.....8..}.6.$..`..r.. ..n..F..v[.Vq...Q.r......9.../h....r~..y...)Jv.._@....Z...cm.z.(...u..#EMKK..e.mm..2,.FK...Y..mk].{...[.^UR......8p.jD.n.t..k.....b!.C...&8...._.-n69(...N....o..w..1...\|.i....!..\...n.^.Kq..../]x.........x..N...=.^".ZF.L.6lD...X..[u.-.............y....\...%.q.....u~.y.K..>.d{...P..BU..2..p.nO.z....y~.....#DT...S.(d-~E.m...][..s...\..+.t..\!H.......'V...@.w..r['bc:V...X.d.86..c.......Xd<..p..N".9...X6..(\|.C..t....0x.E.....8_.....Xs..8(...4I.X2J,Y[[....U..^I.y.#...w.R.....).o..i.....a......t+...Pz.%..FB..&.$.dS.!$...iM;....K....;M....z`iw..j;.Su.I...O.Z9.....d....-2.Y2k.5....M.g..1u.$....T../.K.R1... ..?....C.&.wk..N.X....h.B.......};K@S...@'..4.;...\|x.I.R....zj..Ph....\7...<.m~U ......Hu.(\|SV<...?$.....MO.9.....H..z~R..9rD..y..H........N..i....}.."23.+........\|i.[..\|w..=.a-..E4...f..[....O9..g....x.0.c.f4..p[m.e/...)P......5.M......../..6.&..5.Rw

Chrome Cache Entry: 166

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11118)
Category:	downloaded
Size (bytes):	11167
Entropy (8bit):	5.535074023387345
Encrypted:	false
SSDEEP:	192:YVQA29dyFDfqMgeYTllT06FJLviKriLZErOWD8yLg6T06oGL3rOhzus:QazsqP116In4zn
MD5:	8AAA605C48DC545F185CA77C921139D3
SHA1:	D2481F19DC4D8F4B161D3DD0B35B446FDC505446
SHA-256:	9ADEBA0225F0D293B735E83C05D1BB063F750C439CE8BCD7ED362D795CFD39B1
SHA-512:	469573F4D8F912DC151474F9ACA815F2A686C590408B20733E58C1C21F8DC71A26B2569B8052A8B67331D2DD2FA4E54AD7B4D953FEBC2DCA0676827AC0EFD377
Malicious:	false
URL:	https://discord.com/assets/6df906184440a6461f5c.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["52030"],{48550:function(e,t,s){s.d(t,{P:function(){return l}});var n=s(689938);let l={get webauthn(){return n.Z.Messages.MFA_V2_WEBAUTHN_NAME},get totp(){return n.Z.Messages.MFA_V2_TOTP_NAME},get sms(){return n.Z.Messages.MFA_V2_SMS_NAME},get password(){return n.Z.Messages.MFA_V2_PASSWORD_NAME},get backup(){return n.Z.Messages.MFA_V2_BACKUP_NAME}}},124860:function(e,t,s){s.d(t,{Cd:function(){return f},YR:function(){return S}}),s(47120),s(411104);var n=s(200651),l=s(192379),i=s(481060),r=s(447097),o=s(873124),a=s(248902),d=s(160511),u=s(51693),c=s(973810),h=s(689938);function f(e){var t,s;let{mfaChallenge:h,mfaFinish:f,onEarlyClose:m,onClose:S,width:_=440}=e,[g,x]=l.useState(null!==(s=null===(t=h.methods[0])\|\|void 0===t?void 0:t.type)&&void 0!==s?s:"select"),[E,C]=l.useState(g),p=async e=>{let{mfaType:t,data:s}=e;await f({mfaType:t,data:s,ticket:h.ticket}),null!=S&&S()},v={mfaChallenge:h,finish:p,setSli

Chrome Cache Entry: 167

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9319)
Category:	downloaded
Size (bytes):	9368
Entropy (8bit):	5.515903871543996
Encrypted:	false
SSDEEP:	96:i5FOdCCCb5Ui4C5wOjggHurX0W89VSIFIUpSpWgAUcnNyeVjAZ2dQTK0ne+6ACub:iSbuIAr3gKYa48OwaUDhQDFRtQS
MD5:	484B9F4BDA963A4ADE71A4EB95D2538F
SHA1:	C381C9D9C91D4256D92E2480CB9DF1A0F090F7D6
SHA-256:	EA87CB393653DF89EF7B31DD35BC78C5DBA14B5F5BEC401153A3C51CD566C923
SHA-512:	D18D67D5B5FC1FDBE61C6728B7104A5589837A32D6D20BF59B0405DB4093FBAF3FBF961DBC24158B5C21147945941D75ECBADF264857EAB722C9511F70D0988B
Malicious:	false
URL:	https://discord.com/assets/6674c18c2e4160ceca2d.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["84956"],{986197:function(e,t,n){var i=n(990547),o=n(544891),a=n(570140),s=n(881052),r=n(626135),u=n(573261),l=n(545851),g=n(109488),d=n(794099),c=n(981631),m=n(689938);n(135200);t.Z={resetSuggestions:()=>a.Z.dispatch({type:"POMELO_SUGGESTIONS_RESET"}),async fetchSuggestionsRegistration(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:1500;if(!!(0,d.vc)()){a.Z.dispatch({type:"POMELO_SUGGESTIONS_RESET"});try{var n;let i=await o.tn.get({url:c.ANM.POMELO_SUGGESTIONS_UNAUTHED,query:null==e?void 0:{global_name:e},timeout:t});if(i.ok&&(null===(n=i.body)\|\|void 0===n?void 0:n.username)!=null)return a.Z.dispatch({type:"POMELO_REGISTRATION_SUGGESTIONS_SUCCESS",suggestion:i.body,source:e})}catch(e){return}}},async fetchSuggestions(e){if(!!(0,g.P)())try{var t;a.Z.dispatch({type:"POMELO_SUGGESTIONS_FETCH",usernameSuggestionLoading:!0});let n=await o.tn.get({url:c.ANM.POMELO_SUGGESTIONS,timeout:e});if(

Chrome Cache Entry: 168

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11498)
Category:	dropped
Size (bytes):	11547
Entropy (8bit):	5.654551838352384
Encrypted:	false
SSDEEP:	192:632FaInJkXD9sQex9Wlp4JG+xyhyTBwFRAD0C+eN1Z0:632UK2XD9sQex9Wj4JG+xS0yba0
MD5:	AC6CE4E7FF5F746693AB549F03BE7ADE
SHA1:	2A3F2AFB8955C4218FDE52112D6F2E0E96CBD666
SHA-256:	233B97D0C0F688815243BCED54A8E2B633F60622B8704676F1E7C8F3051E19A1
SHA-512:	6F9EFF5DBC54D96955A801E0BB5A15E08989A8569018C223E0A079BFA03CAB090ADB545A5145EE934B848D2DF677493EF90E8A42D801817A4EA9BCBFC16F5DCD
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["90628"],{231443:function(e){e.exports="/assets/e04bcb7316f7205e85fb.svg"},74830:function(e){e.exports="/assets/23a7a3fd6624342117bf.svg"},206818:function(e){e.exports="/assets/17a91e9b4e7eb3921ed5.svg"},73117:function(e,s,n){e.exports=n.p+"39b91170d9f2309e4c5e.mov"},988868:function(e,s,n){e.exports=n.p+"15aad6b83736f221e23b.mp4"},554355:function(e){e.exports="/assets/fb70c6325a7d728cb6d0.png"},991989:function(e,s,n){e.exports=n.p+"48ad19e80083bee682d2.webm"},787462:function(e,s,n){e.exports=n.p+"a476863d4f441618840f.mov"},635507:function(e,s,n){e.exports=n.p+"87c3abd90e246db4b38a.mp4"},470794:function(e){e.exports="/assets/7df11a68a272724be266.png"},886777:function(e,s,n){e.exports=n.p+"b235c36699192662a3fe.webm"},588705:function(e,s,n){n.d(s,{R:function(){return f}}),n(411104);var t=n(200651),a=n(192379),l=n(442837),r=n(481060),i=n(388905),u=n(686546),o=n(925329),c=n(372769),m=n(726745),d=n(973616),I=

Chrome Cache Entry: 169

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1220)
Category:	downloaded
Size (bytes):	11639
Entropy (8bit):	5.447050095277233
Encrypted:	false
SSDEEP:	96:oTwUTwJTwcUqMJ5DdEQwS1oOfRr8LCzKRe5mvtgCsXe5oEM97Inx/IJ:vz6cCrDYARr80FoVN5nx/0
MD5:	A4D042EDFC50DB622A14E1404DBB7376
SHA1:	5E236D91A7C212B518FB044288EC09BE599338B9
SHA-256:	78EB876F13A8BDA09E76D4F81D4C2E65C08F3B772C0AE89D0C637C610F0A2885
SHA-512:	EF4EB24465524510A17A5169E5354E7E3BC3003C53DF5384003AF0C735904BA4514EF89B0481DEA055C79941D628C30FE54879DE740626F7FE012CF446A73CB2
Malicious:	false
URL:	https://discord.com/invite/privatecommunity
Preview:	<!DOCTYPE html>.<html>.<head> <meta charset="utf-8">. <meta content="width=device-width,initial-scale=1,maximum-scale=3" name="viewport">.<meta name="description" content="Check out the .............. .......... .. community on Discord - hang out with 2638 other members and enjoy free voice and text chat." />.<meta name="twitter:card" content="summary_large_image" />.<meta name="twitter:site" content="@discord" />.<meta name="twitter:title" content="Join the .............. .......... .. Discord Server!" />.<meta name="twitter:description" content="Check out the .............. .......... .. community on Discord - hang out with 2638 other members and enjoy free voice and text chat." />.<meta property="og:title" content="Join the .............. .......... .. Discord Server!" />.<meta property="og:url" content="https://discord.com/invite/privatecommunity" />.<meta property="og:desc

Chrome Cache Entry: 170

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4246
Entropy (8bit):	4.103696787604314
Encrypted:	false
SSDEEP:	96:K9F4GfkbfNyN48/E8jfsrKk1Z/eO4oSgT3I/VcbQokvBD:KnqbfQ48/BfsrKYZ/eOBe9FJD
MD5:	DDA77F765068E4450D3545A40B777663
SHA1:	63AE45EF489734D09D3AEA98E016C0DD1BC733F9
SHA-256:	A644A9364BE96AD0A72F8E24397322B4D0646563A11E8FF76191A9239A561AC9
SHA-512:	D88521109D4AC8EA200F644973A7A554C1A6B8E0AE4658C7F0E3FAFBEE40A1CB8A6A75BECB2A49AE3B8D226BEE36CD8CA63B492FABC2BF034D6A295349567946
Malicious:	false
Preview:	<svg width="124" height="24" viewBox="0 0 124 24" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#a)"><g clip-path="url(#b)" fill="#fff"><path d="M26.242 2.01A25.218 25.218 0 0 0 19.851 0a18.718 18.718 0 0 0-.819 1.701 23.45 23.45 0 0 0-7.083 0A18.2 18.2 0 0 0 11.121 0a25.13 25.13 0 0 0-6.396 2.015C.68 8.132-.417 14.097.132 19.978c2.682 2.005 5.282 3.223 7.838 4.02A19.514 19.514 0 0 0 9.65 21.23a16.507 16.507 0 0 1-2.644-1.287c.222-.165.439-.337.648-.513 5.098 2.386 10.636 2.386 15.673 0 .211.177.428.348.648.513-.839.505-1.726.939-2.649 1.29A19.432 19.432 0 0 0 23.004 24c2.558-.797 5.16-2.015 7.843-4.022.643-6.817-1.099-12.728-4.605-17.968ZM10.343 16.361c-1.53 0-2.785-1.43-2.785-3.17 0-1.741 1.228-3.174 2.785-3.174 1.557 0 2.812 1.43 2.785 3.174.003 1.74-1.228 3.17-2.785 3.17Zm10.293 0c-1.53 0-2.786-1.43-2.786-3.17 0-1.741 1.228-3.174 2.785-3.174 1.557 0 2.812 1.43 2.785 3.174 0 1.74-1.228 3.17-2.785 3.17ZM41.629 6.122h6.652c1.603 0 2.958.257 4.069.767 1.109.51 1.94 1

Chrome Cache Entry: 171

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7029)
Category:	downloaded
Size (bytes):	7078
Entropy (8bit):	5.693672087902241
Encrypted:	false
SSDEEP:	192:EDHGzBioMyirXyf70li//fZc8Twtv1T5aLdMu951f54aH8L:EDmlioLirXyfYlw/xHWOyuB+acL
MD5:	45A3EE5FF96BDB2DD7FBB2846B5EA494
SHA1:	795E2BB4E00AB75A91BDBA9A4C7D9E2B2E0CD905
SHA-256:	08F280458FAB95C2E5754187C406458A8FE69A1C12329C8EF6CB801067E00BB6
SHA-512:	D545E8F9FE857A5A3AC908E1CCDA13ADCD19EFA78AE34143BCB36080C228090B8C5AE446EFE51C4A87A22BD9403B6E851219B331274D8929EB20AF81E9B159F8
Malicious:	false
URL:	https://discord.com/assets/1bab9b095996b8d024ce.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["43222"],{340618:function(r,t,o){var e=o(354848),n=String,c=TypeError;r.exports=function(r){if("object"==typeof r\|\|e(r))return r;throw c("Can't set "+n(r)+" as a prototype")}},442975:function(r,t,o){var e=o(936940);r.exports=!e(function(){function r(){}return r.prototype.constructor=null,Object.getPrototypeOf(new r)!==r.prototype})},33995:function(r){r.exports={IndexSizeError:{s:"INDEX_SIZE_ERR",c:1,m:1},DOMStringSizeError:{s:"DOMSTRING_SIZE_ERR",c:2,m:0},HierarchyRequestError:{s:"HIERARCHY_REQUEST_ERR",c:3,m:1},WrongDocumentError:{s:"WRONG_DOCUMENT_ERR",c:4,m:1},InvalidCharacterError:{s:"INVALID_CHARACTER_ERR",c:5,m:1},NoDataAllowedError:{s:"NO_DATA_ALLOWED_ERR",c:6,m:0},NoModificationAllowedError:{s:"NO_MODIFICATION_ALLOWED_ERR",c:7,m:1},NotFoundError:{s:"NOT_FOUND_ERR",c:8,m:1},NotSupportedError:{s:"NOT_SUPPORTED_ERR",c:9,m:1},InUseAttributeError:{s:"INUSE_ATTRIBUTE_ERR",c:10,m:1},InvalidStateError:{

Chrome Cache Entry: 172

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 43364, version 3.131
Category:	downloaded
Size (bytes):	43364
Entropy (8bit):	7.995499053027601
Encrypted:	true
SSDEEP:	768:fQelRMAMlg6keZjHGyL9BFjYBuukYbpX4Qb0NJ4rLU7KoYVZ:fQeTWlg6kON8cubbpIb+ggf
MD5:	281BBA49537CF936D1A0DF10FB719F63
SHA1:	4085AD185C5902AFD273E3E92296A4DE3DC19EDD
SHA-256:	B78FB569265B01789E7EDD88CFE02ECB2C3FEE5E1999678255F9B78A3B2CC4E8
SHA-512:	AF988371DB77831F76EDF95A50B9DDF1E957F0230404C8307914F11211E01CC95C61E0768D55AA4347F24E856D226F7E07AC21C09880E49DBD6346D1760B8BFF
Malicious:	false
URL:	https://discord.com/assets/8234e0a75aa9afb205bd.woff2
Preview:	wOF2.......d.......8..............................x...@..\.`..X..>...........".6.$........ .....K...[.q...c...5.nC...U....?...q.zn.<..-...a..C..J;..8.....s......M.@5.u.F....).'.N..9{U.'..u...\|.;W....gz;m.o..&A.....o.........Vm/....a.VNF......T/$..iM......".J(...:.F1.x.}.F....%..Xb.3d%....)Yv..'.th..}..&......k.f..%'..i=@..p..wr.<.i.;...c...13..........i....{.F...&{.....A.]....-...?.....<.....J?.9B.&.f.d.).T...S.. n...g7N...w.=...\|.!......b..s.........qI<F:...p...y...2.h.+1L.,.mG\..4.E%+r...........o#7F..H.-.h..R..EXdHY.......(....-J....Mg..%m.5I....]rQo.$M..m..m...dL.m.n.~....clT.m..=.(..3....Cz..p........k...dF?......s...rQ.)}....LS....}._.5......z.....P.B$.T.D..OX.r.5..-1.H..pD..L../.........'....&'\.T.N...........-.}J..Z....y.d!t..#....@.].!P5..S.`.A.`....E.y...k..*d.......p..O.H.7...P...q......4.....U.Y2.w4..E. Y]$Y.R...x.=..+...T7.-O..yH.0/.&....E.q1[.uOO[..=\Q"...,..W\q1\a..).......`acasaacc4s...XXX....e..v.-N.oh)...E%..D......#..CL

Chrome Cache Entry: 173

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.460750616283363
Encrypted:	false
SSDEEP:	3:YGKjl8jwDEYRrajpHV+wJ6ARORzACDEYkayjY6v:YGKjDRrajpHV9LorMcE
MD5:	30B15D37E2F2C6C09F35BCC56B64571A
SHA1:	A5566ADA13410C39A4059BEC0FF59D51316D89CD
SHA-256:	BE58D93E5BC2C48B3FB9C87BD7140109630195E84CCE67701FCCABCF5256BFE0
SHA-512:	EE8E8192B3120D7A2FC9DCE3585D87FAAF689B2E03046C8B7F533FE3CBA408BF0E8614CA2AACD6ED21A206B4B461ECA507D5B38D01839CA9AC5B93971D1F7B10
Malicious:	false
Preview:	{"consent_required":false,"country_code":"US","promotional_email_opt_in":{"required":false,"pre_checked":false}}.

Chrome Cache Entry: 174

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5552)
Category:	dropped
Size (bytes):	5601
Entropy (8bit):	5.7655360019382895
Encrypted:	false
SSDEEP:	96:2XobeWK+r3kiJfaaLUmbybQSfuaVRbm0HMgFfgWuAyEdVAmefr4/8VZPUGky:qobvfaa9DSfXDbXMaYPAyEdLefr4/YMe
MD5:	13FF42A071C43FA5521C11EB2F2EA914
SHA1:	B97D6318B384D57DEFD41EC4DEBF9D7DE198537C
SHA-256:	6B8776086567649C2432023184979BB8244A268C081FC1D478D834BF50A169F9
SHA-512:	F38C1D3760B23A65EACDB8214424227BDFE638C4A86E6DB89D8D86E29A820060165583FB7794E77935E52B62A6FE09567FC71FB44986D0FBD473F54DEBC56202
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["46369"],{438820:function(e,t,n){var i,a=n(442837),c=n(570140);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}let s={canPlayWowMoment:!1,isFetchingWowMomentMedia:!1,wowMomentWumpusMediaUrl:null};class d extends(i=a.ZP.PersistedStore){initialize(e){null!=e&&(s=e),s.canPlayWowMoment=!1,s.isFetchingWowMomentMedia=!1,s.wowMomentWumpusMediaUrl=null}getState(){return s}get canPlayWowMoment(){return s.canPlayWowMoment}get isFetchingWowMomentMedia(){return s.isFetchingWowMomentMedia}get wowMomentWumpusMedia(){return s.wowMomentWumpusMediaUrl}}o(d,"displayName","PurchasedItemsFestivityStore"),o(d,"persistKey","PurchasedItemsFestivityStore"),o(d,"migrations",[e=>({...e})]),t.Z=new d(c.Z,{LOGOUT:function(){s={canPlayWowMoment:!1,isFetchingWowMomentMedia:!1,wowMomentWumpusMediaUrl:null}},PURCHASED_ITEMS_FESTIVITY_SET_CAN_PLAY_WOW_MOMENT:functi

Chrome Cache Entry: 175

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (28863)
Category:	dropped
Size (bytes):	28864
Entropy (8bit):	4.499876765666944
Encrypted:	false
SSDEEP:	384:Dbqk4HVnC1CcPtMjBuvLTBrqDoiba+h3pjeuOXPRTpCLhuYNWGLk:DbzwC3ku3UDbzU9JYcOLk
MD5:	0D728EE17577BE00FD0689118969EE4A
SHA1:	ADCFF1FD23F0D295C090C0D60EC446CC302E8B61
SHA-256:	1AE9A0B94F208129789C94BEB87262742C9992AB98A232B9D47E9545944C5A0E
SHA-512:	0C3CEAED05E997A85AB0F1BD8A7757752FF8225CF3138646562FC6CEC68F03EEAE7C4F1A4E674FCE522FE34AEC472AF56B4B9444DF0EC1FFD108EF4B44B54A48
Malicious:	false
Preview:	{"fingerprint":"1298907776634064996.chIr-LijiGVch-zgFnzsCKUGSeQ","assignments":[[2810205487,1,1,-1,3,3600,0,0],[2617218444,4,1,-1,2,6524,0,0],[3035674767,0,1,-1,0,5896,0,0],[1609782151,0,1,-1,2,1805,0,0],[3643362751,0,1,-1,0,6626,0,0],[3753034466,1,2,-1,0,5844,0,0],[1913882179,0,1,-1,2,9290,0,0],[1567199723,0,1,-1,1,5398,0,0],[454783470,4,1,-1,0,5664,0,0],[3450899088,1,1,-1,0,5463,0,0],[3656796460,3,3,-1,3,4011,0,0],[1814483290,0,1,-1,0,7054,0,0],[4221006726,0,1,-1,0,3719,0,0],[1398673921,1,1,-1,0,7653,0,0],[2532700533,0,1,-1,0,4642,0,0],[3557480712,0,1,-1,0,7841,0,0],[853403133,4,1,-1,0,9473,0,0],[2491005019,4,1,-1,0,6827,0,0],[3889077804,2,1,-1,0,2816,0,0],[4079214319,2,1,-1,0,5101,0,0],[1034661306,0,1,-1,0,2990,0,0],[828251710,2,1,-1,1,2510,0,0],[3124003316,1,1,-1,0,3553,0,0],[2676348506,0,1,-1,0,4108,0,0],[4136574802,0,1,-1,1,8261,0,0],[4049571159,0,1,-1,0,9141,0,0],[3182051840,0,1,-1,0,151,0,0],[2539540256,0,1,-1,3,9311,0,0],[3991298449,2,1,-1,2,4762,0,0],[472975400,6,1,-1,0,1138,

Chrome Cache Entry: 176

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 45868, version 3.131
Category:	downloaded
Size (bytes):	45868
Entropy (8bit):	7.995149406203617
Encrypted:	true
SSDEEP:	768:7T3lyZzszaXGZG8vNh620Ph+EdGcNo3ITx62hw4oZkha6UK5+Ubp7tSSC5Zn/pf8:7TVyZwzQZ8vNd0Ph9/Nuo6GPUK5+UbJz
MD5:	D295C40AF6FCA08F8E0EB5425351F431
SHA1:	1D246A1E54B3A1F2428883D8C911AF73EDDFFCA6
SHA-256:	5D225B25D66B30563A00F395476ED701130D3F749620A63531CEA09FC537164E
SHA-512:	9C9F23CB775244EB10F83F964B36224AD2CD5152CFA5AB82928F68ED1CB49BE4156F887CC40A857B72EFD0833014E4366BF136689A717DD58828A1B195ED486E
Malicious:	false
URL:	https://discord.com/assets/8bd8143eff37936894aa.woff2
Preview:	wOF2.......,......................................x......\.`..X..@........T..@.6.$........ ..a..K..x[T...5...(..V.M..m...{.9....s49..ybj.......>}.m......O&r.%.T..Q....5.43.yD..u.%.S.w^.B....1p\|b2..g...Wuq.B...2.e~.3..>.I..TLP..c.....c$8..Tle.......U:6Wl.=.....U..V............W .iH8..7...r..~.eo.A......8..T.`.o........&.L".o.E..v....+B...N"].p...d [ ..Z_.w....s....L......,.E..=+.y3l...-......K..5..6....~.r.f..5D..U\|W.$...n.f.(6..j.\|....B...]..-....]"..5..[g.B..[s..% .[/.D..m.../...U}d....T.<....b......\|..Fc..K..2Y..pb}m\..p.....:.hn.6$F..F..1"E*.h+......&5r..(...\|\|g.N\T.....I.4KD[U.^V..y.{.n%j3.k.....E%...@...<(j.......O....K...0 L...QD.......Q.xzQ...[Y..".1F..1j0F...C.."e.i.wN/<.(...k.".++....`........UW.K3.......}...u+I%........y.o.v.ym....D\|f2.cWr@...l;.L.Y..~.&..g.... b[......j..I.i.H.{4n....s.y.`_v7..,...Z...".S.t.J3.[...t+.'b..F.6...Q`.!..B...N.0L.,<.:>......:@.SP..9@2.....rvr0.oJ,.5..p'..V.Js@.....L..%[.%#=.y3.\|..V.fa.m;).....G....._

Chrome Cache Entry: 177

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2701)
Category:	downloaded
Size (bytes):	2750
Entropy (8bit):	5.460366645013334
Encrypted:	false
SSDEEP:	48:F0fzk02vWrc1AKTMSTEcr9rTOLBsmPBo/6XgpdgwrIsi5dEk+MQwq2kWkGRv6hvr:ek02hfMXcKs+lXyisi5CkiPrWk+Ch/Ew
MD5:	390A7AB1F964AA8CB1B87DD13732C3BC
SHA1:	CEA52AC6FA0CDF49A18D51C8CD8A5C4FB52DEAC9
SHA-256:	BEDD382930BA4E10DFA902BF833195911F82E754223441446E9D7CC45B01110F
SHA-512:	4B799488E35C5B933E9B1BA6AB335E2EAD6D625D3DC1FEC19DD80F48B9B7996171BEC24513095F3F1BAA9C8B7675FA4E527B763AEED26B69273BF2DCED014D3F
Malicious:	false
URL:	https://discord.com/assets/29a63f12209c956d9204.js
Preview:	(()=>{"use strict";var t={137920:function(t,r,n){var e,i;n.d(r,{J:function(){return u},z:function(){return e}}),(i=e\|\|(e={}))[i.NONE=0]="NONE",i[i.SOCIAL=1]="SOCIAL",i[i.CASUAL=2]="CASUAL",i[i.COMPETITIVE=3]="COMPETITIVE",i[i.CREATIVE=4]="CREATIVE",i[i.VERY_HARDCORE=5]="VERY_HARDCORE";let u={0:"NONE",4:"NONE",1:"CASUAL",2:"CASUAL",3:"COMPETITIVE",5:"COMPETITIVE"}},945124:function(t,r,n){n.d(r,{y:function(){return i}});var e=n(137920);function i(t,r){let n=0;return null!=r.games&&(n+=2r.games.filter(r=>t.games.includes(r)).length),null!=r.playstyle&&(r.playstyle===t.playstyle?n+=2:e.J[t.playstyle]===e.J[r.playstyle]&&(n+=1)),null!=r.traits&&(n+=2Array.from(r.traits).filter(r=>t.traits.includes(r)).length),n}},866762:function(t,r,n){n(312677);var e=n(945124);self.addEventListener("message",t=>{var r,n;let{data:{unsortedClans:i,id:u,criteria:o}}=t;let a=(r=i,n=o,r.map(t=>({...t,affinity:(0,e.y)(t,n)})).sort((t,r)=>{var i,u;let o=null!==(i=r.affinity)&&void 0!==i?i:(0,e.y)(r,n);return o-

Chrome Cache Entry: 178

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	168789
Entropy (8bit):	5.612789333447181
Encrypted:	false
SSDEEP:	1536:lvVvKVPI1oqgO/usjA1vkY0JCxf7UG/9rHUQNbsbkb5a05VGOEc2+hzuy6fvxO7a:uVPIgPvEc7N/9rNhbYy6w7XvXcZ
MD5:	3B74671903D935A08DC04ACEF440C188
SHA1:	7B2C8D8AE72E5E2DA1BA4440722810565E11084C
SHA-256:	4AC4D0F31456B9D1741A52E5C54089952219E0C2287D83B81F12C94468DB3B03
SHA-512:	7F465558B1D640EEC9639921A70C0C0A9AE8BD7F95D0EE098B0553A7B84C5B983A9140FA48C45453FD8E39FAB7188000A2A0628300C4CEF9FE3F2742C20F1C62
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["41315"],{863942:function(e,t,n){var s=n(22092);(0,n(192291).exportTypedArrayStaticMethod)("from",n(12367),s)},70519:function(e){e.exports="/assets/76a4af59aa173c519461.svg"},806848:function(e){e.exports="/assets/6183fdc13d8046fd5bda.svg"},512266:function(e){e.exports="/assets/a2d51a24d014f52f83a6.png"},105020:function(e){e.exports="/assets/89ea0e62d0f8ffa67a17.svg"},211095:function(e){e.exports="/assets/86755fd1deda5cb45518.svg"},640356:function(e){e.exports="/assets/3880dc73d6be9d91ef36.svg"},515695:function(e){e.exports="/assets/450a761db3bfe89ca9b9.png"},892235:function(e){e.exports="/assets/48f03d965f1e82275006.svg"},375673:function(e){e.exports="/assets/3cf7f333e815240d3294.svg"},73962:function(e){e.exports="/assets/ed7318a94c14ce41d11d.svg"},689411:function(e){e.exports="/assets/831c999494cb5e095eae.svg"},2984:function(e){e.exports="/assets/0e5029fd9cd4812b6712.svg"},575703:function(e){e.exports=

Chrome Cache Entry: 179

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	24565
Entropy (8bit):	6.000976601202208
Encrypted:	false
SSDEEP:	384:xakxHbO0x9ipfSEuH44B445H44Q544Aq44Q4P44ZF944Q4Q4424Qb444nxWl444p:xZxH5ripqEuH44B445H44Q544Aq44Q4+
MD5:	EC2C34CADD4B5F4594415127380A85E6
SHA1:	E7E129270DA0153510EF04A148D08702B980B679
SHA-256:	128E20B3B15C65DD470CB9D0DC8FE10E2FF9F72FAC99EE621B01A391EF6B81C7
SHA-512:	C1997779FF5D0F74A7FBB359606DAB83439C143FBDB52025495BDC3A7CB87188085EAF12CC434CBF63B3F8DA5417C8A03F2E64F751C0A63508E4412EA4E7425C
Malicious:	false
URL:	https://discord.com/assets/favicon.ico
Preview:	............ .h...F... .... .........00.... ..%..V......... ..$...:..(....... ..... ..........................................dX2.dX..dW..dW..dX..dX..dX..dX2.........................dW..dW..dX..eX..eX..eX..eX..eX..eX..dW..dW..dW..............dW..dX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eW..........dW..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eW......dX2.dW..eX..eX..\|q......eX..eX..eX..eX......\|q..eX..eX..eX..eX2.dW..eX..eX..........................................eX..eX..eW..dW..eX..eX..........................................eX..eX..dW..dW..eX..eX..............eX..........eX..............eX..eX..dW..dW..eX..eX..........................................eX..eX..dW..dW..eX..eX..~s..................................~s..eX..eX..dW..dW..eX..eX..eX..................................eX..eX..eX..dW..dX2.eX..eX..eX..h[..........{p..{p..........h[..eX..eX..dW..eW2.....dX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eW..........eX..dX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eW..e

Chrome Cache Entry: 180

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8712)
Category:	downloaded
Size (bytes):	8761
Entropy (8bit):	5.595354119822134
Encrypted:	false
SSDEEP:	96:7YoXmoXiURhBU9QCy4WqAVMF+FW91nuFua4MDeTVPpz6jid6ftysD9g9u6EPaLil:7YoXmoXE9xUFEuTKt2lyLkTp/os
MD5:	102FE4FDEC4447C9891C9F3FAEAE0474
SHA1:	3FA3BAF1DCED3A39DF8599BEEFA5180B436A782C
SHA-256:	E45508538EE1AB34F520303F7D1A9A7F5CB5D99FF34CE7E5EB64EB32EF6F19F9
SHA-512:	97942EEC44A5F613A45A514E355F26EC3B2458BA497009D4D70D88FF3562C94212DFB424AF0CE37BE880F3528446B28BBAB6F77C2717F0C16BF1317AFBC030D4
Malicious:	false
URL:	https://discord.com/assets/d86788be99e870993214.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["18543"],{725436:function(e,t,n){n.d(t,{m:function(){return u}});var s=n(454585),a=n(551452),l=n(532901);let r={...s.Z.guildEventRules.link,react:(0,l.Z)({enableBuildOverrides:!1,mustConfirmExternalLink:!0}).react},i={...s.Z.guildEventRules.channelMention,react:(0,a.Z)({enableBuildOverrides:!1,shouldCloseDefaultModals:!0,shouldStopPropagation:!0}).react},u=s.Z.reactParserFor({...s.Z.guildEventRules,link:r,channelMention:i})},315416:function(e,t,n){n.d(t,{Z:function(){return i}});var s=n(192379),a=n(442837),l=n(897285),r=n(924301);function i(e,t,n){let i=(0,a.e7)([r.ZP],()=>r.ZP.getUserCount(t,n));return(0,s.useEffect)(()=>{null!=e&&null!=t&&l.Z.getGuildEventUserCounts(e,t,null!=n?[n]:[])},[t,e,n]),i}},405613:function(e,t,n){n.d(t,{Z:function(){return l}});var s=n(134432),a=n(981631);function l(e,t){let n;if(null==e.image)return null;null==t&&(t=window.screen.width*(0,s.x_)()),t=(0,s.oO)(t);let l=window.

Chrome Cache Entry: 181

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7679)
Category:	dropped
Size (bytes):	7728
Entropy (8bit):	5.087323529198084
Encrypted:	false
SSDEEP:	96:wgSRVk6Wg8lh4Nrviiv1aWPRkDhTt9qwqSBtxCMNMRV0IBSAMD9C+m+rmxARJx3t:RSRVmriLDPRkxtRJxNMRV0IZdSL9ilfA
MD5:	1C6B9D0AD743762986197AE0E81874C1
SHA1:	EABACE4131BA74B108FC891EA843B4F85B218808
SHA-256:	2D739091F602476FCF261435B48A1FAFCE2533564FFF0549D27B47E341B4DCBF
SHA-512:	74FDE9F8997087BB107ED5DDC3A4A37BD24793CAAD605FBDCDD54E9D18AF8F44D0C0E92FB2259AA936BD1B20D5537441EF39D9A7F066323911436184B0138111
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["75492"],{849146:function(t,e,n){var r=function(){if("undefined"!=typeof Map)return Map;function t(t,e){var n=-1;return t.some(function(t,r){return t[0]===e&&(n=r,!0)}),n}return function(){function e(){this.__entries__=[]}return Object.defineProperty(e.prototype,"size",{get:function(){return this.__entries__.length},enumerable:!0,configurable:!0}),e.prototype.get=function(e){var n=t(this.__entries__,e),r=this.__entries__[n];return r&&r[1]},e.prototype.set=function(e,n){var r=t(this.__entries__,e);~r?this.__entries__[r][1]=n:this.__entries__.push([e,n])},e.prototype.delete=function(e){var n=this.__entries__,r=t(n,e);~r&&n.splice(r,1)},e.prototype.has=function(e){return!!~t(this.__entries__,e)},e.prototype.clear=function(){this.__entries__.splice(0)},e.prototype.forEach=function(t,e){void 0===e&&(e=null);for(var n=0,r=this.__entries__;n<r.length;n++){var i=r[n];t.call(e,i[1],i[0])}},e}()}(),i="undefined"!

Chrome Cache Entry: 182

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 39724, version 2.66
Category:	downloaded
Size (bytes):	39724
Entropy (8bit):	7.994965715436545
Encrypted:	true
SSDEEP:	768:w35mZVsqT7RAo+6tbgLdolT9YSswcTWa+O/dm8ae41u37qt+:1xTO3kb0dolT998WhO/Hae4jt+
MD5:	FF5ECCDE83F118CEA0224EBBB9DC3179
SHA1:	0AD305614C46BDB6B7BB3445C2430E12AECEE879
SHA-256:	13DA02CE62B1A388A7C8D6F3BD286FE774EE2B91AC63D281523E80B2A8A063BC
SHA-512:	03DC88F429DD72D9433605C7C0F5659AD8D72F222DA0BB6BF03B46F4A509B17EC2181AF5DB180C2F6D11C02F39A871C651BE82E28FB5859037E1BBF6A7A20F6B
Malicious:	false
URL:	https://discord.com/assets/b21c5111a12372139409.woff2
Preview:	wOF2.......,......\|P.......B............................. .`..P..@..W........<.6.$..`..r.. ..<..F..`[pVq..w.SI..+.S.f;dS.i.. C.bj.6..w;./......OM&..[.mo-......4F`...SeR.XzP.g..j..L.....S.T(a..y.D...od./).....\|l...zn...T..OpZP....c\....%.H..y..g.!..!..\|._........O._.[.nJS..]..H....rd..#.?.n#.B.w.w...":.u...\|.a..#.#N...q.z.Z.....".5...X...3\|O...8>......(...H....M\|.w.o.%.%..\|5.'L.a.N.) ..G`.(1.je.#.~_.......!...7.e.......s.\.`G.^...h.B....tR.N..+"xU....3.F}0....z...@^..iB^....u&....._{.$]..........8k....?.c...^.~...A2...T.$.i.....Ycx!b~.x...3:g.[.!.X...fgt.duf.....uZW!....y..(].$.If_....g69.Ef.'{.ndC..Yt6...;..\..M......E'.^I....rFJ..)1\|...q......!.m~......../M.........7!I.E...U..!"....:...T9{!=.+... ..es2.2.%.Ll.t.j.D .p..<...$.....%...IB"'..#H.D............;OWk..G.Y.V....\&.U{.V....N.h....S[Yg(......f..Uu......z2.(.r..3...,-...G....c.9^"..:..>.......Q....S......]D'.,.@4..w./S.ep`...].sGR....Vc.j...-.\|..}_...&.eg.G..e.u...(./S..+H.'.9\.k%..

Chrome Cache Entry: 183

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	14624305
Entropy (8bit):	5.854943527266922
Encrypted:	false
SSDEEP:	196608:r6lXgFXaYzjupIEtYW4sZoymJBkD/skskv:rXXaYzjupIEtYW4sZ9mJBkDks
MD5:	216CB783D60A3E7C57C9D9FFEA99DC3F
SHA1:	C645D044161C447B84CBA1E62FCB018B5A7D6066
SHA-256:	48D0B669FD29BF3D5A6552EBD89B2048FBB6D58F824E8DD1F92772AC5821D716
SHA-512:	54F12CC52FBCAE1DF1575969CD269E75795B6D469B2C5CB0854D5A242A9A460CFBC8A9C9DCBDF4A7B7CEBC9EEC2EFC54A714C9CB6DB68974173DA2AC4E01E84B
Malicious:	false
Preview:	(()=>{var e={385007:function(e,t,n){var r={"./de.jsona":["644753","30244"],"./zh-CN.jsona":["494062","56446"],"./da.jsona":["44867","57387"],"./el.jsona":["581144","55601"],"./tr.jsona":["146878","84385"],"./es-ES.jsona":["872550","45747"],"./hr.jsona":["403530","29924"],"./cs.jsona":["753771","87233"],"./fi.jsona":["554545","7402"],"./es-419.jsona":["39227","59729"],"./ja.jsona":["516722","7728"],"./pt-BR.jsona":["246297","394"],"./ro.jsona":["37190","53269"],"./sv-SE.jsona":["335417","11193"],"./ru.jsona":["809464","12611"],"./vi.jsona":["139107","45576"],"./id.jsona":["492248","77800"],"./it.jsona":["515630","78670"],"./uk.jsona":["167111","58548"],"./lt.jsona":["877749","44754"],"./pl.jsona":["477384","60878"],"./hu.jsona":["107425","98570"],"./nl.jsona":["432763","41588"],"./th.jsona":["182260","49827"],"./bg.jsona":["251927","20575"],"./fr.jsona":["570173","99450"],"./zh-TW.jsona":["592369","30684"],"./hi.jsona":["629869","22732"],"./en-GB.jsona":["569249","99339"],"./ko.jsona":[

Chrome Cache Entry: 184

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 137140, version 2.459
Category:	downloaded
Size (bytes):	137140
Entropy (8bit):	7.998481140044296
Encrypted:	true
SSDEEP:	3072:kX89D4n2tV29WN9z2uXw/hqzr7IbI1O1KfB9Bk8WnRSqv2WDc+FC5:kn2tS/IzXIbIo1KZWUqv2W8
MD5:	F9BF0F65660D23C6F359D22720FC55AE
SHA1:	9FA19AB7EA56165E2138C443816C278D5752DD08
SHA-256:	426AE06CD942849AB48B84C287C760F3701B603EBCC5C9AAA4A89923EF5F058E
SHA-512:	436019A96E47848533684A34E3C360F516C29B2AA2473D0A05D50C0FD3AD19EAC39DF2DE12B6EC1C6760493EFB5ABF58E6A54D32080226FA1765983435634D88
Malicious:	false
URL:	https://discord.com/assets/f5b8aa3411dfc24ff2e6.woff2
Preview:	wOF2..............0....U..........................f........`........$..U.6.$..T..X.. ......[..[.;......w.N....ZjU...]".u..$.k..<..1...3@i...6.I.X......@ydf.h#..................{I~<:..I..C_........#.]7i..q[.+PF.U...x.......1..b..31Va....aB......n.V..&.Q.3cc.L...1f6.-:x.G..`EE.....r ......6..r..F.u..<\|..aEX.V......c.L.,....RX....V....FQ.u..q.^.{q.]#.y..I.....19c$..j...k...W.......+.....H.dy....-.c.....X<<.....@.Q=.........:....+....F..z.K..Y..{t..{..p..".I......M.X\|t........}......nk42...S\.....$H...0...m......#f>EU..-z.k\|.. ..Y.'..;<?.......S.C...............weU"...ES.2.>.%...O..q.@....F...0.aR.F\|[a..Vq...z\|HQ_m-j.3x1.XX.p...T./...z.p\|..<-...%;Fx.....8CG&d..FQ.{.'..1...1#7..a?.;.G.....~U..4.F.....Q.f...3..t:.~..o};"+...O....>D.x)%.. .O:.x.`N..]..uG.....C.!......%z..g...ZT.p.........5.......@!.S#/6$.k%..]...b=. $0gOC.]G\..lU....DH...(..;.e.B.!GH.5.eY.eY...-.m.....\..&.KYF3...-..........-......d..V.&w..... ..{..C.SZ...p)...d.w,...<....}.@

Chrome Cache Entry: 185

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18413)
Category:	dropped
Size (bytes):	18462
Entropy (8bit):	5.313916053766187
Encrypted:	false
SSDEEP:	384:r0Q0mLG04pG+rx1GoKoLItuPVMWpUdq3FYbNbeka5xeWoY/La0WMTUbbbutFY/GU:r0PmLGTGGDGoRstuKFNCQ/ORQL
MD5:	DC15D17D50A8A78E8C593E27FA1EAF57
SHA1:	42BD0149308EEBA00FF841AC13E5AB6DC7659513
SHA-256:	FFE3FB22E7E5528DA94902D66D2C834C448E7AC03896B63886E08CECCFC26A35
SHA-512:	4FF0AF46A6E692365F6037AD1778652A05401DBF3C2C042BF75B3AED44F37D642D63967FE65720176B3513E2791DC1DF9C784D0C9A3C2BF380832B4216569A5E
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["20011"],{482682:function(t){t.exports="/assets/ebb5b41de823fbc19d12.png"},450125:function(t){t.exports="/assets/1e4932a7afbb1fcdba2d.png"},733949:function(t){t.exports="/assets/e1ce6b38901837435ec5.png"},877604:function(t,i,e){e(411104);var s,n=e(200651),h=e(192379),a=e(120356),r=e.n(a),l=e(111543);function o(t,i,e){return i in t?Object.defineProperty(t,i,{value:e,enumerable:!0,configurable:!0,writable:!0}):t[i]=e,t}let d=t=>new Promise((i,e)=>{null==t&&e(Error("No image src passed"));let s=new Image;s.src=t,s.onload=()=>i(s),s.onerror=t=>e(t)});class u extends(s=h.PureComponent){componentDidUpdate(t){t.src!==this.props.src&&this.setState({loaded:!1},()=>this.initialize())}initialize(){d(this.props.src).then(()=>{!this.unmounting&&this.setState({loaded:!0})})}componentWillUnmount(){this.unmounting=!0}render(){let{className:t,src:i,alt:e,width:s,height:h,onLoad:a,style:o,imageClassName:d}=this.props,{lo

Chrome Cache Entry: 186

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18413)
Category:	downloaded
Size (bytes):	18462
Entropy (8bit):	5.313916053766187
Encrypted:	false
SSDEEP:	384:r0Q0mLG04pG+rx1GoKoLItuPVMWpUdq3FYbNbeka5xeWoY/La0WMTUbbbutFY/GU:r0PmLGTGGDGoRstuKFNCQ/ORQL
MD5:	DC15D17D50A8A78E8C593E27FA1EAF57
SHA1:	42BD0149308EEBA00FF841AC13E5AB6DC7659513
SHA-256:	FFE3FB22E7E5528DA94902D66D2C834C448E7AC03896B63886E08CECCFC26A35
SHA-512:	4FF0AF46A6E692365F6037AD1778652A05401DBF3C2C042BF75B3AED44F37D642D63967FE65720176B3513E2791DC1DF9C784D0C9A3C2BF380832B4216569A5E
Malicious:	false
URL:	https://discord.com/assets/89b7ddebcacbe8dfbd3a.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["20011"],{482682:function(t){t.exports="/assets/ebb5b41de823fbc19d12.png"},450125:function(t){t.exports="/assets/1e4932a7afbb1fcdba2d.png"},733949:function(t){t.exports="/assets/e1ce6b38901837435ec5.png"},877604:function(t,i,e){e(411104);var s,n=e(200651),h=e(192379),a=e(120356),r=e.n(a),l=e(111543);function o(t,i,e){return i in t?Object.defineProperty(t,i,{value:e,enumerable:!0,configurable:!0,writable:!0}):t[i]=e,t}let d=t=>new Promise((i,e)=>{null==t&&e(Error("No image src passed"));let s=new Image;s.src=t,s.onload=()=>i(s),s.onerror=t=>e(t)});class u extends(s=h.PureComponent){componentDidUpdate(t){t.src!==this.props.src&&this.setState({loaded:!1},()=>this.initialize())}initialize(){d(this.props.src).then(()=>{!this.unmounting&&this.setState({loaded:!0})})}componentWillUnmount(){this.unmounting=!0}render(){let{className:t,src:i,alt:e,width:s,height:h,onLoad:a,style:o,imageClassName:d}=this.props,{lo

Chrome Cache Entry: 187

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	5.359578028959659
Encrypted:	false
SSDEEP:	24:Y74WU4bejvfkjyDEfXgAh/4ACjsY384W9iiex4grjh:Y741gerKyDEfbftY384Swx4UN
MD5:	E2CD13D6C4B1EF7E464FD22FBC18BA56
SHA1:	478AC70BFFF328092BC4A88898AD5ECB7232AB23
SHA-256:	B48B77DEC8C7D5A0953A7F8F06E363884387239A5A3BF9B9BD63945B68FE3A2B
SHA-512:	53F927063C760D199A8A11733AF3CB821C53BEF30EFAF4D113970CDE2AA6791E1FBED06EB947A707CC4316CAFA799CAE1B88A00280C05C6AE89BBF48C3B84A4C
Malicious:	false
Preview:	{"type":0,"code":"privatecommunity","expires_at":null,"guild":{"id":"1230227842877620359","name":"\ud835\udc0f\ud835\udc11\ud835\udc08\ud835\udc15\ud835\udc00\ud835\udc13\ud835\udc04 \ud835\udc12\ud835\udc13\ud835\udc0e\ud835\udc11\ud835\udc04 \ud83d\udd10","splash":"04b58b5d8c863962ccdac305e5ee1269","banner":"0ada4913f44d405e7a85ad7d492c34fd","description":null,"icon":"a_75aa56a5faded73ac41ce0fac1e7d74c","features":["BANNER","PRIVATE_THREADS","ROLE_ICONS","THREE_DAY_THREAD_ARCHIVE","MEMBER_PROFILES","ENABLED_MODERATION_EXPERIENCE_FOR_NON_COMMUNITY","ANIMATED_BANNER","SOUNDBOARD","COMMUNITY","ANIMATED_ICON","NEWS","INVITE_SPLASH","VANITY_URL","SEVEN_DAY_THREAD_ARCHIVE"],"verification_level":4,"vanity_url_code":"privatecommunity","nsfw_level":0,"nsfw":false,"premium_subscription_count":56},"guild_id":"1230227842877620359","channel":{"id":"1230229306408697856","type":0,"name":"\ud83c\udf10\u30fb\ud835\udc12\ud835\udc08\ud835\udc13\ud835\udc04-\ud835\udc0f\ud835\udc11\ud835\udc08\ud835\ud

Chrome Cache Entry: 188

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7029)
Category:	dropped
Size (bytes):	7078
Entropy (8bit):	5.693672087902241
Encrypted:	false
SSDEEP:	192:EDHGzBioMyirXyf70li//fZc8Twtv1T5aLdMu951f54aH8L:EDmlioLirXyfYlw/xHWOyuB+acL
MD5:	45A3EE5FF96BDB2DD7FBB2846B5EA494
SHA1:	795E2BB4E00AB75A91BDBA9A4C7D9E2B2E0CD905
SHA-256:	08F280458FAB95C2E5754187C406458A8FE69A1C12329C8EF6CB801067E00BB6
SHA-512:	D545E8F9FE857A5A3AC908E1CCDA13ADCD19EFA78AE34143BCB36080C228090B8C5AE446EFE51C4A87A22BD9403B6E851219B331274D8929EB20AF81E9B159F8
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["43222"],{340618:function(r,t,o){var e=o(354848),n=String,c=TypeError;r.exports=function(r){if("object"==typeof r\|\|e(r))return r;throw c("Can't set "+n(r)+" as a prototype")}},442975:function(r,t,o){var e=o(936940);r.exports=!e(function(){function r(){}return r.prototype.constructor=null,Object.getPrototypeOf(new r)!==r.prototype})},33995:function(r){r.exports={IndexSizeError:{s:"INDEX_SIZE_ERR",c:1,m:1},DOMStringSizeError:{s:"DOMSTRING_SIZE_ERR",c:2,m:0},HierarchyRequestError:{s:"HIERARCHY_REQUEST_ERR",c:3,m:1},WrongDocumentError:{s:"WRONG_DOCUMENT_ERR",c:4,m:1},InvalidCharacterError:{s:"INVALID_CHARACTER_ERR",c:5,m:1},NoDataAllowedError:{s:"NO_DATA_ALLOWED_ERR",c:6,m:0},NoModificationAllowedError:{s:"NO_MODIFICATION_ALLOWED_ERR",c:7,m:1},NotFoundError:{s:"NOT_FOUND_ERR",c:8,m:1},NotSupportedError:{s:"NOT_SUPPORTED_ERR",c:9,m:1},InUseAttributeError:{s:"INUSE_ATTRIBUTE_ERR",c:10,m:1},InvalidStateError:{

Chrome Cache Entry: 189

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (35326)
Category:	downloaded
Size (bytes):	35327
Entropy (8bit):	4.432899375342247
Encrypted:	false
SSDEEP:	384:UIScTwQpPEPnFd+1CcPtMjBupLTBr3DozAbb2S+h3pjeuOzPRTfZoDpavLhuYpWj:EcTDGnFk3ku1BVbbqUNJgacuLk
MD5:	C0DAA8A86FA853A89F618826403C9F67
SHA1:	D879A807FA720965A27A96FE362D03138ED0326D
SHA-256:	CAA93CD176F63E300138842586F1F84529538A9E8CE71DE3C76D627E15F47BCC
SHA-512:	59C8F2C1F367344C733B11969D1FA607334FBF07DD14145E31726ED2E41F8A785A4551B0A95E9E7AC226FBA154AD3430D98A394242FCD17C22B6713B644D4756
Malicious:	false
URL:	https://discord.com/api/v9/experiments?with_guild_experiments=true
Preview:	{"fingerprint":"1298907770543669269.3mKIt_b3e6cjNLa98gAmbtR2lvU","assignments":[[2810205487,1,1,-1,3,3817,0,0],[2617218444,4,1,-1,2,8447,0,0],[3035674767,0,1,-1,0,1959,0,0],[1609782151,0,1,-1,2,6681,0,0],[3643362751,0,1,-1,0,4657,0,0],[3753034466,1,2,-1,0,2699,0,0],[1913882179,0,1,-1,2,5317,0,0],[1567199723,0,1,-1,1,8514,0,0],[3091068323,0,2,-1,10,7279,0,0],[454783470,4,1,-1,0,632,0,0],[3450899088,1,1,-1,0,8016,0,0],[3656796460,3,3,-1,3,8458,0,0],[2519288568,0,1,-1,4,9938,0,0],[1814483290,0,1,-1,0,1163,0,0],[4221006726,0,1,-1,0,5782,0,0],[1398673921,1,1,-1,0,8556,0,0],[2532700533,0,1,-1,0,3391,0,0],[3557480712,0,1,-1,0,7327,0,0],[853403133,4,1,-1,0,5319,0,0],[2491005019,4,1,-1,0,297,0,0],[3889077804,2,1,-1,0,8319,0,0],[4079214319,2,1,-1,0,9809,0,0],[1532280548,16,1,-1,5,3876,0,0],[1095779154,0,1,-1,4,1991,0,0],[1398007839,0,1,-1,2,3096,0,0],[1034661306,0,1,-1,0,2319,0,0],[1944696695,0,1,-1,0,2966,0,0],[828251710,2,1,-1,1,2832,0,0],[3124003316,1,1,-1,0,707,0,0],[2676348506,0,1,-1,0,8961

Chrome Cache Entry: 190

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3481)
Category:	dropped
Size (bytes):	3530
Entropy (8bit):	5.525597791927395
Encrypted:	false
SSDEEP:	48:4SloopsVL5u5CfGRxnDFzmThAlvnPE17cXfXTrI1iQhTTrUE7qp6upMNqsykTHuV:CokFVfMD04DvEbrOp6udE6ezfkjj
MD5:	BE6064FF8C1D480AFB80FE48762A06C1
SHA1:	F832A784FAEDB0BCFEE78661031D3C23C622501A
SHA-256:	3666E614B6564F13247BF5E53B0DD5C57F27ED75F397AA839F4B75BF55177203
SHA-512:	78E847E48E1A509B9E01550B10A94EA77D4D6BD9208131DD52FFAA379150660A2B7BA11750CA87173FDE4EB75A99512BC98ABDD6593D47DC1A0B8886905DF08E
Malicious:	false
Preview:	(()=>{"use strict";var r={504053:function(r,t,e){e.d(t,{F:function(){return o}}),e(518263),e(970173),e(520712),e(268111),e(941497),e(32026),e(480839),e(744285),e(492257),e(873817),e(863942),e(642549),e(653041);var n=e(788900);function o(r){let t=function(r){let{detail:t=1,pop:e=1}=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{},{PI:o,min:f,max:i,cos:u,round:a}=Math,c=r[0]\|r[1]<<8\|r[2]<<16,l=r[3]\|r[4]<<8,s=(63&c)/63,p=(c>>6&63)/31.5-1,d=(c>>12&63)/31.5-1,v=c>>23,h=l>>15,b=i(3,h?v?5:7:7&l),g=i(3,h?7&l:v?5:7),y=v?(15&r[5])/15:1,O=(r[5]>>4)/15,m=v?6:5,w=0,x=(t,e,n)=>{let o=[];for(let f=0;f<e;f++)for(let i=f?0:1;ie<t(e-f);i++)o.push(((r[m+(w>>1)]>>((1&w++)<<2)&15)/7.5-1)n);return o},j=x(b,g,(c>>18&31)/31/2),k=x(3,3,(l>>3&63)/63e),P=x(3,3,(l>>9&63)/63e),_=v?x(5,5,O):[],A=(0,n.UN)(r),C=a(A>1?32:32A),F=a(A>1?32/A:32),M=new Uint8Array(CF4),U=[],T=[];for(let r=0,e=0;r<F;r++)for(let n=0;n<C;n++,e+=4){let a=s,c=p,l=d,h=y;for(let r=0,t=i(b,v?5:3);r<t;r++)U[r]=u(o/C(n+.5)r);for(l

Chrome Cache Entry: 191

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	688
Entropy (8bit):	4.422809447424027
Encrypted:	false
SSDEEP:	12:t6AbzVKIh4zXvVg/jzDJU0uE2pLAZTX9D1jPb1qcNRxU7EK53TQke:tDbzVKwkXveLPC0uWZjR1LhFFkxhe
MD5:	C6CE0010471B65C0FAEDA6C53AB297BD
SHA1:	8735052DE92D694B4EA91CECCAB0E7E8F75A3CC7
SHA-256:	862046FEE1B4F3744F000347CC0B337871967B2BD9471BCB6DDED2A49A61C527
SHA-512:	7A054A7E19F80F7735CCDBC13E9CAFA13A779764C1725161B4EC7D3C793CFFB2E56C61109AA5F09A21E9DE3FD46B2E2EC756A6B03E46F4760125D282C14273C4
Malicious:	false
Preview:	<svg fill="none" height="12" viewBox="0 0 13 12" width="13" xmlns="http://www.w3.org/2000/svg"><path d="m5.39011.540027c.35536-.720037 1.38211-.720036 1.73747.000002l1.18359 2.398201c.14111.28593.41388.48411.72942.52996l2.64661.38457c.7946.11546 1.1119 1.09196.5369 1.65243l-1.9151 1.86674c-.2283.22257-.33252.54323-.2786.8575l.4521 2.63587c.1357.7914-.69496 1.3949-1.40567 1.0213l-2.36717-1.2445c-.28223-.1484-.6194-.1484-.90162 0l-2.36717 1.2445c-.71072.3736-1.54138-.2299-1.40565-1.0213l.45209-2.63587c.0539-.31427-.05029-.63493-.27861-.8575l-1.915083-1.86674c-.574984-.56047-.2576998-1.53697.536908-1.65243l2.646575-.38457c.31554-.04585.58831-.24403.72943-.52996z" fill="#fff"/></svg>

Chrome Cache Entry: 192

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	137
Entropy (8bit):	4.832107377824175
Encrypted:	false
SSDEEP:	3:t6WH7W+lFAATcvcmJDmJS4RKb5KVErcHrFvR8hiJqGrqL0:t6Abli/c8mc4slmrFv2hiAe
MD5:	70275FE3104CF1D3388586AD8FFD478E
SHA1:	473EA46F5B22B5C7D14C39EE9C0C82811593883B
SHA-256:	3269CF3FDA7681388472225BAD39B6BB3B26088A0A03B6CD5796195F0114CE13
SHA-512:	044C0F8F1583FAEBA3A23FF2DF821A5A0E79C548DB3A6474614894DA2CB125476227407F865CF20D32DC7E4D9ADE09EBA6317EFB787EEED2570C0EBDFC401D2A
Malicious:	false
URL:	https://discord.com/assets/af5116b1db004acbdb8b.svg
Preview:	<svg fill="none" height="8" viewBox="0 0 9 8" width="9" xmlns="http://www.w3.org/2000/svg"><path d="m4.5 0 4.5 8h-9z" fill="#fff"/></svg>

Chrome Cache Entry: 193

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	109613
Entropy (8bit):	5.4029332021931715
Encrypted:	false
SSDEEP:	1536:fCBKa1oPP8sGolumyOSsN5VYpLUBDL2QPidmHTRWisxpLAkF+d10J:qB9C81a5YpL5kl9sxpTa10J
MD5:	80F500D4D0495E5C74E9B92CBC26F088
SHA1:	A2C3F68D87AD8F793935FA7B8D05A0A2D635C4E0
SHA-256:	407002AD3FD8CF26EF02A802DD0D4DB7BFF395D8C22F5F8580CA6CE65A797238
SHA-512:	500C40BF257E7F4098B3B64CEDD49D8612FAF8B254CF496019C5B579C784A416F466C6BAC174B5317A663071E736C2DF82D22E6A7F88AF664BC421A974ABDF59
Malicious:	false
Preview:	(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["63288"],{473452:function(e,t){"use strict";t.Z=function(e){for(var t,n=e.length,o=n^n,r=0;n>=4;)t=(65535&(t=255&e.charCodeAt(r)\|(255&e.charCodeAt(++r))<<8\|(255&e.charCodeAt(++r))<<16\|(255&e.charCodeAt(++r))<<24))1540483477+(((t>>>16)1540483477&65535)<<16),t^=t>>>24,o=(65535&o)1540483477+(((o>>>16)1540483477&65535)<<16)^(t=(65535&t)1540483477+(((t>>>16)1540483477&65535)<<16)),n-=4,++r;switch(n){case 3:o^=(255&e.charCodeAt(r+2))<<16;case 2:o^=(255&e.charCodeAt(r+1))<<8;case 1:o^=255&e.charCodeAt(r),o=(65535&o)1540483477+(((o>>>16)1540483477&65535)<<16)}return o^=o>>>13,o=(65535&o)1540483477+(((o>>>16)1540483477&65535)<<16),((o^=o>>>15)>>>0).toString(36)}},230371:function(e,t){"use strict";t.Z=function(e){var t={};return function(n){return void 0===t[n]&&(t[n]=e(n)),t[n]}}},184826:function(e,t){"use strict";t.Z=function(e){function t(e,t,o){var r=t.trim().split(h);t=r;var i=r.length,a=e.length;switch(a){case

Chrome Cache Entry: 194

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (905)
Category:	downloaded
Size (bytes):	957
Entropy (8bit):	5.034768569958886
Encrypted:	false
SSDEEP:	12:Bw1JU1t21f1C1bA19RAHxrV1e7Co1RSg341Nzg5mBU9K9K/sSelw1NeVE:BgJ0t2DKeAtG1Es4Fg57Xeis+
MD5:	20DDAA519E404695D0657D3868D2701F
SHA1:	0BDF7AD9C1F272B72FD83741504A39D5E8097901
SHA-256:	808A1D58F797547FE5A8ACDC841C6CA36E7440E1DCFFF9CB40497CAE9ED11143
SHA-512:	3D556D1EA31E803BB1E4EE11F68DAFC2FD0121E1A0E7EBE0BEDD1AFDFD646B05357842C825FFA0909492BA7FA00530C8B79BCD7A3778CF5B663194DF6D3BC227
Malicious:	false
URL:	https://discord.com/assets/2917679ca8a08c390036.css
Preview:	.wrapper_cd22e7,.activeWrapper_cd22e7{height:100%;left:0;position:absolute;top:0;width:100%;z-index:1002}.wrapper_cd22e7{pointer-events:none}.videoWrapper_cd22e7{position:absolute;transform:translate(-50%,-50%);top:50%;left:50%;z-index:200;pointer-events:none;width:auto;height:100%}@media(min-aspect-ratio:2880/2048){.videoWrapper_cd22e7{width:100%;height:auto}}.videoWrapperForHelper_cd22e7{position:absolute;pointer-events:none;z-index:200;top:0;left:0;width:100%;height:100%}.gadientHighlight_cd22e7{position:absolute;width:100%;height:100%;pointer-events:none;background-image:linear-gradient(90deg,var(--premium-tier-2-purple-for-gradients)0%,var(--premium-tier-2-purple-for-gradients-2)50%,var(--premium-tier-2-pink-for-gradients)100%)}.swipeWrapper_cd22e7{position:absolute;width:100%;height:100%;pointer-events:none}.swipe_cd22e7{position:absolute;height:100%;opacity:.1;width:auto;right:0;top:0}./# sourceMappingURL=2917679ca8a08c390036.css.map/

Chrome Cache Entry: 195

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3481)
Category:	downloaded
Size (bytes):	3530
Entropy (8bit):	5.525597791927395
Encrypted:	false
SSDEEP:	48:4SloopsVL5u5CfGRxnDFzmThAlvnPE17cXfXTrI1iQhTTrUE7qp6upMNqsykTHuV:CokFVfMD04DvEbrOp6udE6ezfkjj
MD5:	BE6064FF8C1D480AFB80FE48762A06C1
SHA1:	F832A784FAEDB0BCFEE78661031D3C23C622501A
SHA-256:	3666E614B6564F13247BF5E53B0DD5C57F27ED75F397AA839F4B75BF55177203
SHA-512:	78E847E48E1A509B9E01550B10A94EA77D4D6BD9208131DD52FFAA379150660A2B7BA11750CA87173FDE4EB75A99512BC98ABDD6593D47DC1A0B8886905DF08E
Malicious:	false
URL:	https://discord.com/assets/ac625b77a0bab0ee72df.js
Preview:	(()=>{"use strict";var r={504053:function(r,t,e){e.d(t,{F:function(){return o}}),e(518263),e(970173),e(520712),e(268111),e(941497),e(32026),e(480839),e(744285),e(492257),e(873817),e(863942),e(642549),e(653041);var n=e(788900);function o(r){let t=function(r){let{detail:t=1,pop:e=1}=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{},{PI:o,min:f,max:i,cos:u,round:a}=Math,c=r[0]\|r[1]<<8\|r[2]<<16,l=r[3]\|r[4]<<8,s=(63&c)/63,p=(c>>6&63)/31.5-1,d=(c>>12&63)/31.5-1,v=c>>23,h=l>>15,b=i(3,h?v?5:7:7&l),g=i(3,h?7&l:v?5:7),y=v?(15&r[5])/15:1,O=(r[5]>>4)/15,m=v?6:5,w=0,x=(t,e,n)=>{let o=[];for(let f=0;f<e;f++)for(let i=f?0:1;ie<t(e-f);i++)o.push(((r[m+(w>>1)]>>((1&w++)<<2)&15)/7.5-1)n);return o},j=x(b,g,(c>>18&31)/31/2),k=x(3,3,(l>>3&63)/63e),P=x(3,3,(l>>9&63)/63e),_=v?x(5,5,O):[],A=(0,n.UN)(r),C=a(A>1?32:32A),F=a(A>1?32/A:32),M=new Uint8Array(CF4),U=[],T=[];for(let r=0,e=0;r<F;r++)for(let n=0;n<C;n++,e+=4){let a=s,c=p,l=d,h=y;for(let r=0,t=i(b,v?5:3);r<t;r++)U[r]=u(o/C(n+.5)r);for(l

Chrome Cache Entry: 196

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17413)
Category:	downloaded
Size (bytes):	17462
Entropy (8bit):	5.594711522541062
Encrypted:	false
SSDEEP:	384:iwLnWOUnUuyMNps0HHHsglNzUxBAAdTRIZWiv/XB2kZYP:BLQne0P5UxMXB2kSP
MD5:	3B98C1EF9293D482A5099FDB6984946F
SHA1:	6FEFA9D8FF6B2DB16B5EC2ED5922DA0AE6187448
SHA-256:	A76F75BF6294EEA278F82522810ACBC3BCFA9290006F57746AD79BCA3615AD66
SHA-512:	CE9915807ADC42ECAF18D254091B31BD65CE9A29AF38820ACCC2A5D38BC8AA329471AE1E7F404B6F8D0F85CC643B3616863A70D0E3EA1B8C569AC64A5E889C54
Malicious:	false
URL:	https://discord.com/assets/1f7f046253c197b5a419.js
Preview:	(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["15812"],{884835:function(t,e,r){"use strict";var o=r(311596);function n(){}function i(){}i.resetWarningCache=n,t.exports=function(){function t(t,e,r,n,i,a){if(a!==o){var u=Error("Calling PropTypes validators directly is not supported by the `prop-types` package. Use PropTypes.checkPropTypes() to call them. Read more at http://fb.me/use-check-prop-types");throw u.name="Invariant Violation",u}}function e(){return t}t.isRequired=t;var r={array:t,bigint:t,bool:t,func:t,number:t,object:t,string:t,symbol:t,any:t,arrayOf:e,element:t,elementType:t,instanceOf:e,node:t,objectOf:e,oneOf:e,oneOfType:e,shape:e,exact:e,checkPropTypes:i,resetWarningCache:n};return r.PropTypes=r,r}},639519:function(t,e,r){t.exports=r(884835)()},311596:function(t){"use strict";t.exports="SECRET_DO_NOT_PASS_THIS_OR_YOU_WILL_BE_FIRED"},58615:function(t,e,r){var o=r(338091);function n(t){this.mode=o.MODE_8BIT_BYTE,this.data=t}n.prototype={getLength:fu

Chrome Cache Entry: 197

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18134)
Category:	downloaded
Size (bytes):	18183
Entropy (8bit):	5.745446950417671
Encrypted:	false
SSDEEP:	384:M7+ek/HNfVFGOSH4vgk+l/HyHOC7CmA5h4m4C2xYtL5c299H0KkBijYpthjDh2P1:g+ek/7VwEgkK/SuC7Cx5G1C2xYtL5c2R
MD5:	CB2E31554EC3CE69856DD70C281A6DB7
SHA1:	53524C140D3B966DFA9ADAF06A1AD062CC5FB9E1
SHA-256:	A4E79A1E245BDE12C9A8FE50342E450213CB0F3002D0453DE8FDEDE75630F2D2
SHA-512:	FB5D9629793FA3A432D955AE2193504445464719C92B7281612DC83912FCF1150A07F2BEDEDADFB102D8FC0D54980B769C933D4D99DEDAD0AFC14E3065ABE6FC
Malicious:	false
URL:	https://discord.com/assets/36e086bbcea2eace814d.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["10778"],{418757:function(e){e.exports="/assets/b7d1dc6b0746101719c5.png"},494207:function(e){e.exports="/assets/85153fe71873da0f5802.svg"},320440:function(e){e.exports="/assets/4676f063fb9f129e9fdb.svg"},561030:function(e){e.exports="/assets/75c80c4160a66983ae66.svg"},419185:function(e){e.exports="/assets/47e72e6360ce185adab6.svg"},826806:function(e){e.exports="/assets/fb418059f41b569abca4.svg"},123013:function(e){e.exports="/assets/98cacc492d985565ed4f.png"},540909:function(e){e.exports="/assets/2a5176cf2bd0ccdf0e7b.svg"},232454:function(e){e.exports="/assets/ad2027f11792ba8c0e7f.svg"},526916:function(e){e.exports="/assets/f38b6aefa24dc9a54765.svg"},29654:function(e){e.exports="/assets/dde11474b0623b723861.svg"},820160:function(e,s,a){a.d(s,{Z:function(){return L}});var E=a(200651);a(192379);var _=a(481060),t=a(813197),n=a(689938),r=a(510186);function L(e){let{icon:s,onChange:a}=e;return(0,E.jsx)(_.Fo

Chrome Cache Entry: 198

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	688
Entropy (8bit):	4.422809447424027
Encrypted:	false
SSDEEP:	12:t6AbzVKIh4zXvVg/jzDJU0uE2pLAZTX9D1jPb1qcNRxU7EK53TQke:tDbzVKwkXveLPC0uWZjR1LhFFkxhe
MD5:	C6CE0010471B65C0FAEDA6C53AB297BD
SHA1:	8735052DE92D694B4EA91CECCAB0E7E8F75A3CC7
SHA-256:	862046FEE1B4F3744F000347CC0B337871967B2BD9471BCB6DDED2A49A61C527
SHA-512:	7A054A7E19F80F7735CCDBC13E9CAFA13A779764C1725161B4EC7D3C793CFFB2E56C61109AA5F09A21E9DE3FD46B2E2EC756A6B03E46F4760125D282C14273C4
Malicious:	false
URL:	https://discord.com/assets/9017b7062734e72bb476.svg
Preview:	<svg fill="none" height="12" viewBox="0 0 13 12" width="13" xmlns="http://www.w3.org/2000/svg"><path d="m5.39011.540027c.35536-.720037 1.38211-.720036 1.73747.000002l1.18359 2.398201c.14111.28593.41388.48411.72942.52996l2.64661.38457c.7946.11546 1.1119 1.09196.5369 1.65243l-1.9151 1.86674c-.2283.22257-.33252.54323-.2786.8575l.4521 2.63587c.1357.7914-.69496 1.3949-1.40567 1.0213l-2.36717-1.2445c-.28223-.1484-.6194-.1484-.90162 0l-2.36717 1.2445c-.71072.3736-1.54138-.2299-1.40565-1.0213l.45209-2.63587c.0539-.31427-.05029-.63493-.27861-.8575l-1.915083-1.86674c-.574984-.56047-.2576998-1.53697.536908-1.65243l2.646575-.38457c.31554-.04585.58831-.24403.72943-.52996z" fill="#fff"/></svg>

Chrome Cache Entry: 199

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 139388, version 2.459
Category:	downloaded
Size (bytes):	139388
Entropy (8bit):	7.99804629870967
Encrypted:	true
SSDEEP:	3072:Q69dyqPSD49z56qcFxDiYZHYj3pU5qJvdzqC3dZIwv82phTFsZ:yUSD49d6TDiYZ8pU4Jvlnd42vmZ
MD5:	DB985AAA3C64F10506D96D876E350D47
SHA1:	AAD4A93575E59643FED7617E2FEB893DD763D801
SHA-256:	234FEB9A8A2C759D00A4959506A3B9CB94C772186A2D117AED973347C7EF1891
SHA-512:	300D0D35EBB9E27D66489FFB3E5502A4DCD3AF032FB0F672D4F004E3846FB795772B6938C99DAFED6FAD0C25DA8412D6F6A7B0221EB2540E84527703DB5B7073
Malicious:	false
URL:	https://discord.com/assets/452d7be36bf4b23241bd.woff2
Preview:	wOF2...... \|......9... ...........................f...v....`...........e.6.$..T..X.. ..\|...[..[.B...c.{....:.w..T.l...C.T+...G.......F.\s...m..J.n`....y..6.<.................c......#............m..n...u..#$H..+....1).oq.l.@...U...#TpP...C..Xk.`.k.....(!...1k0....2f.W^.&hw.hF&h...v.[dA..Y./.6....zC..3._d.....r@...n.$...,.F.6X......SG....x...N.+..6.a%.].V}.u.(P..w.pK..%?.o......b.So1.....M.5.2........).`.N...D.fwTz..a.A. ...).=.\Y..Z.')+.../....0{..8..26u.;<a.......<...=.....eq;kD....Y..I^..`.R..n...T=.R..T.Jl.W..p..].....5.(y#....P.G.N........$Iv.....~....ns...J....TuY!o..jz...P5\|@..H.Tu.P.b!T..r7..,<.u.O....?......J.9...........r....~..f..U`...Y..\|....;..K>cl.....`_.+..l....f>.s.#w...36...[...9rI..t@.....b7.s..F....<..x.zT.t.5...8..?..j9k.'-.)u.[..w..>1I.....2.w.;..3.\?.,...b!.B$Qh.......A....?#...O.....5~W.h..HD.....V..d.O..\x1.rLV..U.4~...k.m.U...{6mg...q.ldfc...d..>[.i............<.".w^....4...XJ.n.xm..D.......M....XE.@.....GL...

Chrome Cache Entry: 200

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (23014)
Category:	downloaded
Size (bytes):	41018
Entropy (8bit):	5.288611763514835
Encrypted:	false
SSDEEP:	768:AwNvVNMV9ptcE+wCFgFLWcE+wCFgFLjONOT/cEA6KAOD54Dow93Tz:bAVeE++E+GONOzcEsYnjz
MD5:	FBEC530F567CB32C81348642102C8348
SHA1:	8D1BD68302D72651A78FD252EE52552D4B7E3364
SHA-256:	24055C6A77C3CDB43FCBB15A9F48F622042F3E8052F177916E3325BCDC85D1F3
SHA-512:	CEF10273CCDECDC4A389724FD4499371595F79601B51AD8CFE14D333E393E5E67373A97D3EDAE722868A7E68A70A6A22FF764AEE40D3CAC21F8CFFC1A231A11F
Malicious:	false
URL:	https://discord.com/assets/591980d24607547de30a.css
Preview:	.discordLogo_b83a05{height:36px;width:112px;background:url(/assets/23a7a3fd6624342117bf.svg)no-repeat;display:none;flex-shrink:0;margin-bottom:16px}.authBox_b83a05{width:480px;padding:var(--custom-auth-box-auth-box-padding);font-size:18px;box-shadow:var(--legacy-elevation-high);border-radius:5px;box-sizing:border-box;color:var(--text-muted)}.authBox_b83a05 a{color:var(--text-link)}.authBox_b83a05 a:hover{-webkit-text-decoration:underline;text-decoration:underline}.authBoxExpanded_b83a05{width:784px}.centeringWrapper_b83a05{width:100%;text-align:center}.avatar_b83a05{margin-bottom:24px}@media(max-width:485px){.authBox_b83a05{position:absolute;top:0;right:0;bottom:0;left:0;padding:20px 16px;width:100%;height:100%;display:flex;align-items:center;flex-direction:column;background:linear-gradient(to left bottom,#3d4046,#1e1e23);border-radius:0;overflow:scroll}.authBox_b83a05 .discordLogo_b83a05{display:block}@media(max-width:830px){.authBox_b83a05.authBoxExpanded_b83a05{max-width:none}}.auth

Chrome Cache Entry: 201

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	24
Entropy (8bit):	4.022055208874201
Encrypted:	false
SSDEEP:	3:PaniAKp18n:SnT
MD5:	5DFB17ADA137F27939246A24FD5F7CE1
SHA1:	6748CBADBAAA9216F6FC0C3C3B5F7CA786F3C8BA
SHA-256:	E7E1364442A162805292D9693D57C84E66D37E27849E1EDC4C31A3436DEDF238
SHA-512:	70A38493813CA097B394743E6ED33B2574079F500E5D9C911A8EC251E39C5BA47EC41214EE47B21BEF4D4392B2F3D507717282C2AE073A05FEC74542A2460F5D
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAnjkqJiyOoN-BIFDfwdehA=?alt=proto
Preview:	Cg4KDA38HXoQGgUIoAEYAg==

Chrome Cache Entry: 202

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	4246
Entropy (8bit):	4.103696787604314
Encrypted:	false
SSDEEP:	96:K9F4GfkbfNyN48/E8jfsrKk1Z/eO4oSgT3I/VcbQokvBD:KnqbfQ48/BfsrKYZ/eOBe9FJD
MD5:	DDA77F765068E4450D3545A40B777663
SHA1:	63AE45EF489734D09D3AEA98E016C0DD1BC733F9
SHA-256:	A644A9364BE96AD0A72F8E24397322B4D0646563A11E8FF76191A9239A561AC9
SHA-512:	D88521109D4AC8EA200F644973A7A554C1A6B8E0AE4658C7F0E3FAFBEE40A1CB8A6A75BECB2A49AE3B8D226BEE36CD8CA63B492FABC2BF034D6A295349567946
Malicious:	false
URL:	https://discord.com/assets/0e5029fd9cd4812b6712.svg
Preview:	<svg width="124" height="24" viewBox="0 0 124 24" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#a)"><g clip-path="url(#b)" fill="#fff"><path d="M26.242 2.01A25.218 25.218 0 0 0 19.851 0a18.718 18.718 0 0 0-.819 1.701 23.45 23.45 0 0 0-7.083 0A18.2 18.2 0 0 0 11.121 0a25.13 25.13 0 0 0-6.396 2.015C.68 8.132-.417 14.097.132 19.978c2.682 2.005 5.282 3.223 7.838 4.02A19.514 19.514 0 0 0 9.65 21.23a16.507 16.507 0 0 1-2.644-1.287c.222-.165.439-.337.648-.513 5.098 2.386 10.636 2.386 15.673 0 .211.177.428.348.648.513-.839.505-1.726.939-2.649 1.29A19.432 19.432 0 0 0 23.004 24c2.558-.797 5.16-2.015 7.843-4.022.643-6.817-1.099-12.728-4.605-17.968ZM10.343 16.361c-1.53 0-2.785-1.43-2.785-3.17 0-1.741 1.228-3.174 2.785-3.174 1.557 0 2.812 1.43 2.785 3.174.003 1.74-1.228 3.17-2.785 3.17Zm10.293 0c-1.53 0-2.786-1.43-2.786-3.17 0-1.741 1.228-3.174 2.785-3.174 1.557 0 2.812 1.43 2.785 3.174 0 1.74-1.228 3.17-2.785 3.17ZM41.629 6.122h6.652c1.603 0 2.958.257 4.069.767 1.109.51 1.94 1

Chrome Cache Entry: 203

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17745)
Category:	downloaded
Size (bytes):	17794
Entropy (8bit):	5.473881721264957
Encrypted:	false
SSDEEP:	384:ynp0/xKyAhCrap7NrDNZAQJhGzsqX1VXn0Fmc1YNsEPoVUA7:ynpGyfplzJisajM
MD5:	8F5BEB794777EAC4C63978CD0EF850F4
SHA1:	1E1FC58F2A253F63B96801836B6E626898319D4C
SHA-256:	81614ED290684BA635701BA13C3D61377AE1D96E0A8F32FD424879AF56010044
SHA-512:	318626E5ECD021D3B8CC096AE0EA866D62A1CCA883643BD7813490AE7C87CD7D55114CE2FFD6D46F7688DC467A4A4BDB389EE9AF6688EFE0FD1A5FC205613E14
Malicious:	false
URL:	https://discord.com/assets/ea8b2ed5e609f40e7f7b.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["11260"],{26230:function(e){e.exports="/assets/afd44ae05126b5fab40d.svg"},935227:function(e){e.exports="/assets/50b96601171fd361101c.svg"},479495:function(e,t,s){s(757143);var n,r=s(200651),i=s(192379),a=s(120356),o=s.n(a),l=s(593473),c=s(873546),u=s(442837),d=s(570140),h=s(893776),p=s(129293),m=s(388905),f=s(17894),C=s(124860),g=s(108427),x=s(314897),N=s(585483),v=s(981631),E=s(689938),S=s(113207);function A(e,t,s){return t in e?Object.defineProperty(e,t,{value:s,enumerable:!0,configurable:!0,writable:!0}):e[t]=s,e}u.ZP.initialize();class j extends(n=i.PureComponent){componentDidMount(){(0,g.e)("reset_password")}renderPasswordReset(){let{password:e,error:t,hasCancel:n}=this.state,i=this.isSubmitting(),a=null!=t?t:this.renderError("password");return(0,r.jsxs)(m.ZP,{onSubmit:this.handleSubmit,tag:"form",children:[(0,r.jsx)("img",{alt:"",src:null==a?s(26230):s(935227),className:S.marginBottom20}),(0,r.jsx

Chrome Cache Entry: 204

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.921485085907038
Encrypted:	false
SSDEEP:	3:t6WH7W+ZacvTnARcLnkDmJS4RKb5KVErcHYWNTWi7eLFOyTIXGUNfHFQJJqGrqL0:t6AbZ/Ikn4mc4slmYWBWzLRI2ylQJAe
MD5:	B1D4C5E276E3AAA8EC41E6014DD572B2
SHA1:	B5B63A8B35223277D75C79B2AABD8221FDA383EB
SHA-256:	7CF5996F7AB483BD985B3DE5BFBCF50A2B22A7B473E8011E5C993D9830AF9D12
SHA-512:	8E4C954D96FBDA407E87FA65859FE758FC83F2DA0C6D7C07824926BFB0BCDF4F40DE057C5DD1D7EE0890C5287D2ED2EC8FDEFBDF317B46FE222339894E0A559B
Malicious:	false
Preview:	<svg fill="none" height="9" viewBox="0 0 6 9" width="6" xmlns="http://www.w3.org/2000/svg"><path d="m0 2.83912v3.32176l3 2.83912 3-2.83912v-3.32176l-3-2.83912z" fill="#fff"/></svg>

Chrome Cache Entry: 205

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8139), with no line terminators
Category:	downloaded
Size (bytes):	8139
Entropy (8bit):	5.770847531810929
Encrypted:	false
SSDEEP:	192:xr4W6VJS7uTxJvVnNosydMEnNb+wZHf2e16Xma8eIrD9DYTDS:xr7K9wsydMEnNbLdfL16XErDVb
MD5:	A19C174FE2783628C7D534196144481A
SHA1:	D196C6C0C4139F5A734AEEA3CF62A5EF5BFCE9CF
SHA-256:	649F686F77E658CF7C0F2700348CF3CFB4A3FFCDD3D9D62CCF045D7A56892A54
SHA-512:	B1EDCF5F1228F8260F859803D97B5A2838B28405F268BCCD74784E8E64006C11496712FC4FC0C5D3E3FC46FC1CD98C0C3A18CF6EA453D0293442205C45762F6C
Malicious:	false
URL:	https://discord.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js?
Preview:	window._cf_chl_opt={cFPWv:'g'};~function(V,h,i,j,k,l,s,v){V=b,function(c,e,U,f,g){for(U=b,f=c();!![];)try{if(g=-parseInt(U(486))/1+-parseInt(U(441))/2(-parseInt(U(394))/3)+-parseInt(U(388))/4(parseInt(U(422))/5)+parseInt(U(469))/6(parseInt(U(406))/7)+parseInt(U(384))/8(parseInt(U(407))/9)+parseInt(U(465))/10+-parseInt(U(452))/11*(parseInt(U(451))/12),g===e)break;else f.push(f.shift())}catch(D){f.push(f.shift())}}(a,214041),h=this\|\|self,i=h[V(397)],j=function(W,e,f,g){return W=V,e=String[W(414)],f={'h':function(D){return null==D?'':f.g(D,6,function(E,X){return X=b,X(425)[X(459)](E)})},'g':function(D,E,F,Y,G,H,I,J,K,L,M,N,O,P,Q,R,S,T){if(Y=W,D==null)return'';for(H={},I={},J='',K=2,L=3,M=2,N=[],O=0,P=0,Q=0;Q<D[Y(399)];Q+=1)if(R=D[Y(459)](Q),Object[Y(396)][Y(483)][Y(478)](H,R)\|\|(H[R]=L++,I[R]=!0),S=J+R,Object[Y(396)][Y(483)][Y(478)](H,S))J=S;else{if(Object[Y(396)][Y(483)][Y(478)](I,J)){if(256>J[Y(494)](0)){for(G=0;G<M;O<<=1,P==E-1?(P=0,N[Y(484)](F(O)),O=0):P++,G++);for(T=J[Y(494)](0),G

Chrome Cache Entry: 206

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 960x540, components 3
Category:	dropped
Size (bytes):	33094
Entropy (8bit):	7.662961138741444
Encrypted:	false
SSDEEP:	384:lgO9OMfES6EqMU9mmYJIbvXWQGA7DC5QC1QP9HfPt6r5esdEiExCbli1zqlYlBaJ:lJU5zGQswlE1TEx8kzqloBYA8R
MD5:	7E3C950F6514CEAEC263944BB6149A6B
SHA1:	D60A06B2724156F2C808648E8B5D8D543D93B084
SHA-256:	2CFA6F333D5A195FDFC244B2F3FBEDBAC858071EEC196BCA300808BAC20BF273
SHA-512:	AF8A05BDB2900D7D06D782309340941C4A0C6623F60F672AD4342A474F17CC76A987584D7EEB8D64D8960D6126A7A9FDB3E847D70DE8BD06C6BBAC24F6851D77
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..Z(...(...E...ZE....Z(...(...O.?AKI.G.(.h...(...).U..........(...(..o.~....O...(...(...(..^....^......(...(...#.....~....(...(...._.-!.ZZ.(...(...F...KH.t.)h...(...(..^....^......(...(...#.....~....(...(...._.-!.Z.Z(...(...F...KH.t.(.h...(...(...E...ZE...Z.(...(...O.?AKI.G.)h...(...(..U..........(...(..o.~....O...(...(...E...ZE....Z(...(...O.?AKI.G.(.h...(...).U.........

Chrome Cache Entry: 207

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.710597482771287
Encrypted:	false
SSDEEP:	3:t6WH7W+lFAATcvdnmFFSDDmJS4RKb5KGMXf/FGc8qQAGrqLW:t6Abli/m03mc4sldMX9QAw
MD5:	72A8B168AD2C7EEA7B2559B5690C7695
SHA1:	85E4F43154EA713C832BA27128A33EB7B2A7CF7A
SHA-256:	1F988D1AD4AB163D61A584254C07D75F3241EB6380BF48BF7D8F981E13C092CD
SHA-512:	11BCB1A3623B97C9DD2F22D0389B3CA05AB4F99596DE5D07C50C1FC83F7532D8C20B58379C54C38F503D86D8C2CAF52AF3B35FFCCDC4750089ABAF86C1C5294E
Malicious:	false
Preview:	<svg fill="none" height="8" viewBox="0 0 8 8" width="8" xmlns="http://www.w3.org/2000/svg"><circle cx="4" cy="4" r="4" fill="#fff"/></svg>.

Chrome Cache Entry: 208

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4804
Entropy (8bit):	3.9838661314243433
Encrypted:	false
SSDEEP:	96:Ez1Y5tmUKv0bhb9lsqYnlV4XdUo4e7JR0Tn515GGNj1j:eWtRK8Z4qYnlV4Xdt6RGaj1j
MD5:	22FD790491653D837422D80E3500CF92
SHA1:	E0618307DDC1E06D85729819B115D0652ABB148C
SHA-256:	641B1091276BA75578C3D93F367F0D70BCBBA7C62A7F159C4307ACF0ED6C5CBE
SHA-512:	AD2100B9391969B160D3DE80C7310CF5706B89CD097D8B48D6DF0D96E9CFB73C15DDD487DF7773C28094A152EC9D4F8F6E6B718C96FAF734708018C65511266E
Malicious:	false
Preview:	<svg fill="none" height="36" viewBox="0 0 130 36" width="130" xmlns="http://www.w3.org/2000/svg"><g fill="#fff"><path d="m27.5247 8.06243c-2.1034-.96349-4.3524-1.66374-6.7036-2.06243-.2888.51114-.6261 1.19861-.8587 1.74553-2.4995-.36802-4.9759-.36802-7.4293 0-.2326-.54692-.5777-1.23439-.869-1.74553-2.35376.39869-4.60533 1.1015-6.70864 2.06754-4.242451 6.27676-5.392506 12.39766-4.817478 18.43156 2.813808 2.0574 5.540698 3.3071 8.221628 4.1249.6619-.892 1.25228-1.8401 1.76089-2.8394-.96862-.3603-1.89634-.805-2.77294-1.3213.23259-.1686.46001-.345.67979-.5265 5.34655 2.4484 11.15555 2.4484 16.43815 0 .2224.1815.4498.3579.6798.5265-.8791.5188-1.8094.9635-2.778 1.3239.5086.9967 1.0964 1.9474 1.7609 2.8393 2.6834-.8178 5.4129-2.0675 8.2267-4.1274.6747-6.9949-1.1526-13.0595-4.8302-18.43667zm-16.6759 14.72587c-1.6049 0-2.92111-1.467-2.92111-3.2534s1.28807-3.2559 2.92111-3.2559c1.6331 0 2.9493 1.4669 2.9212 3.2559.0025 1.7864-1.2881 3.2534-2.9212 3.2534zm10.7952 0c-1.6049 0-2.9211-1.467-2.9211-3

Chrome Cache Entry: 209

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (970)
Category:	dropped
Size (bytes):	1019
Entropy (8bit):	5.481455450518707
Encrypted:	false
SSDEEP:	24:wkU14HIuIuISm+mm7VOhR1RYIbTOZF7B7v/SlCxKqWeeUu5m:wkTH/bIm7VObfqZFN7vqYxKfv5m
MD5:	5489024A0568CEB2CCC181B8BA420A0F
SHA1:	121F6E3A6DE26A8DCF7A967C442A8509BC196CDC
SHA-256:	34048A4F2D6B0861798B4D37954DAC09E8071EBB63C8E9B6D8ADF20BE95BFF82
SHA-512:	1C9B0EEF72C329B62D8DBAD87C9BCD78E65C11EFC5075C8EE8120A62F803E0F97B78E9E481373DC88908B00B8D9A9675CA81038EFE05E65BF9E9F3247A8F8D15
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["89273"],{361207:function(n,t,i){i.d(t,{DW:function(){return d},t3:function(){return f},w4:function(){return r}});var u=i(525654),e=i.n(u);i(271579),i(314897);var o=i(981631);let c="linux";function r(n){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1],i=arguments.length>2?arguments[2]:void 0;return"".concat(o.fzT.DESKTOP).concat(t?"/ptb":"","?platform=").concat(n).concat(null!=i?"&format=".concat(i):"")}function a(){var n;let t=arguments.length>0&&void 0!==arguments[0]?arguments[0]:null===(n=e().os)\|\|void 0===n?void 0:n.family;return null==t?"win":-1!==t.indexOf("Ubuntu")\|\|-1!==t.indexOf("Debian")\|\|-1!==t.indexOf("Fedora")\|\|-1!==t.indexOf("Red Hat")\|\|-1!==t.indexOf("SuSE")\|\|-1!==t.indexOf("Linux")?c:-1!==t.indexOf("OS X")?"osx":"win"}function d(n){return({win:"Windows",osx:"Mac",[c]:"Linux"})[a(n)]}function f(){let n=a();return r(n,!1,n===c?"tar.gz":null)}}}]);.//# sourceMappingURL=b8160243

Chrome Cache Entry: 210

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8712)
Category:	dropped
Size (bytes):	8761
Entropy (8bit):	5.595354119822134
Encrypted:	false
SSDEEP:	96:7YoXmoXiURhBU9QCy4WqAVMF+FW91nuFua4MDeTVPpz6jid6ftysD9g9u6EPaLil:7YoXmoXE9xUFEuTKt2lyLkTp/os
MD5:	102FE4FDEC4447C9891C9F3FAEAE0474
SHA1:	3FA3BAF1DCED3A39DF8599BEEFA5180B436A782C
SHA-256:	E45508538EE1AB34F520303F7D1A9A7F5CB5D99FF34CE7E5EB64EB32EF6F19F9
SHA-512:	97942EEC44A5F613A45A514E355F26EC3B2458BA497009D4D70D88FF3562C94212DFB424AF0CE37BE880F3528446B28BBAB6F77C2717F0C16BF1317AFBC030D4
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["18543"],{725436:function(e,t,n){n.d(t,{m:function(){return u}});var s=n(454585),a=n(551452),l=n(532901);let r={...s.Z.guildEventRules.link,react:(0,l.Z)({enableBuildOverrides:!1,mustConfirmExternalLink:!0}).react},i={...s.Z.guildEventRules.channelMention,react:(0,a.Z)({enableBuildOverrides:!1,shouldCloseDefaultModals:!0,shouldStopPropagation:!0}).react},u=s.Z.reactParserFor({...s.Z.guildEventRules,link:r,channelMention:i})},315416:function(e,t,n){n.d(t,{Z:function(){return i}});var s=n(192379),a=n(442837),l=n(897285),r=n(924301);function i(e,t,n){let i=(0,a.e7)([r.ZP],()=>r.ZP.getUserCount(t,n));return(0,s.useEffect)(()=>{null!=e&&null!=t&&l.Z.getGuildEventUserCounts(e,t,null!=n?[n]:[])},[t,e,n]),i}},405613:function(e,t,n){n.d(t,{Z:function(){return l}});var s=n(134432),a=n(981631);function l(e,t){let n;if(null==e.image)return null;null==t&&(t=window.screen.width*(0,s.x_)()),t=(0,s.oO)(t);let l=window.

Chrome Cache Entry: 211

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17745)
Category:	dropped
Size (bytes):	17794
Entropy (8bit):	5.473881721264957
Encrypted:	false
SSDEEP:	384:ynp0/xKyAhCrap7NrDNZAQJhGzsqX1VXn0Fmc1YNsEPoVUA7:ynpGyfplzJisajM
MD5:	8F5BEB794777EAC4C63978CD0EF850F4
SHA1:	1E1FC58F2A253F63B96801836B6E626898319D4C
SHA-256:	81614ED290684BA635701BA13C3D61377AE1D96E0A8F32FD424879AF56010044
SHA-512:	318626E5ECD021D3B8CC096AE0EA866D62A1CCA883643BD7813490AE7C87CD7D55114CE2FFD6D46F7688DC467A4A4BDB389EE9AF6688EFE0FD1A5FC205613E14
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["11260"],{26230:function(e){e.exports="/assets/afd44ae05126b5fab40d.svg"},935227:function(e){e.exports="/assets/50b96601171fd361101c.svg"},479495:function(e,t,s){s(757143);var n,r=s(200651),i=s(192379),a=s(120356),o=s.n(a),l=s(593473),c=s(873546),u=s(442837),d=s(570140),h=s(893776),p=s(129293),m=s(388905),f=s(17894),C=s(124860),g=s(108427),x=s(314897),N=s(585483),v=s(981631),E=s(689938),S=s(113207);function A(e,t,s){return t in e?Object.defineProperty(e,t,{value:s,enumerable:!0,configurable:!0,writable:!0}):e[t]=s,e}u.ZP.initialize();class j extends(n=i.PureComponent){componentDidMount(){(0,g.e)("reset_password")}renderPasswordReset(){let{password:e,error:t,hasCancel:n}=this.state,i=this.isSubmitting(),a=null!=t?t:this.renderError("password");return(0,r.jsxs)(m.ZP,{onSubmit:this.handleSubmit,tag:"form",children:[(0,r.jsx)("img",{alt:"",src:null==a?s(26230):s(935227),className:S.marginBottom20}),(0,r.jsx

Chrome Cache Entry: 212

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 39764, version 2.66
Category:	downloaded
Size (bytes):	39764
Entropy (8bit):	7.993646621116526
Encrypted:	true
SSDEEP:	768:90TMDBOLlFMKbQDweRs+mkq4oY+VT6p+0t5LMXTkfm7s/U2Uq:6TppGKMDwtN4orTAHjMDja
MD5:	71D3E9DC2BCB8E91225BA9FAB588C8F2
SHA1:	D7E38EE4C245F64B78EB18E6ECD7B9F53B3254A8
SHA-256:	AE99AAEDE2F373187A4FE442A2CB0AB9C2945EFBAB01CF33E01BE517C0C4F813
SHA-512:	DEDA05EBD575D413AA2277876991ECC2EA238907390753485BA1B487EDE2F432363C46DAAD5F3F240EAAF8D3258150829A3AE3D2D9C420EA59567CFD440361A6
Malicious:	false
URL:	https://discord.com/assets/1222195a37d6dd10994e.woff2
Preview:	wOF2.......T......}........B..........................z.. .`..P..D..W........S.6.$..`..r.. .....F..=[.W..ir.h......,......j..In.X....Uj..3...`K\t........".%.]..p..E........G..9&r...S.+.r.5....~`.....S'..1~.a..H...S.........N.tX2G7.u..m.z.!.......).w....V....:.6..W.\.+..j.K...[\|.n..dg.....Kx:;....7?2.j..\...0..=zd.(...{.c.....}._..Q.....dUx....b.\Y,.........W.b.zkAX.,..X..jO..w..% .[..DD.X..G\..?.9..\.G...#...T ..".$.Z.P...W..5.b.._......}at.....@2.A.....m...5Oy....e.a...D...'.s.$...Q.......[.....A.....r..&....8.Q.KZ.#G...#_.~...yh1$.b~.0S[..6..+...../...jdlcC_0S..J.J!e.'...)3.O..}.C.)...v.qn.......5}.7{.m.b.&:.S..h>.hz..."N.G8..A..&.....s...3<...C... _.F$.`.J.....UuKv.ik.H.'....e..b-k..kt..!....Q.l.R)ai&....Dp..\T).O...'6.<....u..WiM.s....I@.....+.....=...&.6.N..n.....\..k...8.....P6.f..k{...3....5....C..T.iG.5....s...$W..=^...3..V.._\..J..2`.........z........1....l.F... .zVb...0.Z..=........[2?.V.....J.....!4B.U..*.....>.Ta`0...

Chrome Cache Entry: 213

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5552)
Category:	downloaded
Size (bytes):	5601
Entropy (8bit):	5.7655360019382895
Encrypted:	false
SSDEEP:	96:2XobeWK+r3kiJfaaLUmbybQSfuaVRbm0HMgFfgWuAyEdVAmefr4/8VZPUGky:qobvfaa9DSfXDbXMaYPAyEdLefr4/YMe
MD5:	13FF42A071C43FA5521C11EB2F2EA914
SHA1:	B97D6318B384D57DEFD41EC4DEBF9D7DE198537C
SHA-256:	6B8776086567649C2432023184979BB8244A268C081FC1D478D834BF50A169F9
SHA-512:	F38C1D3760B23A65EACDB8214424227BDFE638C4A86E6DB89D8D86E29A820060165583FB7794E77935E52B62A6FE09567FC71FB44986D0FBD473F54DEBC56202
Malicious:	false
URL:	https://discord.com/assets/05bd1eb5dea5ee3387f4.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["46369"],{438820:function(e,t,n){var i,a=n(442837),c=n(570140);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}let s={canPlayWowMoment:!1,isFetchingWowMomentMedia:!1,wowMomentWumpusMediaUrl:null};class d extends(i=a.ZP.PersistedStore){initialize(e){null!=e&&(s=e),s.canPlayWowMoment=!1,s.isFetchingWowMomentMedia=!1,s.wowMomentWumpusMediaUrl=null}getState(){return s}get canPlayWowMoment(){return s.canPlayWowMoment}get isFetchingWowMomentMedia(){return s.isFetchingWowMomentMedia}get wowMomentWumpusMedia(){return s.wowMomentWumpusMediaUrl}}o(d,"displayName","PurchasedItemsFestivityStore"),o(d,"persistKey","PurchasedItemsFestivityStore"),o(d,"migrations",[e=>({...e})]),t.Z=new d(c.Z,{LOGOUT:function(){s={canPlayWowMoment:!1,isFetchingWowMomentMedia:!1,wowMomentWumpusMediaUrl:null}},PURCHASED_ITEMS_FESTIVITY_SET_CAN_PLAY_WOW_MOMENT:functi

Chrome Cache Entry: 214

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (970)
Category:	downloaded
Size (bytes):	1019
Entropy (8bit):	5.481455450518707
Encrypted:	false
SSDEEP:	24:wkU14HIuIuISm+mm7VOhR1RYIbTOZF7B7v/SlCxKqWeeUu5m:wkTH/bIm7VObfqZFN7vqYxKfv5m
MD5:	5489024A0568CEB2CCC181B8BA420A0F
SHA1:	121F6E3A6DE26A8DCF7A967C442A8509BC196CDC
SHA-256:	34048A4F2D6B0861798B4D37954DAC09E8071EBB63C8E9B6D8ADF20BE95BFF82
SHA-512:	1C9B0EEF72C329B62D8DBAD87C9BCD78E65C11EFC5075C8EE8120A62F803E0F97B78E9E481373DC88908B00B8D9A9675CA81038EFE05E65BF9E9F3247A8F8D15
Malicious:	false
URL:	https://discord.com/assets/b8160243347055e1f278.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["89273"],{361207:function(n,t,i){i.d(t,{DW:function(){return d},t3:function(){return f},w4:function(){return r}});var u=i(525654),e=i.n(u);i(271579),i(314897);var o=i(981631);let c="linux";function r(n){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1],i=arguments.length>2?arguments[2]:void 0;return"".concat(o.fzT.DESKTOP).concat(t?"/ptb":"","?platform=").concat(n).concat(null!=i?"&format=".concat(i):"")}function a(){var n;let t=arguments.length>0&&void 0!==arguments[0]?arguments[0]:null===(n=e().os)\|\|void 0===n?void 0:n.family;return null==t?"win":-1!==t.indexOf("Ubuntu")\|\|-1!==t.indexOf("Debian")\|\|-1!==t.indexOf("Fedora")\|\|-1!==t.indexOf("Red Hat")\|\|-1!==t.indexOf("SuSE")\|\|-1!==t.indexOf("Linux")?c:-1!==t.indexOf("OS X")?"osx":"win"}function d(n){return({win:"Windows",osx:"Mac",[c]:"Linux"})[a(n)]}function f(){let n=a();return r(n,!1,n===c?"tar.gz":null)}}}]);.//# sourceMappingURL=b8160243

Chrome Cache Entry: 215

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	4804
Entropy (8bit):	3.9838661314243433
Encrypted:	false
SSDEEP:	96:Ez1Y5tmUKv0bhb9lsqYnlV4XdUo4e7JR0Tn515GGNj1j:eWtRK8Z4qYnlV4Xdt6RGaj1j
MD5:	22FD790491653D837422D80E3500CF92
SHA1:	E0618307DDC1E06D85729819B115D0652ABB148C
SHA-256:	641B1091276BA75578C3D93F367F0D70BCBBA7C62A7F159C4307ACF0ED6C5CBE
SHA-512:	AD2100B9391969B160D3DE80C7310CF5706B89CD097D8B48D6DF0D96E9CFB73C15DDD487DF7773C28094A152EC9D4F8F6E6B718C96FAF734708018C65511266E
Malicious:	false
URL:	https://discord.com/assets/23a7a3fd6624342117bf.svg
Preview:	<svg fill="none" height="36" viewBox="0 0 130 36" width="130" xmlns="http://www.w3.org/2000/svg"><g fill="#fff"><path d="m27.5247 8.06243c-2.1034-.96349-4.3524-1.66374-6.7036-2.06243-.2888.51114-.6261 1.19861-.8587 1.74553-2.4995-.36802-4.9759-.36802-7.4293 0-.2326-.54692-.5777-1.23439-.869-1.74553-2.35376.39869-4.60533 1.1015-6.70864 2.06754-4.242451 6.27676-5.392506 12.39766-4.817478 18.43156 2.813808 2.0574 5.540698 3.3071 8.221628 4.1249.6619-.892 1.25228-1.8401 1.76089-2.8394-.96862-.3603-1.89634-.805-2.77294-1.3213.23259-.1686.46001-.345.67979-.5265 5.34655 2.4484 11.15555 2.4484 16.43815 0 .2224.1815.4498.3579.6798.5265-.8791.5188-1.8094.9635-2.778 1.3239.5086.9967 1.0964 1.9474 1.7609 2.8393 2.6834-.8178 5.4129-2.0675 8.2267-4.1274.6747-6.9949-1.1526-13.0595-4.8302-18.43667zm-16.6759 14.72587c-1.6049 0-2.92111-1.467-2.92111-3.2534s1.28807-3.2559 2.92111-3.2559c1.6331 0 2.9493 1.4669 2.9212 3.2559.0025 1.7864-1.2881 3.2534-2.9212 3.2534zm10.7952 0c-1.6049 0-2.9211-1.467-2.9211-3

Chrome Cache Entry: 216

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	137
Entropy (8bit):	4.832107377824175
Encrypted:	false
SSDEEP:	3:t6WH7W+lFAATcvcmJDmJS4RKb5KVErcHrFvR8hiJqGrqL0:t6Abli/c8mc4slmrFv2hiAe
MD5:	70275FE3104CF1D3388586AD8FFD478E
SHA1:	473EA46F5B22B5C7D14C39EE9C0C82811593883B
SHA-256:	3269CF3FDA7681388472225BAD39B6BB3B26088A0A03B6CD5796195F0114CE13
SHA-512:	044C0F8F1583FAEBA3A23FF2DF821A5A0E79C548DB3A6474614894DA2CB125476227407F865CF20D32DC7E4D9ADE09EBA6317EFB787EEED2570C0EBDFC401D2A
Malicious:	false
Preview:	<svg fill="none" height="8" viewBox="0 0 9 8" width="9" xmlns="http://www.w3.org/2000/svg"><path d="m4.5 0 4.5 8h-9z" fill="#fff"/></svg>

Chrome Cache Entry: 217

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11118)
Category:	dropped
Size (bytes):	11167
Entropy (8bit):	5.535074023387345
Encrypted:	false
SSDEEP:	192:YVQA29dyFDfqMgeYTllT06FJLviKriLZErOWD8yLg6T06oGL3rOhzus:QazsqP116In4zn
MD5:	8AAA605C48DC545F185CA77C921139D3
SHA1:	D2481F19DC4D8F4B161D3DD0B35B446FDC505446
SHA-256:	9ADEBA0225F0D293B735E83C05D1BB063F750C439CE8BCD7ED362D795CFD39B1
SHA-512:	469573F4D8F912DC151474F9ACA815F2A686C590408B20733E58C1C21F8DC71A26B2569B8052A8B67331D2DD2FA4E54AD7B4D953FEBC2DCA0676827AC0EFD377
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["52030"],{48550:function(e,t,s){s.d(t,{P:function(){return l}});var n=s(689938);let l={get webauthn(){return n.Z.Messages.MFA_V2_WEBAUTHN_NAME},get totp(){return n.Z.Messages.MFA_V2_TOTP_NAME},get sms(){return n.Z.Messages.MFA_V2_SMS_NAME},get password(){return n.Z.Messages.MFA_V2_PASSWORD_NAME},get backup(){return n.Z.Messages.MFA_V2_BACKUP_NAME}}},124860:function(e,t,s){s.d(t,{Cd:function(){return f},YR:function(){return S}}),s(47120),s(411104);var n=s(200651),l=s(192379),i=s(481060),r=s(447097),o=s(873124),a=s(248902),d=s(160511),u=s(51693),c=s(973810),h=s(689938);function f(e){var t,s;let{mfaChallenge:h,mfaFinish:f,onEarlyClose:m,onClose:S,width:_=440}=e,[g,x]=l.useState(null!==(s=null===(t=h.methods[0])\|\|void 0===t?void 0:t.type)&&void 0!==s?s:"select"),[E,C]=l.useState(g),p=async e=>{let{mfaType:t,data:s}=e;await f({mfaType:t,data:s,ticket:h.ticket}),null!=S&&S()},v={mfaChallenge:h,finish:p,setSli

\Device\Null

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.003997527334849
Encrypted:	false
SSDEEP:	3:HnRthLK5a6eCMABe:HRoJPO
MD5:	DF5DC1ABC0D52F3C9E931E26A7C0065C
SHA1:	EE84123D3B3BC440C63DFE65FF5616BE2B0904D5
SHA-256:	F7167A2FACDE50428D8D2697A1CDFF075DE809323DD16D62B65CDD103B2A9A6D
SHA-512:	9B2253CE41880D22A2DDF4F886BB6CB22FF0C981400CD9D03A1FCA81DE5FAEB86C26B85B66ECEC960816D7BBE9740843890F2FCCD334B6D274295A32A8E6A4E9
Malicious:	false
Preview:	The system cannot find the file specified...

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.423289184775784
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	xxImTScxAq.exe
File size:	506'368 bytes
MD5:	c6938e6c34b9124099c93dec5f9487c7
SHA1:	e6270c7c2948665c0e0c2cefd498740e1beb9ffd
SHA256:	8516ea0af2d90490f0c657e87a92a91b7606ac94f010a46e57b1f3dcb426e678
SHA512:	daa46cb1ef6d47ab561b1664c4457dd8df54fe0d3e570276f110326d7c6dd401eca819c9ee8e2e514a79ea6fedf0d287e1bdbfbd830712772e5afad2e78838cc
SSDEEP:	6144:WbG8heoa+/t7gnvxN52fvrHYsCFN5cMa2qqsjrpzAt+fSK9bBIKhoL4Qgc6:WKIY4CjAvrH0FNK2VsjlcsbXIL49
TLSH:	F5B47D97A7A807E9D1A7D03CC547C603E7B6B49913109BDB43A4CA791F637E12E3A720
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........V...V...V..._.+.B...PHE.^...PH..v...PH..\...PH..R...PH..P.......A...V...s.......?...9H..T...9H..W...9HG.W...9H..W...RichV..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14005fa08
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6716ACAB [Mon Oct 21 19:34:03 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3dd1b7e6418973ac2798d88d33677d96

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F99D8BDAF48h
dec eax
add esp, 28h
jmp 00007F99D8BDA837h
int3
int3
jmp 00007F99D8BDB1F8h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0000175Bh]
dec eax
mov ecx, ebx
call dword ptr [000016C2h]
call dword ptr [00001744h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00001740h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [00001734h]
test eax, eax
je 00007F99D8BDA9C9h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [00018DE2h]
call 00007F99D8BDAB8Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00018EC9h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [00018E59h], eax
dec eax
mov eax, dword ptr [00018EB2h]
dec eax
mov dword ptr [00018D23h], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [00018E27h], eax
mov dword ptr [00018CFDh], C0000409h
mov dword ptr [00018CF7h], 00000001h
mov dword ptr [00000001h], 00000000h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x760f0	0x1cc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7d000	0x1e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x79000	0x3f84	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7e000	0x4e4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x6ffc0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x70080	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x6fe80	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x61000	0x818	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5fdd8	0x5fe00	3cf2e56785173d82847d8f9bcfea8804	False	0.53282879726206	data	6.336582282577137	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x61000	0x16b92	0x16c00	1d897ac11c2977e4c09cb7b14384333e	False	0.3795930631868132	data	5.5799732176819274	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x78000	0xdf8	0x400	d7fd048bac923da9b702c3a4df4c893e	False	0.2138671875	mumps blt global (V6) - 596 byte blocks - P/D format	2.4411408781631465	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x79000	0x3f84	0x4000	6958d7a482fdbe14be61350635b2382f	False	0.48187255859375	data	5.77717054413388	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x7d000	0x1e8	0x200	7d03a0f9d3c3a10dec18b513161e66d8	False	0.54296875	data	4.772037401703051	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7e000	0x4e4	0x600	39326fb49822ad82593e9e49b5e608b8	False	0.5123697916666666	data	4.849267575521713	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x7d060	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
KERNEL32.dll	WideCharToMultiByte, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, GetTickCount, QueryPerformanceCounter, VerifyVersionInfoA, LoadLibraryA, GetProcAddress, GetModuleHandleA, FreeLibrary, GetSystemDirectoryA, CreateFileA, VerSetConditionMask, SleepEx, LeaveCriticalSection, EnterCriticalSection, FormatMessageA, SetLastError, CloseHandle, GetCurrentProcess, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetModuleHandleW, GetCurrentProcessId, GetCurrentThreadId, GetFileSizeEx, WaitForMultipleObjects, PeekNamedPipe, ReadFile, GetFileType, GetEnvironmentVariableA, MultiByteToWideChar, WaitForSingleObjectEx, QueryPerformanceFrequency, GetSystemTimeAsFileTime, MoveFileExA, DeleteCriticalSection, GetLastError, InitializeCriticalSectionEx, OutputDebugStringW, InitializeSListHead, GetConsoleWindow, SetConsoleTitleA, SetConsoleTextAttribute, Sleep, GetStdHandle
USER32.dll	GetWindowLongPtrA, SetWindowLongPtrA, MessageBoxA, SetLayeredWindowAttributes
ADVAPI32.dll	CryptAcquireContextA, CryptReleaseContext, CryptGetHashParam, CryptGenRandom, CryptCreateHash, CryptHashData, CryptDestroyHash, CryptDestroyKey, CryptImportKey, CryptEncrypt
SHELL32.dll	ShellExecuteA
MSVCP140.dll	?_Xlength_error@std@@YAXPEBD@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z, ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?uncaught_exception@std@@YA_NXZ, ?_Xbad_function_call@std@@YAXXZ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
urlmon.dll	URLDownloadToFileA
Normaliz.dll	IdnToAscii
WLDAP32.dll
CRYPT32.dll	CertGetCertificateChain, CertFreeCertificateChainEngine, CertCreateCertificateChainEngine, CryptQueryObject, CertGetNameStringA, CertFindExtension, CertAddCertificateContextToStore, CertFreeCertificateChain, PFXImportCertStore, CryptStringToBinaryA, CertFreeCertificateContext, CertFindCertificateInStore, CertEnumCertificatesInStore, CertCloseStore, CertOpenStore, CryptDecodeObjectEx
WS2_32.dll	gethostname, sendto, recvfrom, freeaddrinfo, getaddrinfo, select, ioctlsocket, listen, htonl, accept, WSACleanup, WSAStartup, WSAIoctl, WSASetLastError, socket, setsockopt, ntohs, htons, getsockopt, getsockname, getpeername, connect, bind, WSAGetLastError, send, recv, closesocket, ntohl, __WSAFDIsSet
VCRUNTIME140.dll	__std_exception_copy, __std_exception_destroy, _CxxThrowException, memcpy, memset, __std_terminate, __C_specific_handler, __current_exception_context, __current_exception, memchr, memcmp, strchr, strstr, memmove, strrchr
VCRUNTIME140_1.dll	__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0.dll	_invalid_parameter_noinfo_noreturn, _beginthreadex, _errno, __sys_nerr, _getpid, exit, system, terminate, _register_thread_local_exe_atexit_callback, _configure_narrow_argv, _initialize_narrow_environment, _initialize_onexit_table, _register_onexit_function, _crt_atexit, _cexit, _seh_filter_exe, _set_app_type, strerror, _c_exit, _initterm, _initterm_e, _exit, __p___argv, __p___argc, _get_initial_narrow_environment
api-ms-win-crt-heap-l1-1-0.dll	realloc, _callnewh, free, calloc, _set_new_mode, malloc
api-ms-win-crt-utility-l1-1-0.dll	rand, qsort
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vfprintf, fseek, feof, __p__commode, __acrt_iob_func, ftell, fputc, _lseeki64, _read, _write, _close, _open, fflush, __stdio_common_vsscanf, __stdio_common_vsprintf, fread, fputs, fopen, fwrite, fgets, fclose, _set_fmode
api-ms-win-crt-convert-l1-1-0.dll	strtod, atoi, strtoul, strtoull, strtol, strtoll
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale, localeconv
api-ms-win-crt-time-l1-1-0.dll	_time64, _gmtime64
api-ms-win-crt-string-l1-1-0.dll	strcmp, strncmp, isupper, strcspn, strspn, _strdup, strncpy, tolower, strpbrk
api-ms-win-crt-filesystem-l1-1-0.dll	_stat64, _unlink, _access, _fstat64
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr, _dclass

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 09:15:20.018733025 CEST	443	49707	104.98.116.138	192.168.2.7
Oct 24, 2024 09:15:20.018846989 CEST	49707	443	192.168.2.7	104.98.116.138
Oct 24, 2024 09:15:20.153810978 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 24, 2024 09:15:20.716325045 CEST	49675	443	192.168.2.7	104.98.116.138
Oct 24, 2024 09:15:20.718508005 CEST	49674	443	192.168.2.7	104.98.116.138
Oct 24, 2024 09:15:20.872575998 CEST	49672	443	192.168.2.7	104.98.116.138
Oct 24, 2024 09:15:22.318569899 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:22.318629026 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:22.318718910 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:22.319077015 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:22.319094896 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.070911884 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.071062088 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.076553106 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.076560020 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.077079058 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.087042093 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.127341032 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.301950932 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.301980972 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.302016020 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.302172899 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.302207947 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.302258968 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.335894108 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.335923910 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.336083889 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.336098909 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.336216927 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.420659065 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.420682907 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.420845032 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.420865059 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.420903921 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.454593897 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.454618931 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.454772949 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.454802036 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.454844952 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.457317114 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.457340956 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.457431078 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.457437038 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.457479000 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.460004091 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.460026979 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.460097075 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.460103035 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.460135937 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.538654089 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.538676977 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.538893938 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.538918972 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.538961887 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.570944071 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.571012020 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.571125031 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.571137905 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.571172953 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.571187973 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.571824074 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.571870089 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.571906090 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.571912050 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.571942091 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.571959972 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.572710991 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.572756052 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.572774887 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.572781086 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.572813034 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.572834969 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.573787928 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.573827028 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.573867083 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.573873043 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.573887110 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.573911905 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.656325102 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.656347036 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.656543016 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.656558037 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.656615019 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.688724041 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.688757896 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.688816071 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.688863993 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.688879013 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.688896894 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.688936949 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.688936949 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.695182085 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.695182085 CEST	49708	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.695199013 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.695208073 CEST	443	49708	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.746345997 CEST	49710	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.746380091 CEST	49709	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.746388912 CEST	443	49710	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.746429920 CEST	443	49709	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.746489048 CEST	49710	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.746522903 CEST	49709	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.746969938 CEST	49710	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.746985912 CEST	443	49710	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.747293949 CEST	49709	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.747311115 CEST	443	49709	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.748697042 CEST	49711	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.748708963 CEST	443	49711	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.748761892 CEST	49711	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.748877048 CEST	49711	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.748888016 CEST	443	49711	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.749730110 CEST	49712	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.749762058 CEST	443	49712	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.749809027 CEST	49712	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.750114918 CEST	49712	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.750128031 CEST	443	49712	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.750746012 CEST	49713	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.750827074 CEST	443	49713	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:23.750889063 CEST	49713	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.750996113 CEST	49713	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:23.751029015 CEST	443	49713	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.478408098 CEST	443	49711	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.479180098 CEST	49711	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.479213953 CEST	443	49711	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.479789019 CEST	49711	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.479795933 CEST	443	49711	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.486517906 CEST	443	49713	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.488878965 CEST	49713	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.488940954 CEST	443	49713	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.489363909 CEST	49713	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.489377975 CEST	443	49713	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.490940094 CEST	443	49710	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.492872953 CEST	49710	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.492897034 CEST	443	49710	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.493333101 CEST	49710	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.493340015 CEST	443	49710	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.499964952 CEST	443	49712	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.500943899 CEST	49712	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.500962973 CEST	443	49712	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.501379967 CEST	49712	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.501384020 CEST	443	49712	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.506217003 CEST	443	49709	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.506597996 CEST	49709	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.506617069 CEST	443	49709	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.507009029 CEST	49709	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.507014990 CEST	443	49709	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.615238905 CEST	443	49711	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.615261078 CEST	443	49711	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.615346909 CEST	443	49711	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.615422964 CEST	49711	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.615462065 CEST	49711	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.619307041 CEST	49711	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.619332075 CEST	443	49711	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.622839928 CEST	443	49713	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.622901917 CEST	443	49713	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.623316050 CEST	49713	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.623437881 CEST	49713	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.623459101 CEST	443	49713	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.623470068 CEST	49713	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.623476982 CEST	443	49713	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.623729944 CEST	49714	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.623760939 CEST	443	49714	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.623923063 CEST	49714	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.624425888 CEST	49714	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.624437094 CEST	443	49714	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.627135992 CEST	49715	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.627177000 CEST	443	49715	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.627310991 CEST	49715	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.627482891 CEST	49715	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.627501011 CEST	443	49715	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.628810883 CEST	443	49710	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.628896952 CEST	443	49710	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.628966093 CEST	49710	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.629337072 CEST	49710	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.629359007 CEST	443	49710	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.629373074 CEST	49710	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.629379034 CEST	443	49710	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.632428885 CEST	49716	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.632462978 CEST	443	49716	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.632744074 CEST	49716	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.632786989 CEST	49716	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.632798910 CEST	443	49716	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.639697075 CEST	443	49712	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.639720917 CEST	443	49712	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.639836073 CEST	443	49712	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.639945984 CEST	49712	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.640049934 CEST	49712	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.640233994 CEST	49712	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.640233994 CEST	49712	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.640249014 CEST	443	49712	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.640252113 CEST	443	49712	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.644012928 CEST	49717	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.644057989 CEST	443	49717	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.644408941 CEST	49717	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.644763947 CEST	49717	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.644781113 CEST	443	49717	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.646378994 CEST	443	49709	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.646401882 CEST	443	49709	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.646473885 CEST	49709	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.646486044 CEST	443	49709	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.646737099 CEST	49709	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.646738052 CEST	443	49709	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.646737099 CEST	49709	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.646763086 CEST	443	49709	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.646779060 CEST	49709	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.646785975 CEST	443	49709	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.646842957 CEST	49709	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.646852016 CEST	443	49709	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.650207996 CEST	49718	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.650226116 CEST	443	49718	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.650397062 CEST	49718	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.650602102 CEST	49718	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:24.650612116 CEST	443	49718	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:24.950783968 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 24, 2024 09:15:25.364502907 CEST	443	49716	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.365644932 CEST	443	49714	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.372823000 CEST	443	49715	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.374119997 CEST	49716	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.374141932 CEST	443	49716	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.375323057 CEST	49716	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.375330925 CEST	443	49716	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.376202106 CEST	49714	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.376234055 CEST	443	49714	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.376233101 CEST	49715	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.376262903 CEST	443	49715	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.377139091 CEST	49714	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.377146006 CEST	443	49714	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.377228975 CEST	49715	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.377242088 CEST	443	49715	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.385009050 CEST	443	49717	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.385409117 CEST	49717	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.385432005 CEST	443	49717	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.385840893 CEST	49717	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.385847092 CEST	443	49717	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.388927937 CEST	443	49718	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.389718056 CEST	49718	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.389738083 CEST	443	49718	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.389856100 CEST	49718	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.389862061 CEST	443	49718	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.501347065 CEST	443	49716	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.501488924 CEST	443	49716	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.501552105 CEST	49716	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.502631903 CEST	49716	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.502645016 CEST	443	49716	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.502671957 CEST	49716	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.502680063 CEST	443	49716	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.503114939 CEST	443	49714	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.503165007 CEST	443	49714	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.503213882 CEST	49714	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.503536940 CEST	49714	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.503552914 CEST	443	49714	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.503565073 CEST	49714	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.503570080 CEST	443	49714	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.506624937 CEST	443	49715	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.506690979 CEST	443	49715	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.506742001 CEST	49715	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.514552116 CEST	443	49717	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.514724970 CEST	443	49717	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.514772892 CEST	49717	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.520463943 CEST	443	49718	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.520796061 CEST	443	49718	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.520957947 CEST	49718	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.526957035 CEST	49719	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.526993990 CEST	443	49719	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.527055979 CEST	49719	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.527141094 CEST	49715	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.527185917 CEST	443	49715	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.527205944 CEST	49715	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.527221918 CEST	443	49715	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.529120922 CEST	49719	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.529136896 CEST	443	49719	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.529462099 CEST	49717	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.529470921 CEST	443	49717	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.529481888 CEST	49717	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.529485941 CEST	443	49717	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.530253887 CEST	49718	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.530268908 CEST	443	49718	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.530280113 CEST	49718	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.530286074 CEST	443	49718	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.531270027 CEST	49720	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.531323910 CEST	443	49720	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.531384945 CEST	49720	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.537333965 CEST	49721	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.537400007 CEST	443	49721	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.537564993 CEST	49721	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.540312052 CEST	49720	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.540330887 CEST	443	49720	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.547561884 CEST	49721	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.547602892 CEST	443	49721	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.551656008 CEST	49722	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.551704884 CEST	443	49722	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.551778078 CEST	49722	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.551791906 CEST	49723	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.551840067 CEST	443	49723	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.552124977 CEST	49723	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.552124977 CEST	49723	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.552148104 CEST	49722	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:25.552161932 CEST	443	49722	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:25.552175045 CEST	443	49723	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:26.106852055 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 24, 2024 09:15:27.190648079 CEST	443	49723	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.190651894 CEST	443	49722	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.196887970 CEST	443	49719	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.198878050 CEST	443	49720	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.202927113 CEST	443	49721	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.231920958 CEST	49723	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.231983900 CEST	49722	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.247464895 CEST	49719	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.249749899 CEST	49720	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.252484083 CEST	49721	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.301502943 CEST	49721	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.301532030 CEST	443	49721	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.302684069 CEST	49721	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.302690983 CEST	443	49721	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.303338051 CEST	49723	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.303344011 CEST	443	49723	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.303622961 CEST	49723	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.303630114 CEST	443	49723	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.303966999 CEST	49722	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.303993940 CEST	443	49722	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.304630995 CEST	49722	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.304637909 CEST	443	49722	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.304933071 CEST	49719	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.304951906 CEST	443	49719	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.305337906 CEST	49719	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.305345058 CEST	443	49719	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.305583000 CEST	49720	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.305593967 CEST	443	49720	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.305989981 CEST	49720	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.305994987 CEST	443	49720	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.428760052 CEST	443	49723	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.428915977 CEST	443	49723	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.428981066 CEST	49723	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.429943085 CEST	443	49719	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.430025101 CEST	443	49719	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.430088043 CEST	49719	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.430684090 CEST	443	49721	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.430928946 CEST	443	49721	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.431045055 CEST	49721	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.434159994 CEST	443	49720	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.434485912 CEST	443	49720	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.434546947 CEST	49720	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.435843945 CEST	443	49722	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.436328888 CEST	443	49722	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.436378002 CEST	49722	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.514770985 CEST	49723	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.514770985 CEST	49723	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.514800072 CEST	443	49723	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.514811039 CEST	443	49723	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.516602993 CEST	49722	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.516643047 CEST	443	49722	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.516664028 CEST	49722	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.516674042 CEST	443	49722	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.518075943 CEST	49719	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.518109083 CEST	443	49719	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.518121958 CEST	49719	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.518129110 CEST	443	49719	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.520385027 CEST	49721	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.520437956 CEST	443	49721	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.520454884 CEST	49721	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.520462036 CEST	443	49721	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.520617962 CEST	49720	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.520637035 CEST	443	49720	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.520654917 CEST	49720	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.520661116 CEST	443	49720	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.542756081 CEST	49724	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.542867899 CEST	443	49724	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.542952061 CEST	49724	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.546564102 CEST	49725	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.546631098 CEST	443	49725	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.546714067 CEST	49726	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.546741962 CEST	443	49726	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.546819925 CEST	49726	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.547090054 CEST	49724	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.547111034 CEST	443	49724	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.547173023 CEST	49725	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.549998045 CEST	49726	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.550010920 CEST	443	49726	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.550079107 CEST	49727	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.550079107 CEST	49728	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.550080061 CEST	49725	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.550095081 CEST	443	49727	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.550100088 CEST	443	49728	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.550118923 CEST	443	49725	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.550209999 CEST	49728	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.550210953 CEST	49727	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.550410032 CEST	49728	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.550410032 CEST	49727	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:27.550426960 CEST	443	49728	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:27.550441027 CEST	443	49727	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.133064032 CEST	49733	443	192.168.2.7	104.26.0.5
Oct 24, 2024 09:15:28.133090019 CEST	443	49733	104.26.0.5	192.168.2.7
Oct 24, 2024 09:15:28.133162022 CEST	49733	443	192.168.2.7	104.26.0.5
Oct 24, 2024 09:15:28.142756939 CEST	49733	443	192.168.2.7	104.26.0.5
Oct 24, 2024 09:15:28.142767906 CEST	443	49733	104.26.0.5	192.168.2.7
Oct 24, 2024 09:15:28.265126944 CEST	443	49724	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.265748978 CEST	49724	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.265779018 CEST	443	49724	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.266269922 CEST	49724	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.266278028 CEST	443	49724	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.285223007 CEST	443	49727	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.285804987 CEST	49727	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.285825968 CEST	443	49727	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.286339998 CEST	49727	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.286345959 CEST	443	49727	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.290906906 CEST	443	49726	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.291357040 CEST	49726	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.291385889 CEST	443	49726	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.291800022 CEST	49726	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.291807890 CEST	443	49726	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.300919056 CEST	443	49728	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.301326036 CEST	49728	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.301346064 CEST	443	49728	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.301824093 CEST	49728	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.301830053 CEST	443	49728	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.308155060 CEST	443	49725	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.308589935 CEST	49725	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.308614016 CEST	443	49725	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.308880091 CEST	49725	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.308885098 CEST	443	49725	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.393702030 CEST	443	49724	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.393939972 CEST	443	49724	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.394017935 CEST	49724	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.394134045 CEST	49724	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.394154072 CEST	443	49724	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.394166946 CEST	49724	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.394175053 CEST	443	49724	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.397491932 CEST	49734	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.397527933 CEST	443	49734	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.397617102 CEST	49734	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.397866011 CEST	49734	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.397878885 CEST	443	49734	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.417649984 CEST	443	49727	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.417717934 CEST	443	49727	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.417896032 CEST	49727	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.417929888 CEST	49727	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.417967081 CEST	443	49727	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.417983055 CEST	49727	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.417989969 CEST	443	49727	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.420663118 CEST	49735	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.420706034 CEST	443	49735	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.420802116 CEST	49735	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.420974970 CEST	49735	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.420990944 CEST	443	49735	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.424021959 CEST	443	49726	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.424118996 CEST	443	49726	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.424431086 CEST	49726	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.424597979 CEST	49726	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.424618006 CEST	443	49726	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.424632072 CEST	49726	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.424638033 CEST	443	49726	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.427587986 CEST	49736	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.427634954 CEST	443	49736	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.427791119 CEST	49736	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.427956104 CEST	49736	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.427970886 CEST	443	49736	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.434726954 CEST	443	49728	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.434921980 CEST	443	49728	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.435252905 CEST	49728	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.435508013 CEST	49728	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.435508013 CEST	49728	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.435529947 CEST	443	49728	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.435540915 CEST	443	49728	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.438904047 CEST	49737	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.438929081 CEST	443	49737	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.439169884 CEST	49737	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.439306974 CEST	49737	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.439321041 CEST	443	49737	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.441112041 CEST	443	49725	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.441543102 CEST	443	49725	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.441617012 CEST	49725	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.441761971 CEST	49725	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.441761971 CEST	49725	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.441781998 CEST	443	49725	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.441790104 CEST	443	49725	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.458580017 CEST	49738	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.458611965 CEST	443	49738	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.458745003 CEST	49738	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.458898067 CEST	49738	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:28.458911896 CEST	443	49738	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:28.919400930 CEST	443	49733	104.26.0.5	192.168.2.7
Oct 24, 2024 09:15:28.919516087 CEST	49733	443	192.168.2.7	104.26.0.5
Oct 24, 2024 09:15:28.923208952 CEST	49733	443	192.168.2.7	104.26.0.5
Oct 24, 2024 09:15:28.923218012 CEST	443	49733	104.26.0.5	192.168.2.7
Oct 24, 2024 09:15:28.923727989 CEST	443	49733	104.26.0.5	192.168.2.7
Oct 24, 2024 09:15:28.926698923 CEST	49733	443	192.168.2.7	104.26.0.5
Oct 24, 2024 09:15:28.967360020 CEST	443	49733	104.26.0.5	192.168.2.7
Oct 24, 2024 09:15:29.085750103 CEST	443	49733	104.26.0.5	192.168.2.7
Oct 24, 2024 09:15:29.085828066 CEST	443	49733	104.26.0.5	192.168.2.7
Oct 24, 2024 09:15:29.085967064 CEST	49733	443	192.168.2.7	104.26.0.5
Oct 24, 2024 09:15:29.095753908 CEST	49733	443	192.168.2.7	104.26.0.5
Oct 24, 2024 09:15:29.095772028 CEST	443	49733	104.26.0.5	192.168.2.7
Oct 24, 2024 09:15:29.147798061 CEST	443	49734	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.148540020 CEST	49734	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.148554087 CEST	443	49734	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.149375916 CEST	49734	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.149389029 CEST	443	49734	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.154418945 CEST	443	49735	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.154930115 CEST	49735	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.154957056 CEST	443	49735	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.155401945 CEST	49735	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.155407906 CEST	443	49735	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.155859947 CEST	443	49736	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.156291962 CEST	49736	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.156316996 CEST	443	49736	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.156701088 CEST	49736	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.156706095 CEST	443	49736	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.169652939 CEST	443	49737	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.170044899 CEST	49737	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.170063019 CEST	443	49737	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.170475006 CEST	49737	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.170485020 CEST	443	49737	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.208031893 CEST	443	49738	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.208822012 CEST	49738	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.208834887 CEST	443	49738	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.209631920 CEST	49738	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.209639072 CEST	443	49738	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.280097008 CEST	443	49734	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.280237913 CEST	443	49734	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.280527115 CEST	49734	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.284337997 CEST	443	49735	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.284399986 CEST	443	49735	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.284461975 CEST	49735	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.287668943 CEST	443	49736	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.287772894 CEST	443	49736	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.287877083 CEST	49736	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.289412022 CEST	49734	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.289412022 CEST	49734	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.289428949 CEST	443	49734	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.289434910 CEST	443	49734	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.291383982 CEST	49735	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.291403055 CEST	443	49735	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.291434050 CEST	49735	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.291440964 CEST	443	49735	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.292614937 CEST	49736	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.292632103 CEST	443	49736	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.300143957 CEST	49739	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.300175905 CEST	443	49739	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.300471067 CEST	49739	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.301692963 CEST	49740	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.301717043 CEST	443	49740	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.301846027 CEST	49740	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.302472115 CEST	49739	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.302505970 CEST	443	49739	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.302558899 CEST	49740	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.302573919 CEST	443	49740	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.303040028 CEST	49741	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.303070068 CEST	443	49741	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.303282976 CEST	49741	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.303368092 CEST	443	49737	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.303385019 CEST	49741	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.303400993 CEST	443	49741	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.303518057 CEST	443	49737	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.303791046 CEST	49737	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.303836107 CEST	49737	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.303836107 CEST	49737	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.303854942 CEST	443	49737	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.303868055 CEST	443	49737	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.305900097 CEST	49742	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.305917025 CEST	443	49742	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.306029081 CEST	49742	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.306153059 CEST	49742	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.306164980 CEST	443	49742	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.340783119 CEST	443	49738	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.340910912 CEST	443	49738	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.340991974 CEST	49738	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.341540098 CEST	49738	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.341552973 CEST	443	49738	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.344746113 CEST	49743	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.344784021 CEST	443	49743	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:29.344919920 CEST	49743	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.345463037 CEST	49743	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:29.345483065 CEST	443	49743	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:30.325561047 CEST	49675	443	192.168.2.7	104.98.116.138
Oct 24, 2024 09:15:30.325563908 CEST	49674	443	192.168.2.7	104.98.116.138
Oct 24, 2024 09:15:30.481801033 CEST	49672	443	192.168.2.7	104.98.116.138
Oct 24, 2024 09:15:30.939889908 CEST	443	49739	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:30.940517902 CEST	49739	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:30.940536976 CEST	443	49739	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:30.941149950 CEST	49739	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:30.941157103 CEST	443	49739	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:30.941265106 CEST	443	49742	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:30.941589117 CEST	49742	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:30.941613913 CEST	443	49742	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:30.941973925 CEST	49742	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:30.941981077 CEST	443	49742	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:30.942290068 CEST	443	49740	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:30.942631006 CEST	49740	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:30.942646980 CEST	443	49740	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:30.942923069 CEST	443	49741	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:30.943051100 CEST	49740	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:30.943058014 CEST	443	49740	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:30.945173025 CEST	49741	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:30.945188046 CEST	443	49741	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:30.945633888 CEST	49741	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:30.945638895 CEST	443	49741	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:30.951982975 CEST	443	49743	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:30.952428102 CEST	49743	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:30.952440023 CEST	443	49743	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:30.952871084 CEST	49743	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:30.952874899 CEST	443	49743	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.069281101 CEST	443	49739	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.069470882 CEST	443	49739	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.069529057 CEST	49739	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.069680929 CEST	49739	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.069696903 CEST	443	49739	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.069724083 CEST	49739	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.069730043 CEST	443	49739	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.071732044 CEST	443	49742	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.071965933 CEST	443	49742	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.072037935 CEST	49742	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.072925091 CEST	49744	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.072951078 CEST	443	49744	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.073170900 CEST	49744	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.073334932 CEST	49742	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.073357105 CEST	443	49742	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.073368073 CEST	49742	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.073374033 CEST	443	49742	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.074486971 CEST	443	49741	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.074729919 CEST	443	49741	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.074779034 CEST	49741	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.074928999 CEST	49744	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.074940920 CEST	443	49744	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.075700045 CEST	49741	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.075715065 CEST	443	49741	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.075990915 CEST	49745	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.076035976 CEST	443	49745	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.076136112 CEST	49745	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.076354980 CEST	443	49740	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.076380014 CEST	49745	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.076394081 CEST	443	49745	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.076456070 CEST	443	49740	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.076562881 CEST	49740	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.076613903 CEST	49740	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.076613903 CEST	49740	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.076638937 CEST	443	49740	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.076672077 CEST	443	49740	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.078737974 CEST	49746	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.078766108 CEST	443	49746	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.078835011 CEST	49746	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.079142094 CEST	49746	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.079161882 CEST	443	49746	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.079607010 CEST	49747	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.079617977 CEST	443	49747	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.079678059 CEST	49747	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.079793930 CEST	49747	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.079806089 CEST	443	49747	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.082961082 CEST	443	49743	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.083095074 CEST	443	49743	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.083244085 CEST	49743	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.083323956 CEST	49743	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.083336115 CEST	443	49743	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.083347082 CEST	49743	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.083352089 CEST	443	49743	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.085256100 CEST	49748	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.085273981 CEST	443	49748	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.085335970 CEST	49748	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.085638046 CEST	49748	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.085648060 CEST	443	49748	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.793870926 CEST	443	49744	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.798569918 CEST	443	49745	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.799483061 CEST	49744	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.799508095 CEST	443	49744	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.799978018 CEST	49744	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.799983978 CEST	443	49744	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.817611933 CEST	49745	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.817651987 CEST	443	49745	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.818106890 CEST	49745	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.818114042 CEST	443	49745	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.819236040 CEST	443	49746	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.819921970 CEST	49746	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.819943905 CEST	443	49746	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.820569992 CEST	49746	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.820578098 CEST	443	49746	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.828025103 CEST	443	49747	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.829329014 CEST	49747	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.829343081 CEST	443	49747	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.829962969 CEST	49747	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.829969883 CEST	443	49747	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.830797911 CEST	443	49748	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.831131935 CEST	49748	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.831146002 CEST	443	49748	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.831526041 CEST	49748	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.831530094 CEST	443	49748	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.923743963 CEST	443	49744	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.923934937 CEST	443	49744	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.923985958 CEST	49744	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.943274021 CEST	443	49745	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.943624020 CEST	443	49745	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.943790913 CEST	49745	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.951178074 CEST	443	49746	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.951250076 CEST	443	49746	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.951414108 CEST	49746	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.961272001 CEST	443	49747	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.961436033 CEST	443	49747	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.961514950 CEST	49747	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:31.963690996 CEST	443	49748	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.963838100 CEST	443	49748	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:31.963884115 CEST	49748	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:32.013371944 CEST	49748	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:32.013382912 CEST	443	49748	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:32.013391972 CEST	49748	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:32.013398886 CEST	443	49748	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:32.013499022 CEST	49744	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:32.013499022 CEST	49744	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:32.013514042 CEST	443	49744	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:32.013519049 CEST	443	49744	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:32.021687031 CEST	49745	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:32.021712065 CEST	443	49745	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:32.021718979 CEST	49745	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:32.021724939 CEST	443	49745	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:32.023467064 CEST	49746	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:32.023467064 CEST	49746	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:32.023478031 CEST	443	49746	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:32.023482084 CEST	443	49746	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:32.024049044 CEST	49747	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:32.024055004 CEST	443	49747	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:32.024071932 CEST	49747	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:32.024076939 CEST	443	49747	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:32.191340923 CEST	49749	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:32.191387892 CEST	443	49749	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:32.191550016 CEST	49749	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:32.488645077 CEST	49750	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:32.488686085 CEST	443	49750	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:32.488775015 CEST	49750	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:32.696569920 CEST	49749	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:32.696598053 CEST	443	49749	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:32.840600014 CEST	49750	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:32.840620041 CEST	443	49750	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:32.866043091 CEST	49751	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:32.866091013 CEST	443	49751	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:32.866173029 CEST	49751	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:32.937191963 CEST	49751	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:32.937213898 CEST	443	49751	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:33.004726887 CEST	49752	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:33.004769087 CEST	443	49752	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:33.004913092 CEST	49752	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:33.027643919 CEST	49753	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:33.027687073 CEST	443	49753	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:33.027767897 CEST	49753	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:33.056737900 CEST	49752	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:33.056762934 CEST	443	49752	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:33.062511921 CEST	49753	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:33.062545061 CEST	443	49753	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:33.710202932 CEST	49758	443	192.168.2.7	162.159.135.234
Oct 24, 2024 09:15:33.710243940 CEST	443	49758	162.159.135.234	192.168.2.7
Oct 24, 2024 09:15:33.710331917 CEST	49758	443	192.168.2.7	162.159.135.234
Oct 24, 2024 09:15:33.711333990 CEST	49760	443	192.168.2.7	162.159.135.234
Oct 24, 2024 09:15:33.711358070 CEST	443	49760	162.159.135.234	192.168.2.7
Oct 24, 2024 09:15:33.711548090 CEST	49760	443	192.168.2.7	162.159.135.234
Oct 24, 2024 09:15:33.711563110 CEST	49758	443	192.168.2.7	162.159.135.234
Oct 24, 2024 09:15:33.711575985 CEST	443	49758	162.159.135.234	192.168.2.7
Oct 24, 2024 09:15:33.711999893 CEST	49760	443	192.168.2.7	162.159.135.234
Oct 24, 2024 09:15:33.712013006 CEST	443	49760	162.159.135.234	192.168.2.7
Oct 24, 2024 09:15:34.335762978 CEST	443	49760	162.159.135.234	192.168.2.7
Oct 24, 2024 09:15:34.336178064 CEST	49760	443	192.168.2.7	162.159.135.234
Oct 24, 2024 09:15:34.336216927 CEST	443	49760	162.159.135.234	192.168.2.7
Oct 24, 2024 09:15:34.337286949 CEST	443	49760	162.159.135.234	192.168.2.7
Oct 24, 2024 09:15:34.337527990 CEST	49760	443	192.168.2.7	162.159.135.234
Oct 24, 2024 09:15:34.338042021 CEST	443	49758	162.159.135.234	192.168.2.7
Oct 24, 2024 09:15:34.338958025 CEST	49758	443	192.168.2.7	162.159.135.234
Oct 24, 2024 09:15:34.338989973 CEST	443	49758	162.159.135.234	192.168.2.7
Oct 24, 2024 09:15:34.340018988 CEST	443	49758	162.159.135.234	192.168.2.7
Oct 24, 2024 09:15:34.340102911 CEST	49758	443	192.168.2.7	162.159.135.234
Oct 24, 2024 09:15:34.340284109 CEST	49760	443	192.168.2.7	162.159.135.234
Oct 24, 2024 09:15:34.340347052 CEST	443	49760	162.159.135.234	192.168.2.7
Oct 24, 2024 09:15:34.342178106 CEST	49758	443	192.168.2.7	162.159.135.234
Oct 24, 2024 09:15:34.342245102 CEST	443	49758	162.159.135.234	192.168.2.7
Oct 24, 2024 09:15:34.342803001 CEST	49760	443	192.168.2.7	162.159.135.234
Oct 24, 2024 09:15:34.342809916 CEST	443	49760	162.159.135.234	192.168.2.7
Oct 24, 2024 09:15:34.390104055 CEST	49760	443	192.168.2.7	162.159.135.234
Oct 24, 2024 09:15:34.434444904 CEST	443	49753	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.434957981 CEST	443	49752	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.435863972 CEST	49753	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.435889959 CEST	443	49753	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.436410904 CEST	49758	443	192.168.2.7	162.159.135.234
Oct 24, 2024 09:15:34.436441898 CEST	443	49758	162.159.135.234	192.168.2.7
Oct 24, 2024 09:15:34.438946962 CEST	49752	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.438961983 CEST	443	49752	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.439552069 CEST	49753	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.439558983 CEST	443	49753	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.440321922 CEST	49752	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.440327883 CEST	443	49752	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.444844961 CEST	443	49750	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.445195913 CEST	443	49749	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.445353985 CEST	49750	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.445372105 CEST	443	49750	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.445806026 CEST	49749	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.445843935 CEST	443	49749	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.445960045 CEST	49750	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.445966005 CEST	443	49750	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.446257114 CEST	49749	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.446263075 CEST	443	49749	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.460416079 CEST	443	49751	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.460948944 CEST	49751	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.460958004 CEST	443	49751	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.461556911 CEST	49751	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.461560965 CEST	443	49751	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.479150057 CEST	443	49760	162.159.135.234	192.168.2.7
Oct 24, 2024 09:15:34.479221106 CEST	443	49760	162.159.135.234	192.168.2.7
Oct 24, 2024 09:15:34.479444027 CEST	49760	443	192.168.2.7	162.159.135.234
Oct 24, 2024 09:15:34.479885101 CEST	49760	443	192.168.2.7	162.159.135.234
Oct 24, 2024 09:15:34.479908943 CEST	443	49760	162.159.135.234	192.168.2.7
Oct 24, 2024 09:15:34.480143070 CEST	49760	443	192.168.2.7	162.159.135.234
Oct 24, 2024 09:15:34.480143070 CEST	49760	443	192.168.2.7	162.159.135.234
Oct 24, 2024 09:15:34.491343975 CEST	49761	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:34.491365910 CEST	443	49761	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:34.491436958 CEST	49761	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:34.491638899 CEST	49761	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:34.491651058 CEST	443	49761	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:34.546300888 CEST	49758	443	192.168.2.7	162.159.135.234
Oct 24, 2024 09:15:34.567178965 CEST	443	49753	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.567204952 CEST	443	49752	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.567311049 CEST	443	49752	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.567358971 CEST	443	49753	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.567594051 CEST	49752	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.567666054 CEST	49752	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.567687035 CEST	443	49752	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.567780972 CEST	49753	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.567780972 CEST	49753	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.567781925 CEST	49753	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.567797899 CEST	49752	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.567806005 CEST	443	49752	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.571038008 CEST	49762	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.571069002 CEST	443	49762	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.571367979 CEST	49762	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.572323084 CEST	49763	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.572356939 CEST	443	49763	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.572468042 CEST	49763	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.572767019 CEST	49762	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.572779894 CEST	443	49762	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.572885036 CEST	49763	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.572896957 CEST	443	49763	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.576364040 CEST	443	49750	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.576927900 CEST	443	49750	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.577039003 CEST	49750	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.577039003 CEST	49750	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.577039003 CEST	49750	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.577985048 CEST	443	49749	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.578093052 CEST	443	49749	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.578387976 CEST	49749	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.578613043 CEST	49749	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.578630924 CEST	443	49749	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.578668118 CEST	49749	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.578672886 CEST	443	49749	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.584465027 CEST	49764	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.584533930 CEST	443	49764	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.584784985 CEST	49764	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.585077047 CEST	49764	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.585092068 CEST	443	49764	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.585309029 CEST	49765	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.585340977 CEST	443	49765	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.585408926 CEST	49765	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.585659027 CEST	49765	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.585673094 CEST	443	49765	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.591779947 CEST	443	49751	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.591994047 CEST	443	49751	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.592143059 CEST	49751	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.592237949 CEST	49751	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.592247009 CEST	443	49751	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.592258930 CEST	49751	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.592262983 CEST	443	49751	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.597208977 CEST	49766	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.597219944 CEST	443	49766	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.597575903 CEST	49766	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.599433899 CEST	49766	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.599446058 CEST	443	49766	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:34.887733936 CEST	49750	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:34.887758017 CEST	443	49750	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.048291922 CEST	49753	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.048331022 CEST	443	49753	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.119221926 CEST	443	49761	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:35.121949911 CEST	49761	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:35.121964931 CEST	443	49761	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:35.123061895 CEST	443	49761	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:35.123131990 CEST	49761	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:35.125942945 CEST	49761	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:35.126034021 CEST	443	49761	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:35.126382113 CEST	49761	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:35.165997982 CEST	49761	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:35.166006088 CEST	443	49761	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:35.218521118 CEST	49761	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:35.304660082 CEST	443	49763	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.327296972 CEST	443	49765	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.331793070 CEST	443	49764	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.341233015 CEST	443	49766	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.353571892 CEST	49765	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.353634119 CEST	443	49765	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.353905916 CEST	49763	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.353940964 CEST	443	49763	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.354075909 CEST	49765	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.354091883 CEST	443	49765	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.354151011 CEST	49764	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.354176998 CEST	443	49764	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.354490042 CEST	49764	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.354497910 CEST	443	49764	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.354518890 CEST	49763	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.354525089 CEST	443	49763	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.354839087 CEST	49766	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.354855061 CEST	443	49766	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.355272055 CEST	49766	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.355278015 CEST	443	49766	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.417783022 CEST	443	49761	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:35.417882919 CEST	443	49761	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:35.417891979 CEST	443	49761	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:35.417948961 CEST	443	49761	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:35.417948961 CEST	49761	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:35.417978048 CEST	443	49761	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:35.418009996 CEST	49761	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:35.418039083 CEST	443	49761	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:35.418051958 CEST	49761	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:35.458563089 CEST	49761	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:35.458583117 CEST	443	49761	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:35.481205940 CEST	443	49763	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.481296062 CEST	443	49763	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.481453896 CEST	49763	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.482646942 CEST	443	49765	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.482723951 CEST	443	49765	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.482796907 CEST	49765	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.483477116 CEST	443	49764	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.483747959 CEST	443	49764	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.483797073 CEST	49764	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.487108946 CEST	443	49766	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.487179995 CEST	443	49766	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.487344980 CEST	49766	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.488703012 CEST	49763	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.488727093 CEST	443	49763	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.488739014 CEST	49763	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.488745928 CEST	443	49763	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.491306067 CEST	49765	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.491344929 CEST	443	49765	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.491365910 CEST	49765	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.491374016 CEST	443	49765	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.491408110 CEST	49766	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.491424084 CEST	443	49766	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.491455078 CEST	49766	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.491461992 CEST	443	49766	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.491743088 CEST	49764	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.491748095 CEST	443	49764	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.491775990 CEST	49764	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.491780996 CEST	443	49764	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.496424913 CEST	49767	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.496464968 CEST	443	49767	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.496572971 CEST	49767	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.498819113 CEST	49768	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.498852015 CEST	443	49768	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.498912096 CEST	49768	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.499047995 CEST	49769	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.499078035 CEST	443	49769	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.499155045 CEST	49769	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.501076937 CEST	49770	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.501096964 CEST	443	49770	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.501157045 CEST	49770	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.501343012 CEST	49767	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.501359940 CEST	443	49767	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.501898050 CEST	49768	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.501913071 CEST	443	49768	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.502353907 CEST	49769	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.502379894 CEST	443	49769	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.502418995 CEST	49770	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.502429962 CEST	443	49770	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.504436970 CEST	49761	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:35.536765099 CEST	443	49761	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:35.536817074 CEST	443	49761	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:35.536854029 CEST	443	49761	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:35.536926985 CEST	49761	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:35.536950111 CEST	443	49761	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:35.536962986 CEST	443	49761	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:35.537009001 CEST	49761	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:35.538206100 CEST	49761	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:35.538229942 CEST	443	49761	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:35.548227072 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:35.548273087 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:35.548353910 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:35.548445940 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:35.548480034 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:35.548541069 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:35.548954964 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:35.548986912 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:35.549112082 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:35.549115896 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:35.549138069 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:35.549339056 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:35.549355030 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:35.549467087 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:35.549479008 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:35.637521029 CEST	443	49762	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.638159990 CEST	49762	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.638183117 CEST	443	49762	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.638876915 CEST	49762	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.638881922 CEST	443	49762	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.825962067 CEST	443	49762	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.827982903 CEST	443	49762	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.832782030 CEST	49762	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.837101936 CEST	49762	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.837125063 CEST	443	49762	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.837150097 CEST	49762	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.837156057 CEST	443	49762	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.843839884 CEST	49776	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.843862057 CEST	443	49776	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:35.844070911 CEST	49776	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.844583035 CEST	49776	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:35.844597101 CEST	443	49776	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.156238079 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.157037020 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.157290936 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.157309055 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.157653093 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.157743931 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.157766104 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.158030987 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.158133984 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.158138037 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.158545971 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.158615112 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.158909082 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.159087896 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.160784006 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.165632963 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.165649891 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.169167042 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.169261932 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.170310974 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.170376062 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.170753002 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.170762062 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.199346066 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.203329086 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.224776983 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.234733105 CEST	443	49767	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.235549927 CEST	49767	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.235582113 CEST	443	49767	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.236121893 CEST	49767	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.236129999 CEST	443	49767	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.239499092 CEST	443	49768	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.239734888 CEST	443	49770	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.242856026 CEST	49768	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.242887020 CEST	443	49768	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.243082047 CEST	49770	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.243096113 CEST	443	49770	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.243318081 CEST	49768	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.243323088 CEST	443	49768	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.243587017 CEST	49770	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.243592024 CEST	443	49770	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.243957996 CEST	443	49769	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.244339943 CEST	49769	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.244360924 CEST	443	49769	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.244822025 CEST	49769	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.244827986 CEST	443	49769	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.308643103 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.308723927 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.308762074 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.308785915 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.308826923 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.308829069 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.308856010 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.308871984 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.308902025 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.308907032 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.308962107 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.309003115 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.309009075 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.309084892 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.309154034 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.309194088 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.309220076 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.309242010 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.309254885 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.309297085 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.309314966 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.309349060 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.309355021 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.309367895 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.309479952 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.309597969 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.320373058 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.320611954 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.320700884 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.320707083 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.320739031 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.320794106 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.320827961 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.320983887 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.321047068 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.321063995 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.321173906 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.321768999 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.321789980 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.350976944 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.350992918 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.351001024 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.351002932 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.366211891 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.367162943 CEST	443	49767	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.367283106 CEST	443	49767	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.368233919 CEST	49767	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.368280888 CEST	49767	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.368280888 CEST	49767	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.368298054 CEST	443	49767	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.368302107 CEST	443	49767	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.371438026 CEST	49778	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.371481895 CEST	443	49778	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.371798038 CEST	49778	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.371798038 CEST	49778	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.371843100 CEST	443	49778	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.372015953 CEST	443	49770	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.372160912 CEST	443	49768	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.372251987 CEST	443	49770	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.372380972 CEST	49770	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.372457027 CEST	443	49768	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.372574091 CEST	49768	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.372797012 CEST	49770	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.372812033 CEST	443	49770	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.372822046 CEST	49770	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.372827053 CEST	443	49770	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.373049974 CEST	49768	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.373054981 CEST	443	49768	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.373064041 CEST	49768	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.373066902 CEST	443	49768	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.376523972 CEST	49779	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.376549006 CEST	443	49779	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.376621008 CEST	49779	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.376744032 CEST	49779	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.376756907 CEST	443	49779	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.376979113 CEST	49780	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.377005100 CEST	443	49780	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.377093077 CEST	49780	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.377321005 CEST	49780	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.377346992 CEST	443	49780	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.378418922 CEST	443	49769	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.378567934 CEST	443	49769	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.378624916 CEST	49769	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.378648996 CEST	49769	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.378648996 CEST	49769	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.378664017 CEST	443	49769	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.378676891 CEST	443	49769	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.381273031 CEST	49781	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.381304979 CEST	443	49781	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.381436110 CEST	49781	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.382855892 CEST	49781	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.382868052 CEST	443	49781	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.395986080 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.396095037 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.425029993 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.425102949 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.425142050 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.425173044 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.425185919 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.425195932 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.425229073 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.425235987 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.425240040 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.425272942 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.425276995 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.425308943 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.426021099 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.426074028 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.426101923 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.426116943 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.426120996 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.426157951 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.426192999 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.426261902 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.426292896 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.426348925 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.426363945 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.426434040 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.426625967 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.426985025 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.427042007 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.427098036 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.427119017 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.427119970 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.427135944 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.427140951 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.427154064 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.427155972 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.427169085 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.427177906 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.427259922 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.427512884 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.427567959 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.427599907 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.427648067 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.427747011 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.427747011 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.427756071 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.427783966 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.427814960 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.427844048 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.427851915 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.427855968 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.427886009 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.428487062 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.428519964 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.428544998 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.428550959 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.428693056 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.428700924 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.429419994 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.429460049 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.429488897 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.429508924 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.429516077 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.429547071 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.436306000 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.436448097 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.436506033 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.436544895 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.436572075 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.436583996 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.436616898 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.436633110 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.437024117 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.437444925 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.437859058 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.437900066 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.437942028 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.437957048 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.438160896 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.438170910 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.438587904 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.438627958 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.438643932 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.438663006 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.438704014 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.438738108 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.438747883 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.439013004 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.439490080 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.439557076 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.442599058 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.442622900 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.467500925 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.481070042 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.481180906 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.481204987 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.483896017 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.530998945 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.541922092 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.541980028 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.542011976 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.542062044 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.542088032 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.542131901 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.542182922 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.542330027 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.542377949 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.542382956 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.542476892 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.542557955 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.542608976 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.542613983 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.542649984 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.542654037 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.543518066 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.543589115 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.543595076 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.543633938 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.543867111 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.543930054 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.544008017 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.544059038 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.544085026 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.544162035 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.544225931 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.544259071 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.544275045 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.544323921 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.544358969 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.544394016 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.544416904 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.544424057 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.544447899 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.544457912 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.544497967 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.544570923 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.544586897 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.544627905 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.544848919 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.544902086 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.544907093 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.544951916 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.544989109 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.545041084 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.545072079 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.545124054 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.545145035 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.545192957 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.545216084 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.545222998 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.545239925 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.545360088 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.545907021 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.545975924 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.546129942 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.546171904 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.546202898 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.546226978 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.546236038 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.546242952 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.546295881 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.546924114 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.546957016 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.546998978 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.547004938 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.547017097 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.547060013 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.547060013 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.547390938 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.547466040 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.547753096 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.547795057 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.547821999 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.547828913 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.547960043 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.547960043 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.548737049 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.548789978 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.548815012 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.548820972 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.548852921 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.548852921 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.553690910 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.553874969 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.553946972 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.553966045 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.553996086 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.554066896 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.554088116 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.554202080 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.554269075 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.554280043 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.554357052 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.554442883 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.554445028 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.554466963 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.554533958 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.554558992 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.554646969 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.554712057 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.554733038 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.554840088 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.555546999 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.555650949 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.555741072 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.555792093 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.555792093 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.555792093 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.555805922 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.555867910 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.556560040 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.556627989 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.556652069 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.557137966 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.557569027 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.557646990 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.557662010 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.557789087 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.558480978 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.558700085 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.575356960 CEST	443	49776	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.576525927 CEST	49776	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.576560020 CEST	443	49776	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.577254057 CEST	49776	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.577282906 CEST	443	49776	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.598217964 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.598300934 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.658813000 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.658906937 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.659102917 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.659149885 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.659152985 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.659162998 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.659198999 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.659415960 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.659466028 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.659472942 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.659512043 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.659599066 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.659646988 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.659686089 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.659730911 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.659774065 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.659823895 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.659854889 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.659904957 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.660309076 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.660350084 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.660367966 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.660372972 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.660397053 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.660408974 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.660412073 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.660423994 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.660449982 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.660506964 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.660548925 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.660552979 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.660592079 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.660634041 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.660675049 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.660679102 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.660686016 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.660717964 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.660720110 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.660729885 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.660758972 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.662142038 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.662177086 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.662435055 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.662440062 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.662440062 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.662452936 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.662488937 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.662547112 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.662667990 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.662686110 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.662856102 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.663196087 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.663325071 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.663408995 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.663451910 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.663549900 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.663578033 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.663662910 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.663662910 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.663669109 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.663683891 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.663757086 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.663758039 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.663764954 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.664132118 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.664185047 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.664199114 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.664288998 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.664458990 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.664571047 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.664577007 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.664587975 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.664633036 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.664633036 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.665230036 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.665287971 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.665306091 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.665313005 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.665352106 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.665352106 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.665402889 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.665433884 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.665448904 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.665456057 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.665501118 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.665501118 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.667859077 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.667896032 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.667936087 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.667942047 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.667967081 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.668118000 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.668154955 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.668164015 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.668169022 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.668200016 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.668205976 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.668247938 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.668252945 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.668294907 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.668507099 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.668556929 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.668627977 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.668668985 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.670522928 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.670578003 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.670628071 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.670628071 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.670631886 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.670672894 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.670675039 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.670701027 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.670711994 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.670711994 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.670718908 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.670761108 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.670804024 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.670820951 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.670828104 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.670828104 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.670845985 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.670856953 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.670861006 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.670931101 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.670948982 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.670955896 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.671013117 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.671123028 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.671204090 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.671214104 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.671231985 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.671257019 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.671278000 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.671300888 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.671500921 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.671559095 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.671569109 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.671665907 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.672045946 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.672116995 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.672147036 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.672164917 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.672180891 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.672295094 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.672295094 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.672295094 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.672307014 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.673677921 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.673748016 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.673755884 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.673836946 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.673863888 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.673913956 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.674119949 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.674170971 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.674190044 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.674196959 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.674241066 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.674393892 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.674439907 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.674489021 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.674542904 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.674551964 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.674551964 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.674551964 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.674561024 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.674591064 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.674602032 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.674660921 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.674660921 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.674694061 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.676309109 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.676565886 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.676592112 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.676640034 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.679781914 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.680062056 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.684447050 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.712188959 CEST	443	49776	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.712357998 CEST	443	49776	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.712435961 CEST	49776	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.712615013 CEST	49776	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.712615013 CEST	49776	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.712644100 CEST	443	49776	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.712667942 CEST	443	49776	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.715506077 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.715625048 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.716517925 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.716622114 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.716624022 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.718466997 CEST	49782	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.718504906 CEST	443	49782	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.718584061 CEST	49782	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.721111059 CEST	49782	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:36.721126080 CEST	443	49782	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:36.776340961 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.776469946 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.776493073 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.776541948 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.776593924 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.776645899 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.776721001 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.776779890 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.776829958 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.776882887 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.776998043 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.777050972 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.777101040 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.777153969 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.777318001 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.777385950 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.777811050 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.777856112 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.777873993 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.777883053 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.777919054 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.778346062 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.778388023 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.778422117 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.778426886 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.778464079 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.778486967 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.778891087 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.778943062 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.778968096 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.778971910 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.779002905 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.779020071 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.779736996 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.779803991 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.779838085 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.779885054 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.779933929 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.779933929 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.779947042 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.780116081 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.780200958 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.780242920 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.780242920 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.780253887 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.780419111 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.780472994 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.780481100 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.780509949 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.780534029 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.780553102 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.780596972 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.780729055 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.780803919 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.780813932 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.781142950 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.781162024 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.781196117 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.781236887 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.781236887 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.781244040 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.781804085 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.781826973 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.781884909 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.781898975 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.782407045 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.782423019 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.782604933 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.782615900 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.782860994 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.782876015 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.782952070 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.782952070 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.782958984 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.787486076 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.787568092 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.787646055 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.787750006 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.787765980 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.787781000 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.787806988 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.787863970 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.787957907 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.787987947 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.787998915 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.788060904 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.788080931 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.788168907 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.788189888 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.788280010 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.788305044 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.788398027 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.788481951 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.788547039 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.789031029 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.789069891 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.789119005 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.789119005 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.789132118 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.789621115 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.789663076 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.789794922 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.789794922 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.789808035 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.789989948 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.790038109 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.790062904 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.790072918 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.790124893 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.827053070 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.831104994 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.893115044 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.893141985 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.893199921 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.893229961 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.893259048 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.893276930 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.894328117 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.894345045 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.894393921 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.894407034 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.894432068 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.894452095 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.894593000 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.894608021 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.894695997 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.894702911 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.894736052 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.895014048 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.895032883 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.895068884 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.895078897 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.895102978 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.895117998 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.895227909 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.895243883 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.895289898 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.895294905 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.895354033 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.895625114 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.895641088 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.895672083 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.895679951 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.895704985 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.895721912 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.897667885 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.897694111 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.897758007 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.897780895 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.897799015 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.897937059 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.898241997 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.898271084 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.898330927 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.898344994 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.898380995 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.898380995 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.898612976 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.898631096 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.898713112 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.898713112 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.898736000 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.898960114 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.899228096 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.899245977 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.899295092 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.899334908 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.899418116 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.899620056 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.899642944 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.899760008 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.899775028 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.899883986 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.904486895 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.904556036 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.904609919 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.904630899 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.904655933 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.904731035 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.904891968 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.904933929 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.905011892 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.905011892 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.905029058 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.905078888 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.905491114 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.905540943 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.905572891 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.905580044 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.905601978 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.905627966 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.906064034 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.906105995 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.906191111 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.906191111 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.906203032 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.906259060 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.906492949 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.906539917 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.906583071 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.906589985 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.906635046 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.906707048 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.907046080 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.907095909 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.907176971 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.907176971 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.907186985 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:36.907286882 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:36.962966919 CEST	49783	443	192.168.2.7	172.217.18.4
Oct 24, 2024 09:15:36.963002920 CEST	443	49783	172.217.18.4	192.168.2.7
Oct 24, 2024 09:15:36.963057041 CEST	49783	443	192.168.2.7	172.217.18.4
Oct 24, 2024 09:15:36.963330984 CEST	49783	443	192.168.2.7	172.217.18.4
Oct 24, 2024 09:15:36.963344097 CEST	443	49783	172.217.18.4	192.168.2.7
Oct 24, 2024 09:15:37.010281086 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.010313988 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.010382891 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.010420084 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.010436058 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.010489941 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.011151075 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.011176109 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.011208057 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.011215925 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.011243105 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.011260986 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.011573076 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.011590004 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.011642933 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.011651993 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.011698961 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.011909962 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.011938095 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.011970997 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.011976957 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.012001038 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.012022972 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.012303114 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.012320995 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.012346029 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.012352943 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.012376070 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.012393951 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.012818098 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.012860060 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.012900114 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.012906075 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.012938023 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.012955904 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.014800072 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.014823914 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.014890909 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.014911890 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.015014887 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.015014887 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.015057087 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.015074015 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.015125990 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.015136003 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.015170097 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.015218019 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.015584946 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.015603065 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.015772104 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.015772104 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.015784025 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.015836954 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.016134977 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.016150951 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.016196012 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.016202927 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.016238928 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.016299009 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.016632080 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.016653061 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.016784906 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.016784906 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.016794920 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.016937017 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.017122984 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.017142057 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.017215014 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.017215014 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.017224073 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.017671108 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.017729044 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.017749071 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.017784119 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.017792940 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.017826080 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.017874956 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.021593094 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.021629095 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.021743059 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.021743059 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.021763086 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.021923065 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.022145033 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.022173882 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.022286892 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.022286892 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.022295952 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.022535086 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.022625923 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.022650003 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.022689104 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.022699118 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.022811890 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.022811890 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.023411989 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.023432970 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.023490906 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.023509979 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.023550034 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.023595095 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.023729086 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.023751974 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.023818970 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.023818970 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.023828030 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.023958921 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.024326086 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.024352074 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.024420977 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.024430037 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.024444103 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.024507046 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.068114996 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.068150997 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.068321943 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.068321943 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.068350077 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.068499088 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.107192039 CEST	443	49778	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:37.108428001 CEST	49778	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:37.108460903 CEST	443	49778	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:37.110199928 CEST	49778	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:37.110217094 CEST	443	49778	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:37.114375114 CEST	443	49780	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:37.115151882 CEST	49780	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:37.115181923 CEST	443	49780	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:37.115503073 CEST	49780	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:37.115509033 CEST	443	49780	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:37.117440939 CEST	443	49779	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:37.117809057 CEST	49779	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:37.117840052 CEST	443	49779	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:37.118170977 CEST	49779	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:37.118176937 CEST	443	49779	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:37.127283096 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.127321005 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.127402067 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.127429962 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.127486944 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.128037930 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.128055096 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.128108025 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.128113985 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.128156900 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.128530979 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.128546000 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.128592014 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.128597975 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.128633976 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.129812956 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.129831076 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.129893064 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.129898071 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.129942894 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.130676985 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.130697966 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.130778074 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.130783081 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.130820036 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.130863905 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.130881071 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.130929947 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.130934954 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.130973101 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.131186962 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.131206036 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.131263971 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.131268978 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.131321907 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.131787062 CEST	443	49781	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:37.132783890 CEST	49781	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:37.132798910 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.132814884 CEST	443	49781	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:37.132819891 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.132981062 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.132981062 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.132998943 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.133210897 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.133235931 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.133245945 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.133255005 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.133526087 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.133543015 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.133589983 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.133589983 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.133589983 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.133603096 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.133681059 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.134151936 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.134171009 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.134207010 CEST	49781	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:37.134217978 CEST	443	49781	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:37.134233952 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.134252071 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.134402990 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.134535074 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.134552002 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.134967089 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.134995937 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.135006905 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.135164022 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.135164022 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.139149904 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.139183044 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.139339924 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.139339924 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.139384985 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.139579058 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.139604092 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.140129089 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.140155077 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.140268087 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.140268087 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.140268087 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.140268087 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.140305996 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.140683889 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.140708923 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.140902042 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.140919924 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.141793966 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.141793966 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.141813040 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.143336058 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.183244944 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.183279037 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.183366060 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.183399916 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.183543921 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.243983984 CEST	443	49780	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:37.244209051 CEST	443	49780	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:37.244297981 CEST	49780	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:37.244499922 CEST	49780	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:37.244499922 CEST	49780	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:37.244518995 CEST	443	49780	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:37.244532108 CEST	443	49780	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:37.244730949 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.244765997 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.244806051 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.244834900 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.244848967 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.244965076 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.246565104 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.246591091 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.246659994 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.246685982 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.246823072 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.246849060 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.246879101 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.246886015 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.246910095 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.246953964 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.247265100 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.247284889 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.247330904 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.247339010 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.247354031 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.247380972 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.247503042 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.247523069 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.247569084 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.247574091 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.247615099 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.247792959 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.247812986 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.247850895 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.247855902 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.247900009 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.248141050 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.248161077 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.248205900 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.248210907 CEST	443	49772	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.248233080 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.248250008 CEST	49772	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.249017954 CEST	443	49779	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:37.249090910 CEST	443	49779	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:37.249150038 CEST	49779	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:37.249748945 CEST	49779	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:37.249768019 CEST	443	49779	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:37.249963999 CEST	49784	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:37.250011921 CEST	443	49784	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:37.250104904 CEST	49784	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:37.250490904 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.250516891 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.250679970 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.250696898 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.250705957 CEST	49784	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:37.250710964 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.250720978 CEST	443	49784	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:37.250732899 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.250797987 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.250813007 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.250833035 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.250884056 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.251104116 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.251122952 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.251183033 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.251189947 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.251250029 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.251457930 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.251476049 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.251513958 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.251532078 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.251569986 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.251667023 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.251740932 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.251760006 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.251957893 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.251957893 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.251966000 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.252046108 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.252180099 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.252192974 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.252317905 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.252326012 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.252377033 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.252641916 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.252660990 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.252810955 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.252810955 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.252820015 CEST	443	49771	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.252852917 CEST	49771	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.255637884 CEST	49785	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:37.255673885 CEST	443	49785	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:37.255810976 CEST	49785	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:37.255974054 CEST	49785	443	192.168.2.7	13.107.246.51
Oct 24, 2024 09:15:37.255987883 CEST	443	49785	13.107.246.51	192.168.2.7
Oct 24, 2024 09:15:37.256346941 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.256380081 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.256458998 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.256458998 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.256474972 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.256561995 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.256576061 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.256602049 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.256639004 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.256685019 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.256691933 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.256746054 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.256932020 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.256956100 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.256999969 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.257009029 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.257028103 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.257124901 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.257709026 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.257730961 CEST	443	49773	162.159.136.232	192.168.2.7
Oct 24, 2024 09:15:37.257780075 CEST	49773	443	192.168.2.7	162.159.136.232
Oct 24, 2024 09:15:37.257788897 CEST	443	49773	162.159.136.232	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 09:15:20.802313089 CEST	192.168.2.7	1.1.1.1	0x543a	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:28.118447065 CEST	192.168.2.7	1.1.1.1	0x9fcf	Standard query (0)	keyauth.win	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:33.132373095 CEST	192.168.2.7	1.1.1.1	0xab54	Standard query (0)	discord.gg	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:33.132597923 CEST	192.168.2.7	1.1.1.1	0x2333	Standard query (0)	discord.gg	65	IN (0x0001)	false
Oct 24, 2024 09:15:34.483402967 CEST	192.168.2.7	1.1.1.1	0x1e47	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:34.483586073 CEST	192.168.2.7	1.1.1.1	0x5891	Standard query (0)	discord.com	65	IN (0x0001)	false
Oct 24, 2024 09:15:36.953818083 CEST	192.168.2.7	1.1.1.1	0x7d0a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:36.953986883 CEST	192.168.2.7	1.1.1.1	0x85ec	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 24, 2024 09:15:38.061568975 CEST	192.168.2.7	1.1.1.1	0x7d1e	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:38.061902046 CEST	192.168.2.7	1.1.1.1	0x7bf0	Standard query (0)	discord.com	65	IN (0x0001)	false
Oct 24, 2024 09:15:45.131437063 CEST	192.168.2.7	1.1.1.1	0xe3b2	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:45.131800890 CEST	192.168.2.7	1.1.1.1	0x46f3	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Oct 24, 2024 09:15:52.338552952 CEST	192.168.2.7	1.1.1.1	0xb572	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:52.338685036 CEST	192.168.2.7	1.1.1.1	0x60b0	Standard query (0)	cdn.discordapp.com	65	IN (0x0001)	false
Oct 24, 2024 09:15:53.862813950 CEST	192.168.2.7	1.1.1.1	0x1827	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:53.862984896 CEST	192.168.2.7	1.1.1.1	0x9457	Standard query (0)	cdn.discordapp.com	65	IN (0x0001)	false
Oct 24, 2024 09:16:45.142179966 CEST	192.168.2.7	1.1.1.1	0x6be2	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:45.142647028 CEST	192.168.2.7	1.1.1.1	0x1c23	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 24, 2024 09:15:20.812036991 CEST	1.1.1.1	192.168.2.7	0x543a	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 09:15:22.317603111 CEST	1.1.1.1	192.168.2.7	0x28e3	No error (0)	shed.dual-low.s-part-0023.t-0009.t-msedge.net	s-part-0023.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 09:15:22.317603111 CEST	1.1.1.1	192.168.2.7	0x28e3	No error (0)	s-part-0023.t-0009.t-msedge.net		13.107.246.51	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:28.127264977 CEST	1.1.1.1	192.168.2.7	0x9fcf	No error (0)	keyauth.win		104.26.0.5	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:28.127264977 CEST	1.1.1.1	192.168.2.7	0x9fcf	No error (0)	keyauth.win		104.26.1.5	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:28.127264977 CEST	1.1.1.1	192.168.2.7	0x9fcf	No error (0)	keyauth.win		172.67.72.57	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:33.706012964 CEST	1.1.1.1	192.168.2.7	0xab54	No error (0)	discord.gg		162.159.135.234	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:33.706012964 CEST	1.1.1.1	192.168.2.7	0xab54	No error (0)	discord.gg		162.159.130.234	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:33.706012964 CEST	1.1.1.1	192.168.2.7	0xab54	No error (0)	discord.gg		162.159.133.234	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:33.706012964 CEST	1.1.1.1	192.168.2.7	0xab54	No error (0)	discord.gg		162.159.134.234	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:33.706012964 CEST	1.1.1.1	192.168.2.7	0xab54	No error (0)	discord.gg		162.159.136.234	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:33.707077980 CEST	1.1.1.1	192.168.2.7	0x2333	No error (0)	discord.gg			65	IN (0x0001)	false
Oct 24, 2024 09:15:34.490704060 CEST	1.1.1.1	192.168.2.7	0x1e47	No error (0)	discord.com		162.159.136.232	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:34.490704060 CEST	1.1.1.1	192.168.2.7	0x1e47	No error (0)	discord.com		162.159.135.232	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:34.490704060 CEST	1.1.1.1	192.168.2.7	0x1e47	No error (0)	discord.com		162.159.137.232	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:34.490704060 CEST	1.1.1.1	192.168.2.7	0x1e47	No error (0)	discord.com		162.159.138.232	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:34.490704060 CEST	1.1.1.1	192.168.2.7	0x1e47	No error (0)	discord.com		162.159.128.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:34.490726948 CEST	1.1.1.1	192.168.2.7	0x5891	No error (0)	discord.com			65	IN (0x0001)	false
Oct 24, 2024 09:15:36.961221933 CEST	1.1.1.1	192.168.2.7	0x7d0a	No error (0)	www.google.com		172.217.18.4	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:36.961951017 CEST	1.1.1.1	192.168.2.7	0x85ec	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 24, 2024 09:15:38.070373058 CEST	1.1.1.1	192.168.2.7	0x7d1e	No error (0)	discord.com		162.159.138.232	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:38.070373058 CEST	1.1.1.1	192.168.2.7	0x7d1e	No error (0)	discord.com		162.159.136.232	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:38.070373058 CEST	1.1.1.1	192.168.2.7	0x7d1e	No error (0)	discord.com		162.159.128.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:38.070373058 CEST	1.1.1.1	192.168.2.7	0x7d1e	No error (0)	discord.com		162.159.135.232	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:38.070373058 CEST	1.1.1.1	192.168.2.7	0x7d1e	No error (0)	discord.com		162.159.137.232	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:38.070847988 CEST	1.1.1.1	192.168.2.7	0x7bf0	No error (0)	discord.com			65	IN (0x0001)	false
Oct 24, 2024 09:15:45.138771057 CEST	1.1.1.1	192.168.2.7	0xe3b2	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:52.350053072 CEST	1.1.1.1	192.168.2.7	0x60b0	No error (0)	cdn.discordapp.com			65	IN (0x0001)	false
Oct 24, 2024 09:15:52.350193977 CEST	1.1.1.1	192.168.2.7	0xb572	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:52.350193977 CEST	1.1.1.1	192.168.2.7	0xb572	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:52.350193977 CEST	1.1.1.1	192.168.2.7	0xb572	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:52.350193977 CEST	1.1.1.1	192.168.2.7	0xb572	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:52.350193977 CEST	1.1.1.1	192.168.2.7	0xb572	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:53.870387077 CEST	1.1.1.1	192.168.2.7	0x1827	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:53.870387077 CEST	1.1.1.1	192.168.2.7	0x1827	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:53.870387077 CEST	1.1.1.1	192.168.2.7	0x1827	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:53.870387077 CEST	1.1.1.1	192.168.2.7	0x1827	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:53.870387077 CEST	1.1.1.1	192.168.2.7	0x1827	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:15:53.870568037 CEST	1.1.1.1	192.168.2.7	0x9457	No error (0)	cdn.discordapp.com			65	IN (0x0001)	false
Oct 24, 2024 09:16:45.149584055 CEST	1.1.1.1	192.168.2.7	0x6be2	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.7	49708	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:23 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:23 UTC	540	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:23 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 21 Oct 2024 13:21:21 GMT ETag: "0x8DCF1D34132B902" x-ms-request-id: 89fa8e61-601e-0070-0c14-24a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071523Z-r197bdfb6b4r9fwfbdwymmgex8000000015g0000000023k1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:23 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-24 07:15:23 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-24 07:15:23 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-24 07:15:23 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-24 07:15:23 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-24 07:15:23 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-24 07:15:23 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-24 07:15:23 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-24 07:15:23 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-24 07:15:23 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.7	49711	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:24 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:24 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:24 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 394abe64-001e-0028-050b-22c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071524Z-16849878b78mhkkf6kbvry07q000000007900000000067pv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:24 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.7	49713	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:24 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:24 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 31a53d7e-801e-00a3-74f7-217cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071524Z-16849878b782558xg5kpzay6es00000007dg000000001kpp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:24 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.7	49710	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:24 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:24 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 084b2ff6-801e-0067-68fd-24fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071524Z-r197bdfb6b46gt25anfa5gg2fw00000002wg000000006tzz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:24 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.7	49712	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:24 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:24 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:24 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 1cf92a68-e01e-000c-57f4-248e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071524Z-r197bdfb6b4vlqfn9hfre6k1s80000000c8g0000000020a7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:24 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.7	49709	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:24 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:24 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:24 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 331d1c77-401e-0029-354e-229b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071524Z-16849878b789m94j7902zfvfr0000000079g000000004mgp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:15:24 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.7	49716	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:25 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:25 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:25 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 8d314a1c-701e-0097-3ae5-21b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071525Z-16849878b78fmrkt2ukpvh9wh4000000079000000000awas x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:25 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.7	49714	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:25 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:25 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 1041074d-101e-0034-30b5-2596ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071525Z-16849878b78c5zx4gw8tcga1b4000000078g000000007he1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:25 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.7	49715	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:25 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:25 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:25 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: e1deb6d3-201e-006e-700b-22bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071525Z-16849878b78x6gn56mgecg60qc00000000f0000000001802 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.7	49717	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:25 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:25 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 13d0e6d2-b01e-0053-47f4-24cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071525Z-15b8d89586fmhkw4gksnr1w3ds0000000e4g0000000016xd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:25 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.7	49718	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:25 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:25 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:25 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: b0d76b6d-d01e-002b-3e84-2525fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071525Z-16849878b78dsttbr1qw36rxs8000000079g00000000f7k8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:25 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.7	49721	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:27 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:27 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:27 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 1b2fb3ba-201e-0033-65ce-20b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071527Z-16849878b787psctgubawhx7k8000000073g00000000fb1c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:27 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.7	49723	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:27 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:27 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:27 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 7de7ed35-901e-005b-7c14-222005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071527Z-16849878b785g992cz2s9gk35c00000007fg000000001dve x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:27 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.7	49722	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:27 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:27 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 7d84539c-601e-00ab-7af2-2466f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071527Z-r197bdfb6b4sn8wg20e97vn7ps0000000nxg000000009g1w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:27 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.7	49719	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:27 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:27 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 084af2c2-c01e-0079-58fc-24e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071527Z-r197bdfb6b4kkrkjudg185sarw00000001e000000000985u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:27 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.7	49720	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:27 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:27 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:27 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 13862abc-a01e-0053-5aa2-218603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071527Z-16849878b78c2tmb7nhatnd68s00000007c00000000097m7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:27 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.7	49724	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:28 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:28 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 1a83195d-f01e-0071-40f5-24431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071528Z-r197bdfb6b4kq4j5t834fh90qn0000000ak0000000000zqu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:28 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.7	49727	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:28 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:28 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:28 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: ec40f21c-901e-0067-494d-22b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071528Z-16849878b78q4pnrt955f8nkx800000007c00000000003r9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:28 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.7	49726	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:28 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:28 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:28 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 4cd68789-d01e-0017-448e-21b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071528Z-16849878b78k8q5pxkgux3mbgg000000077000000000g7ev x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:28 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.7	49728	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:28 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:28 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 968807c2-e01e-0052-0805-22d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071528Z-16849878b784cpcc2dr9ch74ng00000007h0000000002vw5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:28 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.7	49725	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:28 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 04b89afe-e01e-0003-7c15-250fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071528Z-r197bdfb6b4k6h5j1g5mvtmsmn0000000bug000000002gsr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:28 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	49733	104.26.0.5	443	7456	C:\Users\user\Desktop\xxImTScxAq.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:28 UTC	128	OUT	POST /api/1.1/ HTTP/1.1 Host: keyauth.win Accept: / Content-Length: 58 Content-Type: application/x-www-form-urlencoded
2024-10-24 07:15:28 UTC	58	OUT	Data Raw: 74 79 70 65 3d 69 6e 69 74 26 76 65 72 3d 38 2e 33 26 6e 61 6d 65 3d 6c 6f 61 64 65 72 20 70 72 69 6e 63 69 70 61 6c 26 6f 77 6e 65 72 69 64 3d 39 57 49 76 54 56 4a 61 39 6d Data Ascii: type=init&ver=8.3&name=loader principal&ownerid=9WIvTVJa9m
2024-10-24 07:15:29 UTC	1111	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:29 GMT Content-Type: application/json; charset=UTF-8 Content-Length: 121 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LcOyQ8tcBBS1G4Ge8AcKNBR8%2FPj1qSqw7No0BrlmW3OhJ66Q17SdiSlpzr%2BjBPhWHIc3K%2FzHphM0IKw8c489GdI3lR16hLg84mm0WUYMqNyxjhGhZyk%2Fxgj5PwWE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Acknowledge: Credit to VaultCord.com X-Powered-By: VaultCord.com content-security-policy: upgrade-insecure-requests permissions-policy: accelerometer=(), camera=(), fullscreen=, geolocation=(self), gyroscope=(), microphone=(), payment= referrer-policy: strict-origin-when-cross-origin strict-transport-security: max-age=31536000; includeSubDomains x-content-security-policy: img-src ; media-src data:; x-content-type-options: nosniff x-frame-options: DENY x-xss-protection: 1; mode=block Access-Control-Allow-Headers: * Access-Control-Allow-Methods: * Access-Control-Allow-Origin: * Server: cloudflare CF-RAY: 8d782d0a3f6d4632-DFW
2024-10-24 07:15:29 UTC	121	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 22 3a 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 69 6e 76 61 6c 69 64 76 65 72 22 2c 22 64 6f 77 6e 6c 6f 61 64 22 3a 22 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 2e 67 67 2f 70 72 69 76 61 74 65 63 6f 6d 6d 75 6e 69 74 79 22 2c 22 6f 77 6e 65 72 69 64 22 3a 22 39 57 49 76 54 56 4a 61 39 6d 22 7d Data Ascii: {"success":false,"code":0,"message":"invalidver","download":"https://discord.gg/privatecommunity","ownerid":"9WIvTVJa9m"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.7	49734	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:29 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: ab91094f-501e-008f-72f7-219054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071529Z-16849878b78gvgmlcfru6nuc54000000076g00000000hhkx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.7	49735	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:29 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:29 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 5fceb8c4-d01e-008e-7050-23387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071529Z-r197bdfb6b42sc4ddemybqpm140000000p2g0000000066t4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:29 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.7	49736	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:29 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:29 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 5074b8ce-701e-005c-627a-25bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071529Z-15b8d89586flzzks5bs37v2b9000000002x0000000009yv5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:29 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.7	49737	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:29 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:29 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:29 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 00f7314e-e01e-0052-48ac-21d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071529Z-16849878b78fmrkt2ukpvh9wh4000000079g00000000abzv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:29 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.7	49738	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:29 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:29 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:29 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: e5cf95c3-101e-0046-32f2-2491b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071529Z-15b8d89586fs9clcgrr6f2d6vg000000018000000000df5b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:15:29 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.7	49739	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:30 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:31 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 33373380-a01e-003d-4cf5-2498d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071531Z-15b8d89586fwzdd8urmg0p1ebs00000008wg000000007uxu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:31 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.7	49742	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:30 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:31 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 26284338-e01e-0052-664d-22d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071530Z-16849878b78k8q5pxkgux3mbgg000000076g00000000hhbd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.7	49740	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:30 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:31 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:31 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 3cf1b782-701e-0001-32e5-21b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071531Z-16849878b78dkr6tqerbnpg1zc00000007a000000000e5mr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:31 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.7	49741	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:30 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:31 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: ff77512b-301e-000c-17f4-24323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071531Z-15b8d89586fnsf5zm1ryrxu0bc00000002z0000000001mam x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:31 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.7	49743	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:30 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:31 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 999b7e79-701e-001e-6bf4-24f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071531Z-r197bdfb6b4sn8wg20e97vn7ps0000000nug00000000h9ms x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:31 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.7	49744	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:31 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:31 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: e79f0600-d01e-00ad-4ef2-24e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071531Z-15b8d89586fhl2qtatrz3vfkf000000004d000000000cv7z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:31 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.7	49745	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:31 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:31 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 1f9c3bb8-d01e-0014-220b-22ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071531Z-16849878b78q4pnrt955f8nkx8000000076000000000dqaa x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.7	49746	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:31 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:31 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 46af3d48-701e-0032-6627-21a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071531Z-16849878b78hz7zj8u0h2zng1400000007k0000000000szp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:31 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.7	49747	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:31 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:31 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:31 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 27632888-301e-0096-61d8-21e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071531Z-16849878b78rjhv97f3nhawr7s000000078g00000000c43x x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:31 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.7	49748	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:31 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:31 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:31 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: b13276b3-c01e-00a2-52fc-242327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071531Z-r197bdfb6b42sc4ddemybqpm140000000p0000000000btfh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:31 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.7	49760	162.159.135.234	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:34 UTC	669	OUT	GET /privatecommunity HTTP/1.1 Host: discord.gg Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 07:15:34 UTC	853	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 24 Oct 2024 07:15:34 GMT Content-Type: text/plain;charset=UTF-8 Content-Length: 0 Connection: close Location: https://discord.com/invite/privatecommunity Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FkVdl8i2f5lPwOTm5SWWjMVtOk305tEkXrqWMgztoz77gYtFRj88Shsw%2F%2FP%2FbZhi9BN%2BLIlx8oTfAwdu5P6tDgVGCE6Nov9q673SEyLBcaUnjDwgL%2Fh1fKORArI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d782d2c08992d2b-DFW

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.7	49753	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:34 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:34 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:34 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 6764be4f-301e-0099-1efc-246683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071534Z-r197bdfb6b4ld6jc5asqwvvz0w000000018g00000000dfbn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:34 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.7	49752	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:34 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:34 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:34 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 07f9ef03-d01e-0014-614d-22ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071534Z-16849878b78dghrpt8v731n7r4000000077g000000009rqp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:15:34 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.7	49750	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:34 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:34 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 221e1266-901e-0016-4cfc-24efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071534Z-r197bdfb6b4kkrkjudg185sarw00000001fg000000004z4g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:34 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.7	49749	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:34 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:34 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:34 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 3f3879b0-501e-0035-0b40-22c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071534Z-16849878b786wvrz321uz1cknn000000078g00000000mt8v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:34 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.7	49751	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:34 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:34 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 6177d94c-d01e-0028-6bfc-247896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071534Z-r197bdfb6b4t7wszdvrfk02ah4000000090g000000000hca x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:34 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.7	49761	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:35 UTC	677	OUT	GET /invite/privatecommunity HTTP/1.1 Host: discord.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 07:15:35 UTC	497	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Ray: 8d782d30f89d28ab-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Cache-Control: private Last-Modified: Thu, 24 Oct 2024 03:15:21 GMT Set-Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; Expires=Tue, 23 Oct 2029 07:15:35 GMT; Max-Age=157680000; Path=/; Secure; HttpOnly; SameSite=Lax Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2024-10-24 07:15:35 UTC	5202	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 73 65 6c 66 27 3b 20 73 63 72 69 70 74 2d 73 72 63 20 27 73 65 6c 66 27 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 6e 6f 6e 63 65 2d 4d 6a 41 35 4c 44 63 31 4c 44 59 30 4c 44 45 32 4e 43 77 79 4d 6a 51 73 4d 54 51 78 4c 44 45 77 4c 44 6b 32 27 20 62 6c 6f 62 3a 20 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 61 6e 69 6d 61 74 69 6f 6e 73 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 20 68 74 74 Data Ascii: Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline' 'nonce-MjA5LDc1LDY0LDE2NCwyMjQsMTQxLDEwLDk2' blob: https://cdn.discordapp.com/animations/ https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ htt
2024-10-24 07:15:35 UTC	1369	IN	Data Raw: 32 64 37 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 33 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 43 68 65 63 6b 20 6f 75 74 20 74 68 65 20 f0 9d 90 8f f0 9d 90 91 f0 9d 90 88 f0 9d 90 95 f0 9d 90 80 f0 9d 90 93 f0 9d 90 84 20 f0 9d 90 92 f0 9d 90 93 f0 9d 90 8e f0 9d 90 91 f0 9d 90 84 20 f0 9f 94 90 20 63 6f Data Ascii: 2d77<!DOCTYPE html><html><head> <meta charset="utf-8"> <meta content="width=device-width,initial-scale=1,maximum-scale=3" name="viewport"><meta name="description" content="Check out the co
2024-10-24 07:15:35 UTC	1369	IN	Data Raw: 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 3a 61 6c 74 65 72 6e 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6c 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 3a 61 6c 74 65 72 6e 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 70 74 2d 42 52 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 3a 61 6c 74 65 72 6e 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 72 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 2d 55 53 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 3a 61 6c 74 65 72 6e 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 6c Data Ascii: <meta property="og:locale:alternate" content="el" /><meta property="og:locale:alternate" content="pt-BR" /><meta property="og:locale:alternate" content="tr" /><meta property="og:locale" content="en-US" /><meta property="og:locale:alternate" content="l
2024-10-24 07:15:35 UTC	1369	IN	Data Raw: 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 75 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 3a 61 6c 74 65 72 6e 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 63 73 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 3a 61 6c 74 65 72 6e 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 73 76 2d 53 45 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 3a 61 6c 74 65 72 6e 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6c 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 3a 61 6c 74 65 72 6e 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 66 72 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a Data Ascii: ate" content="hu" /><meta property="og:locale:alternate" content="cs" /><meta property="og:locale:alternate" content="sv-SE" /><meta property="og:locale:alternate" content="nl" /><meta property="og:locale:alternate" content="fr" /><meta property="og:
2024-10-24 07:15:35 UTC	1369	IN	Data Raw: 64 2e 63 6f 6d 2f 69 6e 76 69 74 65 2f 70 72 69 76 61 74 65 63 6f 6d 6d 75 6e 69 74 79 3f 6c 6f 63 61 6c 65 3d 6a 61 22 20 2f 3e 0a 3c 6d 65 74 61 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 6c 61 6e 67 3d 22 65 73 2d 45 53 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 69 6e 76 69 74 65 2f 70 72 69 76 61 74 65 63 6f 6d 6d 75 6e 69 74 79 3f 6c 6f 63 61 6c 65 3d 65 73 2d 45 53 22 20 2f 3e 0a 3c 6d 65 74 61 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 6c 61 6e 67 3d 22 69 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 69 6e 76 69 74 65 2f 70 72 69 76 61 74 65 63 6f 6d 6d 75 6e 69 74 79 3f 6c 6f 63 61 6c 65 3d 69 74 22 20 2f 3e 0a 3c 6d 65 74 61 Data Ascii: d.com/invite/privatecommunity?locale=ja" /><meta rel="alternate" hreflang="es-ES" href="https://discord.com/invite/privatecommunity?locale=es-ES" /><meta rel="alternate" hreflang="it" href="https://discord.com/invite/privatecommunity?locale=it" /><meta
2024-10-24 07:15:35 UTC	1369	IN	Data Raw: 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 6c 61 6e 67 3d 22 74 68 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 69 6e 76 69 74 65 2f 70 72 69 76 61 74 65 63 6f 6d 6d 75 6e 69 74 79 3f 6c 6f 63 61 6c 65 3d 74 68 22 20 2f 3e 0a 3c 6d 65 74 61 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 69 6e 76 69 74 65 2f 70 72 69 76 61 74 65 63 6f 6d 6d 75 6e 69 74 79 3f 6c 6f 63 61 6c 65 3d 65 6e 2d 47 42 22 20 2f 3e 0a 3c 6d 65 74 61 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 6c 61 6e 67 3d 22 6b 6f 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 69 73 63 Data Ascii: rel="alternate" hreflang="th" href="https://discord.com/invite/privatecommunity?locale=th" /><meta rel="alternate" hreflang="en-GB" href="https://discord.com/invite/privatecommunity?locale=en-GB" /><meta rel="alternate" hreflang="ko" href="https://disc
2024-10-24 07:15:35 UTC	1369	IN	Data Raw: 67 3a 69 6d 61 67 65 3a 68 65 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 35 31 32 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 73 70 6c 61 73 68 65 73 2f 31 32 33 30 32 32 37 38 34 32 38 37 37 36 32 30 33 35 39 2f 30 34 62 35 38 62 35 64 38 63 38 36 33 39 36 32 63 63 64 61 63 33 30 35 65 35 65 65 31 32 36 39 2e 6a 70 67 3f 73 69 7a 65 3d 35 31 32 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 6f 6f 67 6c 65 62 6f 74 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 62 69 6e 67 62 6f 74 22 20 63 Data Ascii: g:image:height" content="512" /><meta property="twitter:image" content="https://cdn.discordapp.com/splashes/1230227842877620359/04b58b5d8c863962ccdac305e5ee1269.jpg?size=512" /><meta name="googlebot" content="noindex, nofollow" /><meta name="bingbot" c
2024-10-24 07:15:35 UTC	1369	IN	Data Raw: 0a 20 20 20 20 20 20 43 44 4e 5f 48 4f 53 54 3a 20 27 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 27 2c 0a 20 20 20 20 20 20 41 53 53 45 54 5f 45 4e 44 50 4f 49 4e 54 3a 20 27 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 27 2c 0a 20 20 20 20 20 20 4d 45 44 49 41 5f 50 52 4f 58 59 5f 45 4e 44 50 4f 49 4e 54 3a 20 27 2f 2f 6d 65 64 69 61 2e 64 69 73 63 6f 72 64 61 70 70 2e 6e 65 74 27 2c 0a 20 20 20 20 20 20 57 49 44 47 45 54 5f 45 4e 44 50 4f 49 4e 54 3a 20 27 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 77 69 64 67 65 74 27 2c 0a 20 20 20 20 20 20 49 4e 56 49 54 45 5f 48 4f 53 54 3a 20 27 64 69 73 63 6f 72 64 2e 67 67 27 2c 0a 20 20 20 20 20 20 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 5f 48 4f 53 54 3a 20 27 64 69 73 63 6f 72 64 2e 6e 65 77 27 2c 0a 20 Data Ascii: CDN_HOST: 'cdn.discordapp.com', ASSET_ENDPOINT: '//discord.com', MEDIA_PROXY_ENDPOINT: '//media.discordapp.net', WIDGET_ENDPOINT: '//discord.com/widget', INVITE_HOST: 'discord.gg', GUILD_TEMPLATE_HOST: 'discord.new',
2024-10-24 07:15:35 UTC	1369	IN	Data Raw: 75 6c 6c 3d 3d 6f 3f 6e 75 6c 6c 3a 4a 53 4f 4e 2e 70 61 72 73 65 28 6f 29 7d 63 61 74 63 68 28 6e 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 7d 28 22 74 6f 6b 65 6e 22 29 26 26 21 77 69 6e 64 6f 77 2e 5f 5f 4f 56 45 52 4c 41 59 5f 5f 29 7b 76 61 72 20 6e 3d 6e 75 6c 6c 21 3d 77 69 6e 64 6f 77 2e 44 69 73 63 6f 72 64 4e 61 74 69 76 65 7c 7c 6e 75 6c 6c 21 3d 77 69 6e 64 6f 77 2e 72 65 71 75 69 72 65 3f 22 65 74 66 22 3a 22 6a 73 6f 6e 22 2c 6f 3d 77 69 6e 64 6f 77 2e 47 4c 4f 42 41 4c 5f 45 4e 56 2e 47 41 54 45 57 41 59 5f 45 4e 44 50 4f 49 4e 54 2b 22 2f 3f 65 6e 63 6f 64 69 6e 67 3d 22 2b 6e 2b 22 26 76 3d 22 2b 77 69 6e 64 6f 77 2e 47 4c 4f 42 41 4c 5f 45 4e 56 2e 41 50 49 5f 56 45 52 53 49 4f 4e 3b 6e 75 6c 6c 21 3d 77 69 6e 64 6f 77 2e 44 69 73 63 6f Data Ascii: ull==o?null:JSON.parse(o)}catch(n){return null}}("token")&&!window.__OVERLAY__){var n=null!=window.DiscordNative\|\|null!=window.require?"etf":"json",o=window.GLOBAL_ENV.GATEWAY_ENDPOINT+"/?encoding="+n+"&v="+window.GLOBAL_ENV.API_VERSION;null!=window.Disco
2024-10-24 07:15:35 UTC	695	IN	Data Raw: 2e 73 72 63 3d 27 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 73 63 72 69 70 74 73 2f 6a 73 64 2f 6d 61 69 6e 2e 6a 73 27 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 3b 22 3b 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 64 29 7d 7d 69 66 28 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 29 7b 76 61 72 20 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 69 66 72 61 6d 65 27 29 3b 61 2e 68 65 69 67 68 74 3d 31 3b 61 2e 77 69 64 74 68 3d 31 3b 61 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 Data Ascii: .src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.positi

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.7	49765	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:35 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:35 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:35 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: d4d27aa7-601e-0002-1812-22a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071535Z-16849878b785g992cz2s9gk35c000000079g00000000euqd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:35 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.7	49764	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:35 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:35 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:35 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: a706a42d-501e-008c-4ef2-24cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071535Z-r197bdfb6b4vlqfn9hfre6k1s80000000c3000000000f5fp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:35 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.7	49763	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:35 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:35 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:35 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 71363f0e-d01e-0065-7af4-24b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071535Z-r197bdfb6b429k2s6br3k49qn400000004mg000000004gds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:35 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.7	49766	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:35 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:35 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:35 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: b92258e0-a01e-00ab-2aab-219106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071535Z-16849878b78dghrpt8v731n7r4000000075g00000000ea92 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:35 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.7	49762	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:35 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:35 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:35 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: e5dab064-101e-0046-04f5-2491b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071535Z-r197bdfb6b4sn8wg20e97vn7ps0000000nx000000000asrf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:15:35 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.7	49772	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:36 UTC	889	OUT	GET /assets/69646.2af8e3f2e60b2cca1cbf.css HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:36 UTC	957	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:36 GMT Content-Type: text/css Content-Length: 1189139 Connection: close CF-Ray: 8d782d3768166c34-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "7b173af12aa2176b69d5656709649ab1" Last-Modified: Wed, 23 Oct 2024 17:23:22 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JeUt5GZzP8rqcYo9TMJY9XhXrEWr8a%2F9paexE42EcmlNABgm4JvWssv1XqUXkxCW%2BJZLmFkcREvzeV7CsjbQsWQMfTy%2BdQHUASKfs5LPyOv8dDRNPrz5qc6kImTB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:36 UTC	412	IN	Data Raw: 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 6e 65 72 2d 77 61 6e 64 65 72 69 6e 67 2d 63 75 62 65 73 5f 62 36 64 62 32 30 7b 32 35 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 78 28 32 32 70 78 29 72 6f 74 61 74 65 28 2d 39 30 64 65 67 29 73 63 61 6c 65 28 2e 35 29 7d 35 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 78 28 32 32 70 78 29 74 72 61 6e 73 6c 61 74 65 79 28 32 32 70 78 29 72 6f 74 61 74 65 28 2d 31 38 30 64 65 67 29 7d 37 35 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 78 28 30 29 74 72 61 6e 73 6c 61 74 65 79 28 32 32 70 78 29 72 6f 74 61 74 65 28 2d 32 37 30 64 65 67 29 73 63 61 6c 65 28 2e 35 29 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 2d 33 36 30 64 65 67 29 7d Data Ascii: @keyframes spinner-wandering-cubes_b6db20{25%{transform:translatex(22px)rotate(-90deg)scale(.5)}50%{transform:translatex(22px)translatey(22px)rotate(-180deg)}75%{transform:translatex(0)translatey(22px)rotate(-270deg)scale(.5)}to{transform:rotate(-360deg)}
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 6f 72 6d 3a 73 63 61 6c 65 28 31 29 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 6e 65 72 2d 70 75 6c 73 69 6e 67 2d 65 6c 6c 69 70 73 69 73 5f 62 36 64 62 32 30 7b 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 3b 6f 70 61 63 69 74 79 3a 31 7d 35 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 2e 38 29 3b 6f 70 61 63 69 74 79 3a 2e 33 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 3b 6f 70 61 63 69 74 79 3a 31 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 6e 65 72 2d 6c 6f 77 2d 6d 6f 74 69 6f 6e 5f 62 36 64 62 32 30 7b 30 25 7b 6f 70 61 63 69 74 79 3a 31 7d 35 30 25 7b 6f 70 61 63 69 74 79 3a 2e 36 7d 74 6f 7b 6f 70 61 63 69 74 79 3a 31 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 6e 65 72 2d Data Ascii: orm:scale(1)}}@keyframes spinner-pulsing-ellipsis_b6db20{0%{transform:scale(1);opacity:1}50%{transform:scale(.8);opacity:.3}to{transform:scale(1);opacity:1}}@keyframes spinner-low-motion_b6db20{0%{opacity:1}50%{opacity:.6}to{opacity:1}}@keyframes spinner-
2024-10-24 07:15:36 UTC	1266	IN	Data Raw: 74 6f 3b 77 69 64 74 68 3a 32 38 70 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 70 75 6c 73 69 6e 67 45 6c 6c 69 70 73 69 73 5f 62 36 64 62 32 30 20 2e 69 74 65 6d 5f 62 36 64 62 32 30 7b 61 6e 69 6d 61 74 69 6f 6e 3a 73 70 69 6e 6e 65 72 2d 70 75 6c 73 69 6e 67 2d 65 6c 6c 69 70 73 69 73 5f 62 36 64 62 32 30 20 31 2e 34 73 20 69 6e 66 69 6e 69 74 65 20 65 61 73 65 2d 69 6e 2d 6f 75 74 3b 77 69 64 74 68 3a 36 70 78 3b 68 65 69 67 68 74 3a 36 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 32 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 70 72 69 6d 61 72 79 2d 31 30 30 29 3b 62 6f 72 64 65 72 2d 72 Data Ascii: to;width:28px;display:flex;justify-content:center;position:relative}.pulsingEllipsis_b6db20 .item_b6db20{animation:spinner-pulsing-ellipsis_b6db20 1.4s infinite ease-in-out;width:6px;height:6px;margin-right:2px;background-color:var(--primary-100);border-r
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 32 30 20 32 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 20 69 6e 66 69 6e 69 74 65 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 31 2c 32 30 30 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 30 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 36 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3a 72 6f 75 6e 64 3b 73 74 72 6f 6b 65 3a 76 61 72 28 2d 2d 62 72 61 6e 64 2d 35 30 30 29 7d 2e 70 61 74 68 32 5f 62 36 64 62 32 30 7b 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 2e 31 35 73 3b 73 74 72 6f 6b 65 3a 76 61 72 28 2d 2d 74 65 78 74 2d 62 72 61 6e 64 29 3b 6f 70 61 63 69 74 79 3a 2e 36 7d 2e 70 61 74 68 33 5f 62 36 64 62 32 30 7b 61 6e 69 6d 61 74 69 6f 6e Data Ascii: 20 2s ease-in-out infinite;stroke-dasharray:1,200;stroke-dashoffset:0;fill:none;stroke-width:6;stroke-miterlimit:10;stroke-linecap:round;stroke:var(--brand-500)}.path2_b6db20{animation-delay:.15s;stroke:var(--text-brand);opacity:.6}.path3_b6db20{animation
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 2e 62 75 74 74 6f 6e 5f 64 64 34 66 38 35 20 2e 63 6f 6e 74 65 6e 74 73 5f 64 64 34 66 38 35 7b 2d 2d 62 75 74 74 6f 6e 2d 2d 75 6e 64 65 72 6c 69 6e 65 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 74 6f 70 2c 74 72 61 6e 73 70 61 72 65 6e 74 2c 74 72 61 6e 73 70 61 72 65 6e 74 20 76 61 72 28 2d 2d 63 75 73 74 6f 6d 2d 62 75 74 74 6f 6e 2d 6c 69 6e 6b 2d 75 6e 64 65 72 6c 69 6e 65 2d 6f 66 66 73 65 74 29 2c 74 72 61 6e 73 70 61 72 65 6e 74 20 76 61 72 28 2d 2d 63 75 73 74 6f 6d 2d 62 75 74 74 6f 6e 2d 6c 69 6e 6b 2d 75 6e 64 65 72 6c 69 6e 65 2d 6f 66 66 73 65 74 29 2c 74 72 61 6e 73 70 61 72 65 6e 74 20 76 61 72 28 2d 2d 63 75 73 74 6f Data Ascii: .button_dd4f85 .contents_dd4f85{--button--underline-color:transparent;background-image:linear-gradient(to top,transparent,transparent var(--custom-button-link-underline-offset),transparent var(--custom-button-link-underline-offset),transparent var(--custo
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 72 61 6e 64 2d 32 30 30 29 7d 2e 6c 6f 6f 6b 46 69 6c 6c 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 42 72 61 6e 64 49 6e 76 65 72 74 65 64 5f 64 64 34 66 38 35 3a 64 69 73 61 62 6c 65 64 2c 2e 6c 6f 6f 6b 46 69 6c 6c 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 42 72 61 6e 64 49 6e 76 65 72 74 65 64 5f 64 64 34 66 38 35 5b 61 72 69 61 2d 64 69 73 61 62 6c 65 64 3d 74 72 75 65 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 77 68 69 74 65 2d 35 30 30 29 7d 2e 6c 6f 6f 6b 46 69 6c 6c 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 42 72 61 6e 64 49 6e 76 65 72 74 65 64 5f 64 64 34 66 38 35 20 2e 73 70 69 6e 6e 65 72 49 74 65 6d 5f 64 64 34 66 38 35 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 Data Ascii: d-color:var(--brand-200)}.lookFilled_dd4f85.colorBrandInverted_dd4f85:disabled,.lookFilled_dd4f85.colorBrandInverted_dd4f85[aria-disabled=true]{background-color:var(--white-500)}.lookFilled_dd4f85.colorBrandInverted_dd4f85 .spinnerItem_dd4f85{background-c
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 6e 6b 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 42 72 61 6e 64 5f 64 64 34 66 38 35 20 2e 73 70 69 6e 6e 65 72 49 74 65 6d 5f 64 64 34 66 38 35 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 72 61 6e 64 2d 35 30 30 29 7d 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 50 72 69 6d 61 72 79 5f 64 64 34 66 38 35 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 74 74 6f 6e 2d 6f 75 74 6c 69 6e 65 2d 70 72 69 6d 61 72 79 2d 74 65 78 74 29 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 74 74 6f 6e 2d 6f 75 74 6c 69 6e 65 2d 70 72 69 6d 61 72 79 2d 62 6f 72 64 65 72 29 7d 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 50 72 69 6d 61 72 79 5f 64 64 34 66 38 35 3a Data Ascii: nk_dd4f85.colorBrand_dd4f85 .spinnerItem_dd4f85{background-color:var(--brand-500)}.lookOutlined_dd4f85.colorPrimary_dd4f85{color:var(--button-outline-primary-text);border-color:var(--button-outline-primary-border)}.lookOutlined_dd4f85.colorPrimary_dd4f85:
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 4c 69 6e 6b 5f 64 64 34 66 38 35 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 74 65 78 74 2d 6c 69 6e 6b 29 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 74 65 78 74 2d 6c 69 6e 6b 29 7d 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 4c 69 6e 6b 5f 64 64 34 66 38 35 3a 61 63 74 69 76 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 28 76 61 72 28 2d 2d 74 65 78 74 2d 6c 69 6e 6b 2d 68 73 6c 29 2f 2e 31 29 7d 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 4c 69 6e 6b 5f 64 64 34 66 38 35 3a 64 69 73 61 62 6c 65 64 2c 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 Data Ascii: .lookOutlined_dd4f85.colorLink_dd4f85{color:var(--text-link);border-color:var(--text-link)}.lookOutlined_dd4f85.colorLink_dd4f85:active{background-color:hsl(var(--text-link-hsl)/.1)}.lookOutlined_dd4f85.colorLink_dd4f85:disabled,.lookOutlined_dd4f85.color
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 64 64 34 66 38 35 2e 63 6f 6c 6f 72 57 68 69 74 65 5f 64 64 34 66 38 35 3a 61 63 74 69 76 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 28 76 61 72 28 2d 2d 77 68 69 74 65 2d 35 30 30 2d 68 73 6c 29 2f 2e 31 29 7d 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 57 68 69 74 65 5f 64 64 34 66 38 35 3a 64 69 73 61 62 6c 65 64 2c 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 57 68 69 74 65 5f 64 64 34 66 38 35 5b 61 72 69 61 2d 64 69 73 61 62 6c 65 64 3d 74 72 75 65 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 57 68 69 74 65 5f 64 64 34 66 38 35 20 2e 73 Data Ascii: dd4f85.colorWhite_dd4f85:active{background-color:hsl(var(--white-500-hsl)/.1)}.lookOutlined_dd4f85.colorWhite_dd4f85:disabled,.lookOutlined_dd4f85.colorWhite_dd4f85[aria-disabled=true]{background-color:transparent}.lookOutlined_dd4f85.colorWhite_dd4f85 .s
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 61 6e 67 65 72 2d 62 6f 72 64 65 72 29 7d 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 52 65 64 5f 64 64 34 66 38 35 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 74 74 6f 6e 2d 6f 75 74 6c 69 6e 65 2d 64 61 6e 67 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 68 6f 76 65 72 29 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 74 74 6f 6e 2d 6f 75 74 6c 69 6e 65 2d 64 61 6e 67 65 72 2d 62 6f 72 64 65 72 2d 68 6f 76 65 72 29 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 74 74 6f 6e 2d 6f 75 74 6c 69 6e 65 2d 64 61 6e 67 65 72 2d 74 65 78 74 2d 68 6f 76 65 72 29 7d 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 52 65 64 5f 64 64 34 66 Data Ascii: anger-border)}.lookOutlined_dd4f85.colorRed_dd4f85:hover{background-color:var(--button-outline-danger-background-hover);border-color:var(--button-outline-danger-border-hover);color:var(--button-outline-danger-text-hover)}.lookOutlined_dd4f85.colorRed_dd4f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.7	49771	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:36 UTC	879	OUT	GET /assets/webMinimal.183cbc8427e6b143ce21.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:36 UTC	971	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:36 GMT Content-Type: text/javascript Content-Length: 14624305 Connection: close CF-Ray: 8d782d3768fde75e-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "216cb783d60a3e7c57c9d9ffea99dc3f" Last-Modified: Thu, 24 Oct 2024 03:15:20 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0FlBWVqEyNgpH8pIqvp5fEXhwY7VggOP5W%2BwvTh5rnZv2fq%2Fr0WZGFCk%2Fb%2FTuQQOuaRg%2Fsdp0NUxCu4bXTvT9orxq2kPnQAdSK25qOC2BbFN6h6nOATCEkA89Z%2B2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 28 28 29 3d 3e 7b 76 61 72 20 65 3d 7b 33 38 35 30 30 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 7b 22 2e 2f 64 65 2e 6a 73 6f 6e 61 22 3a 5b 22 36 34 34 37 35 33 22 2c 22 33 30 32 34 34 22 5d 2c 22 2e 2f 7a 68 2d 43 4e 2e 6a 73 6f 6e 61 22 3a 5b 22 34 39 34 30 36 32 22 2c 22 35 36 34 34 36 22 5d 2c 22 2e 2f 64 61 2e 6a 73 6f 6e 61 22 3a 5b 22 34 34 38 36 37 22 2c 22 35 37 33 38 37 22 5d 2c 22 2e 2f 65 6c 2e 6a 73 6f 6e 61 22 3a 5b 22 35 38 31 31 34 34 22 2c 22 35 35 36 30 31 22 5d 2c 22 2e 2f 74 72 2e 6a 73 6f 6e 61 22 3a 5b 22 31 34 36 38 37 38 22 2c 22 38 34 33 38 35 22 5d 2c 22 2e 2f 65 73 2d 45 53 2e 6a 73 6f 6e 61 22 3a 5b 22 38 37 32 35 35 30 22 2c 22 34 35 37 34 37 22 5d 2c 22 2e 2f 68 72 2e 6a 73 6f 6e 61 22 3a 5b 22 Data Ascii: (()=>{var e={385007:function(e,t,n){var r={"./de.jsona":["644753","30244"],"./zh-CN.jsona":["494062","56446"],"./da.jsona":["44867","57387"],"./el.jsona":["581144","55601"],"./tr.jsona":["146878","84385"],"./es-ES.jsona":["872550","45747"],"./hr.jsona":["
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 30 31 37 2d 31 31 2d 31 36 2e 6d 70 34 22 3a 22 32 32 31 38 32 35 22 2c 22 2e 2f 63 68 61 6e 6e 65 6c 2d 66 6f 6c 6c 6f 77 69 6e 67 2e 70 6e 67 22 3a 22 32 34 37 38 31 35 22 2c 22 2e 2f 64 69 73 63 6f 76 65 72 79 2e 6a 70 67 22 3a 22 37 37 38 36 30 38 22 2c 22 2e 2f 67 32 35 30 6b 2d 63 6c 2e 6d 70 34 22 3a 22 39 30 39 38 35 31 22 2c 22 2e 2f 68 79 70 65 73 71 75 61 64 2d 68 61 63 6b 2d 77 65 65 6b 2f 68 65 61 64 65 72 2e 70 6e 67 22 3a 22 38 31 39 30 39 31 22 2c 22 2e 2f 68 79 70 65 73 71 75 61 64 2d 68 61 63 6b 2d 77 65 65 6b 2f 70 61 6c 61 64 69 6e 73 2d 6c 6f 6f 74 2e 70 6e 67 22 3a 22 37 34 32 33 30 35 22 2c 22 2e 2f 6b 6f 2d 6e 65 77 2d 79 65 61 72 2e 6a 70 67 22 3a 22 32 36 35 39 32 31 22 2c 22 2e 2f 70 6f 6c 69 73 68 2d 77 65 65 6b 2e 70 6e 67 22 Data Ascii: 017-11-16.mp4":"221825","./channel-following.png":"247815","./discovery.jpg":"778608","./g250k-cl.mp4":"909851","./hypesquad-hack-week/header.png":"819091","./hypesquad-hack-week/paladins-loot.png":"742305","./ko-new-year.jpg":"265921","./polish-week.png"
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 63 6f 64 65 2e 73 76 67 22 3a 22 38 39 34 39 39 30 22 2c 22 2e 2f 69 63 6f 6e 2d 66 69 6c 65 2d 64 6f 63 75 6d 65 6e 74 2e 73 76 67 22 3a 22 36 37 34 37 32 30 22 2c 22 2e 2f 69 63 6f 6e 2d 66 69 6c 65 2d 69 6d 61 67 65 2e 73 76 67 22 3a 22 31 30 39 38 33 37 22 2c 22 2e 2f 69 63 6f 6e 2d 66 69 6c 65 2d 70 73 2e 73 76 67 22 3a 22 35 30 34 35 31 34 22 2c 22 2e 2f 69 63 6f 6e 2d 66 69 6c 65 2d 73 6b 65 74 63 68 2e 73 76 67 22 3a 22 33 39 32 38 30 37 22 2c 22 2e 2f 69 63 6f 6e 2d 66 69 6c 65 2d 73 70 72 65 61 64 73 68 65 65 74 2e 73 76 67 22 3a 22 32 39 31 34 31 30 22 2c 22 2e 2f 69 63 6f 6e 2d 66 69 6c 65 2d 75 6e 6b 6e 6f 77 6e 2e 73 76 67 22 3a 22 35 31 36 30 38 33 22 2c 22 2e 2f 69 63 6f 6e 2d 66 69 6c 65 2d 76 69 64 65 6f 2e 73 76 67 22 3a 22 34 33 30 35 Data Ascii: code.svg":"894990","./icon-file-document.svg":"674720","./icon-file-image.svg":"109837","./icon-file-ps.svg":"504514","./icon-file-sketch.svg":"392807","./icon-file-spreadsheet.svg":"291410","./icon-file-unknown.svg":"516083","./icon-file-video.svg":"4305
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 31 66 33 66 65 2d 33 32 2e 70 6e 67 22 3a 22 35 34 32 37 31 31 22 2c 22 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 31 66 33 66 65 2d 34 30 2e 70 6e 67 22 3a 22 38 35 35 32 36 36 22 2c 22 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 31 66 33 66 65 2d 34 38 2e 70 6e 67 22 3a 22 38 39 37 39 30 36 22 2c 22 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 31 66 33 66 66 2d 33 32 2e 70 6e 67 22 3a 22 32 30 39 33 36 39 22 2c 22 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 31 66 33 66 66 2d 34 30 2e 70 6e 67 22 3a 22 38 36 32 38 36 31 22 2c 22 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 31 66 33 66 66 2d 34 38 2e 70 6e 67 22 3a 22 33 30 30 38 37 38 22 2c 22 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 65 6d 6f 6a 69 2d 33 32 2e 70 6e 67 22 Data Ascii: ./spritesheet-1f3fe-32.png":"542711","./spritesheet-1f3fe-40.png":"855266","./spritesheet-1f3fe-48.png":"897906","./spritesheet-1f3ff-32.png":"209369","./spritesheet-1f3ff-40.png":"862861","./spritesheet-1f3ff-48.png":"300878","./spritesheet-emoji-32.png"
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 61 6c 6c 5f 72 69 6e 67 69 6e 67 5f 73 6e 6f 77 73 67 69 76 69 6e 67 2e 6d 70 33 22 3a 22 33 36 36 34 34 22 2c 22 2e 2f 63 6c 69 70 5f 65 72 72 6f 72 2e 6d 70 33 22 3a 22 34 35 35 39 34 22 2c 22 2e 2f 63 6c 69 70 5f 73 61 76 65 2e 6d 70 33 22 3a 22 31 32 31 34 32 30 22 2c 22 2e 2f 64 64 72 2d 64 6f 77 6e 2e 6d 70 33 22 3a 22 38 37 39 36 32 22 2c 22 2e 2f 64 64 72 2d 6c 65 66 74 2e 6d 70 33 22 3a 22 32 35 35 32 33 37 22 2c 22 2e 2f 64 64 72 2d 72 69 67 68 74 2e 6d 70 33 22 3a 22 38 35 36 31 36 33 22 2c 22 2e 2f 64 64 72 2d 75 70 2e 6d 70 33 22 3a 22 37 32 32 32 33 37 22 2c 22 2e 2f 64 65 61 66 65 6e 2e 6d 70 33 22 3a 22 35 38 35 33 38 39 22 2c 22 2e 2f 64 69 73 63 6f 64 6f 2e 6d 70 33 22 3a 22 33 36 31 35 31 30 22 2c 22 2e 2f 64 69 73 63 6f 6e 6e 65 63 74 Data Ascii: all_ringing_snowsgiving.mp3":"36644","./clip_error.mp3":"45594","./clip_save.mp3":"121420","./ddr-down.mp3":"87962","./ddr-left.mp3":"255237","./ddr-right.mp3":"856163","./ddr-up.mp3":"722237","./deafen.mp3":"585389","./discodo.mp3":"361510","./disconnect
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 2e 2f 73 74 61 67 65 5f 77 61 69 74 69 6e 67 2e 6d 70 33 22 3a 22 36 31 37 35 31 30 22 2c 22 2e 2f 73 74 72 65 61 6d 5f 65 6e 64 65 64 2e 6d 70 33 22 3a 22 33 30 37 33 33 34 22 2c 22 2e 2f 73 74 72 65 61 6d 5f 73 74 61 72 74 65 64 2e 6d 70 33 22 3a 22 39 31 31 33 36 38 22 2c 22 2e 2f 73 74 72 65 61 6d 5f 75 73 65 72 5f 6a 6f 69 6e 65 64 2e 6d 70 33 22 3a 22 31 39 35 31 32 39 22 2c 22 2e 2f 73 74 72 65 61 6d 5f 75 73 65 72 5f 6c 65 66 74 2e 6d 70 33 22 3a 22 38 32 38 36 36 30 22 2c 22 2e 2f 73 75 63 63 65 73 73 2e 6d 70 33 22 3a 22 34 39 39 33 35 33 22 2c 22 2e 2f 75 6e 64 65 61 66 65 6e 2e 6d 70 33 22 3a 22 39 33 39 38 39 31 22 2c 22 2e 2f 75 6e 6d 75 74 65 2e 6d 70 33 22 3a 22 33 36 30 33 39 34 22 2c 22 2e 2f 75 73 65 72 5f 6a 6f 69 6e 2e 6d 70 33 22 3a Data Ascii: ./stage_waiting.mp3":"617510","./stream_ended.mp3":"307334","./stream_started.mp3":"911368","./stream_user_joined.mp3":"195129","./stream_user_left.mp3":"828660","./success.mp3":"499353","./undeafen.mp3":"939891","./unmute.mp3":"360394","./user_join.mp3":
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 77 61 7c 61 62 61 63 7c 61 63 28 65 72 7c 6f 6f 7c 73 5c 2d 29 7c 61 69 28 6b 6f 7c 72 6e 29 7c 61 6c 28 61 76 7c 63 61 7c 63 6f 29 7c 61 6d 6f 69 7c 61 6e 28 65 78 7c 6e 79 7c 79 77 29 7c 61 70 74 75 7c 61 72 28 63 68 7c 67 6f 29 7c 61 73 28 74 65 7c 75 73 29 7c 61 74 74 77 7c 61 75 28 64 69 7c 5c 2d 6d 7c 72 20 7c 73 20 29 7c 61 76 61 6e 7c 62 65 28 63 6b 7c 6c 6c 7c 6e 71 29 7c 62 69 28 6c 62 7c 72 64 29 7c 62 6c 28 61 63 7c 61 7a 29 7c 62 72 28 65 7c 76 29 77 7c 62 75 6d 62 7c 62 77 5c 2d 28 6e 7c 75 29 7c 63 35 35 5c 2f 7c 63 61 70 69 7c 63 63 77 61 7c 63 64 6d 5c 2d 7c 63 65 6c 6c 7c 63 68 74 6d 7c 63 6c 64 63 7c 63 6d 64 5c 2d 7c 63 6f 28 6d 70 7c 6e 64 29 7c 63 72 61 77 7c 64 61 28 69 74 7c 6c 6c 7c 6e 67 29 7c 64 62 74 65 7c 64 63 5c 2d 73 7c 64 Data Ascii: wa\|abac\|ac(er\|oo\|s\-)\|ai(ko\|rn)\|al(av\|ca\|co)\|amoi\|an(ex\|ny\|yw)\|aptu\|ar(ch\|go)\|as(te\|us)\|attw\|au(di\|\-m\|r \|s )\|avan\|be(ck\|ll\|nq)\|bi(lb\|rd)\|bl(ac\|az)\|br(e\|v)w\|bumb\|bw\-(n\|u)\|c55\/\|capi\|ccwa\|cdm\-\|cell\|chtm\|cldc\|cmd\-\|co(mp\|nd)\|craw\|da(it\|ll\|ng)\|dbte\|dc\-s\|d
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 7c 6d 35 29 7c 74 78 5c 2d 39 7c 75 70 28 5c 2e 62 7c 67 31 7c 73 69 29 7c 75 74 73 74 7c 76 34 30 30 7c 76 37 35 30 7c 76 65 72 69 7c 76 69 28 72 67 7c 74 65 29 7c 76 6b 28 34 30 7c 35 5b 30 2d 33 5d 7c 5c 2d 76 29 7c 76 6d 34 30 7c 76 6f 64 61 7c 76 75 6c 63 7c 76 78 28 35 32 7c 35 33 7c 36 30 7c 36 31 7c 37 30 7c 38 30 7c 38 31 7c 38 33 7c 38 35 7c 39 38 29 7c 77 33 63 28 5c 2d 7c 20 29 7c 77 65 62 63 7c 77 68 69 74 7c 77 69 28 67 20 7c 6e 63 7c 6e 77 29 7c 77 6d 6c 62 7c 77 6f 6e 75 7c 78 37 30 30 7c 79 61 73 5c 2d 7c 79 6f 75 72 7c 7a 65 74 6f 7c 7a 74 65 5c 2d 2f 69 2e 74 65 73 74 28 65 2e 73 75 62 73 74 72 28 30 2c 34 29 29 7d 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 28 30 2c 74 2e 69 73 53 61 66 61 72 Data Ascii: \|m5)\|tx\-9\|up(\.b\|g1\|si)\|utst\|v400\|v750\|veri\|vi(rg\|te)\|vk(40\|5[0-3]\|\-v)\|vm40\|voda\|vulc\|vx(52\|53\|60\|61\|70\|80\|81\|83\|85\|98)\|w3c(\-\| )\|webc\|whit\|wi(g \|nc\|nw)\|wmlb\|wonu\|x700\|yas\-\|your\|zeto\|zte\-/i.test(e.substr(0,4))},e.exports=function(){return!(0,t.isSafar
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 65 6d 69 62 6f 6c 64 69 74 61 6c 69 63 2e 77 6f 66 66 32 22 3a 5b 22 34 38 30 38 35 34 22 5d 2c 22 2e 2f 73 6f 75 72 63 65 2d 63 6f 64 65 2d 70 72 6f 2f 73 6f 75 72 63 65 63 6f 64 65 70 72 6f 2d 37 30 30 2d 62 6f 6c 64 2e 77 6f 66 66 32 22 3a 5b 22 37 31 31 33 31 33 22 5d 2c 22 2e 2f 6e 6f 74 6f 2d 73 61 6e 73 2f 6e 6f 74 6f 73 61 6e 73 2d 34 30 30 2d 6e 6f 72 6d 61 6c 2e 77 6f 66 66 32 22 3a 5b 22 31 33 34 31 33 31 22 5d 2c 22 2e 2f 61 62 63 2d 67 69 6e 74 6f 2d 6e 6f 72 64 2f 61 62 63 67 69 6e 74 6f 6e 6f 72 64 2d 38 30 30 2d 65 78 74 72 61 62 6f 6c 64 2e 77 6f 66 66 32 22 3a 5b 22 38 31 34 37 32 37 22 5d 2c 22 2e 2f 6e 6f 74 6f 2d 73 61 6e 73 2f 6e 6f 74 6f 73 61 6e 73 2d 37 30 30 2d 62 6f 6c 64 69 74 61 6c 69 63 2e 77 6f 66 66 32 22 3a 5b 22 33 37 36 Data Ascii: emibolditalic.woff2":["480854"],"./source-code-pro/sourcecodepro-700-bold.woff2":["711313"],"./noto-sans/notosans-400-normal.woff2":["134131"],"./abc-ginto-nord/abcgintonord-800-extrabold.woff2":["814727"],"./noto-sans/notosans-700-bolditalic.woff2":["376
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 38 38 33 22 2c 22 2e 2f 68 72 22 3a 22 36 30 31 32 30 33 22 2c 22 2e 2f 68 72 2e 6a 73 6f 6e 22 3a 22 36 30 31 32 30 33 22 2c 22 2e 2f 68 75 22 3a 22 32 37 35 31 31 38 22 2c 22 2e 2f 68 75 2e 6a 73 6f 6e 22 3a 22 32 37 35 31 31 38 22 2c 22 2e 2f 69 64 22 3a 22 31 32 36 34 32 22 2c 22 2e 2f 69 64 2e 6a 73 6f 6e 22 3a 22 31 32 36 34 32 22 2c 22 2e 2f 69 74 22 3a 22 33 39 31 35 37 37 22 2c 22 2e 2f 69 74 2e 6a 73 6f 6e 22 3a 22 33 39 31 35 37 37 22 2c 22 2e 2f 6a 61 22 3a 22 38 33 30 36 36 36 22 2c 22 2e 2f 6a 61 2e 6a 73 6f 6e 22 3a 22 38 33 30 36 36 36 22 2c 22 2e 2f 6b 6f 22 3a 22 36 37 36 35 33 22 2c 22 2e 2f 6b 6f 2e 6a 73 6f 6e 22 3a 22 36 37 36 35 33 22 2c 22 2e 2f 6c 74 22 3a 22 37 32 38 31 30 39 22 2c 22 2e 2f 6c 74 2e 6a 73 6f 6e 22 3a 22 37 32 38 Data Ascii: 883","./hr":"601203","./hr.json":"601203","./hu":"275118","./hu.json":"275118","./id":"12642","./id.json":"12642","./it":"391577","./it.json":"391577","./ja":"830666","./ja.json":"830666","./ko":"67653","./ko.json":"67653","./lt":"728109","./lt.json":"728

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.7	49773	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:36 UTC	875	OUT	GET /assets/sentry.d30fc24f50e5e3e76b3e.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:36 UTC	970	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:36 GMT Content-Type: text/javascript Content-Length: 1131565 Connection: close CF-Ray: 8d782d377d48e987-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "4f8f7ac8f509d88d00832626b0034b06" Last-Modified: Thu, 24 Oct 2024 03:15:20 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0XatYdjRAy1vxLXXg8Y%2FmONQjFxzwkwB6cIjS2s%2BhfJm2QTl%2BoylgtkV0%2BsOdUgLKAmhahm5B4vex%2F5fbkm8Io1PHp%2FMa5ujXOWAzivSou1WRsSR2OMOzH7qNJrm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 28 28 29 3d 3e 7b 76 61 72 20 65 3d 7b 36 35 34 38 36 31 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 65 3d 72 2e 6e 6d 64 28 65 29 3b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 73 28 39 30 30 37 31 39 39 32 35 34 37 34 30 39 39 32 29 2c 72 3d 22 30 31 32 33 34 35 36 37 38 39 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 22 2c 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 42 69 67 49 6e 74 3b 66 75 6e 63 74 69 6f 6e 20 5f 28 65 2c 74 2c 72 2c 6e 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 65 3f 5f 5b 30 5d 3a 76 6f 69 64 20 30 21 3d 3d 74 3f 31 30 21 3d 2b 74 7c 7c 72 3f 59 28 65 2c 74 2c 72 2c 6e 29 3a 46 28 65 29 3a 46 28 Data Ascii: (()=>{var e={654861:function(e,t,r){e=r.nmd(e);var n=function(e){"use strict";var t=s(9007199254740992),r="0123456789abcdefghijklmnopqrstuvwxyz",a="function"==typeof BigInt;function _(e,t,r,n){return void 0===e?_[0]:void 0!==t?10!=+t\|\|r?Y(e,t,r,n):F(e):F(
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 6e 67 74 68 2c 6f 3d 41 72 72 61 79 28 61 29 2c 45 3d 30 3b 66 6f 72 28 72 3d 30 3b 72 3c 5f 3b 72 2b 2b 29 28 6e 3d 65 5b 72 5d 2d 45 2d 74 5b 72 5d 29 3c 30 3f 28 6e 2b 3d 31 65 37 2c 45 3d 31 29 3a 45 3d 30 2c 6f 5b 72 5d 3d 6e 3b 66 6f 72 28 72 3d 5f 3b 72 3c 61 3b 72 2b 2b 29 7b 69 66 28 28 6e 3d 65 5b 72 5d 2d 45 29 3c 30 29 6e 2b 3d 31 65 37 3b 65 6c 73 65 7b 6f 5b 72 2b 2b 5d 3d 6e 3b 62 72 65 61 6b 7d 6f 5b 72 5d 3d 6e 7d 66 6f 72 28 3b 72 3c 61 3b 72 2b 2b 29 6f 5b 72 5d 3d 65 5b 72 5d 3b 72 65 74 75 72 6e 20 75 28 6f 29 2c 6f 7d 6f 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 5f 2e 70 72 6f 74 6f 74 79 70 65 29 2c 45 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 5f 2e 70 72 6f 74 6f 74 Data Ascii: ngth,o=Array(a),E=0;for(r=0;r<_;r++)(n=e[r]-E-t[r])<0?(n+=1e7,E=1):E=0,o[r]=n;for(r=_;r<a;r++){if((n=e[r]-E)<0)n+=1e7;else{o[r++]=n;break}o[r]=n}for(;r<a;r++)o[r]=e[r];return u(o),o}o.prototype=Object.create(_.prototype),E.prototype=Object.create(_.protot
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 6f 2f 31 65 37 29 3b 72 65 74 75 72 6e 20 5f 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 72 3d 5b 5d 3b 74 2d 2d 20 3e 30 3b 29 72 2e 70 75 73 68 28 30 29 3b 72 65 74 75 72 6e 20 72 2e 63 6f 6e 63 61 74 28 65 29 7d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 73 75 62 74 72 61 63 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 72 2c 6e 2c 61 2c 5f 3d 46 28 65 29 3b 69 66 28 74 68 69 73 2e 73 69 67 6e 21 3d 3d 5f 2e 73 69 67 6e 29 72 65 74 75 72 6e 20 74 68 69 73 2e 61 64 64 28 5f 2e 6e 65 67 61 74 65 28 29 29 3b 76 61 72 20 69 3d 74 68 69 73 2e 76 61 6c 75 65 2c 63 3d 5f 2e 76 61 6c 75 65 3b 69 66 28 5f 2e 69 73 53 6d 61 6c 6c 29 72 65 74 75 72 6e 20 4c 28 69 2c 4d 61 74 68 2e 61 62 73 Data Ascii: =Math.floor(o/1e7);return _}function p(e,t){for(var r=[];t-- >0;)r.push(0);return r.concat(e)}o.prototype.subtract=function(e){var t,r,n,a,_=F(e);if(this.sign!==_.sign)return this.add(_.negate());var i=this.value,c=_.value;if(_.isSmall)return L(i,Math.abs
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 37 2a 72 3b 6f 5b 6e 2b 5f 5d 3d 72 7d 72 65 74 75 72 6e 20 75 28 6f 29 2c 6f 7d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 75 6c 74 69 70 6c 79 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 72 2c 6e 2c 61 3d 46 28 65 29 2c 45 3d 74 68 69 73 2e 76 61 6c 75 65 2c 69 3d 61 2e 76 61 6c 75 65 2c 63 3d 74 68 69 73 2e 73 69 67 6e 21 3d 3d 61 2e 73 69 67 6e 3b 69 66 28 61 2e 69 73 53 6d 61 6c 6c 29 7b 69 66 28 30 3d 3d 3d 69 29 72 65 74 75 72 6e 20 5f 5b 30 5d 3b 69 66 28 31 3d 3d 3d 69 29 72 65 74 75 72 6e 20 74 68 69 73 3b 69 66 28 2d 31 3d 3d 3d 69 29 72 65 74 75 72 6e 20 74 68 69 73 2e 6e 65 67 61 74 65 28 29 3b 69 66 28 28 6e 3d 4d 61 74 68 2e 61 62 73 28 69 29 29 3c 31 65 37 29 72 65 74 75 72 6e 20 6e 65 77 20 6f 28 4f 28 45 2c 6e 29 2c 63 29 3b 69 Data Ascii: 7*r;o[n+_]=r}return u(o),o}o.prototype.multiply=function(e){var t,r,n,a=F(e),E=this.value,i=a.value,c=this.sign!==a.sign;if(a.isSmall){if(0===i)return _[0];if(1===i)return this;if(-1===i)return this.negate();if((n=Math.abs(i))<1e7)return new o(O(E,n),c);i
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 69 28 74 68 69 73 2e 76 61 6c 75 65 2a 74 68 69 73 2e 76 61 6c 75 65 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 44 28 65 2c 74 29 7b 76 61 72 20 72 2c 6e 2c 61 2c 5f 2c 6f 3d 65 2e 6c 65 6e 67 74 68 2c 45 3d 49 28 6f 29 3b 66 6f 72 28 61 3d 30 2c 72 3d 6f 2d 31 3b 72 3e 3d 30 3b 2d 2d 72 29 6e 3d 52 28 28 5f 3d 31 65 37 2a 61 2b 65 5b 72 5d 29 2f 74 29 2c 61 3d 5f 2d 6e 2a 74 2c 45 5b 72 5d 3d 30 7c 6e 3b 72 65 74 75 72 6e 5b 45 2c 30 7c 61 5d 7d 66 75 6e 63 74 69 6f 6e 20 43 28 65 2c 74 29 7b 76 61 72 20 72 2c 6e 2c 63 3d 46 28 74 29 3b 69 66 28 61 29 72 65 74 75 72 6e 5b 6e 65 77 20 69 28 65 2e 76 61 6c 75 65 2f 63 2e 76 61 6c 75 65 29 2c 6e 65 77 20 69 28 65 2e 76 61 6c 75 65 25 63 2e 76 61 6c 75 65 29 5d 3b Data Ascii: on(e){return new i(this.valuethis.value)};function D(e,t){var r,n,a,_,o=e.length,E=I(o);for(a=0,r=o-1;r>=0;--r)n=R((_=1e7a+e[r])/t),a=_-n*t,E[r]=0\|n;return[E,0\|a]}function C(e,t){var r,n,c=F(t);if(a)return[new i(e.value/c.value),new i(e.value%c.value)];
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 30 3e 67 28 73 2c 74 29 29 7b 63 2e 70 75 73 68 28 30 29 3b 63 6f 6e 74 69 6e 75 65 7d 6e 3d 73 2e 6c 65 6e 67 74 68 2c 61 3d 31 65 37 2a 73 5b 6e 2d 31 5d 2b 73 5b 6e 2d 32 5d 2c 5f 3d 31 65 37 2a 74 5b 69 2d 31 5d 2b 74 5b 69 2d 32 5d 2c 6e 3e 69 26 26 28 61 3d 28 61 2b 31 29 2a 31 65 37 29 2c 72 3d 4d 61 74 68 2e 63 65 69 6c 28 61 2f 5f 29 3b 64 6f 7b 69 66 28 30 3e 3d 67 28 6f 3d 4f 28 74 2c 72 29 2c 73 29 29 62 72 65 61 6b 3b 72 2d 2d 7d 77 68 69 6c 65 28 72 29 3b 63 2e 70 75 73 68 28 72 29 2c 73 3d 64 28 73 2c 6f 29 7d 72 65 74 75 72 6e 20 63 2e 72 65 76 65 72 73 65 28 29 2c 5b 6c 28 63 29 2c 6c 28 73 29 5d 7d 28 4e 2c 41 29 29 5b 30 5d 3b 76 61 72 20 70 3d 65 2e 73 69 67 6e 21 3d 3d 63 2e 73 69 67 6e 2c 68 3d 6e 5b 31 5d 2c 53 3d 65 2e 73 69 67 6e Data Ascii: 0>g(s,t)){c.push(0);continue}n=s.length,a=1e7s[n-1]+s[n-2],_=1e7t[i-1]+t[i-2],n>i&&(a=(a+1)*1e7),r=Math.ceil(a/_);do{if(0>=g(o=O(t,r),s))break;r--}while(r);c.push(r),s=d(s,o)}return c.reverse(),[l(c),l(s)]}(N,A))[0];var p=e.sign!==c.sign,h=n[1],S=e.sign
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 31 5d 7d 2c 69 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 6f 64 3d 69 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 6d 61 69 6e 64 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 69 28 74 68 69 73 2e 76 61 6c 75 65 25 46 28 65 29 2e 76 61 6c 75 65 29 7d 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 6d 61 69 6e 64 65 72 3d 45 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 6f 64 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 6d 61 69 6e 64 65 72 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 6f 64 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 70 6f 77 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 72 2c 6e 2c 61 3d 46 28 65 29 2c 6f 3d 74 68 69 73 2e 76 61 6c 75 65 2c 69 3d 61 2e 76 61 6c 75 65 3b 69 66 28 30 3d 3d 3d 69 29 72 65 74 75 72 6e 20 5f 5b 31 5d Data Ascii: 1]},i.prototype.mod=i.prototype.remainder=function(e){return new i(this.value%F(e).value)},E.prototype.remainder=E.prototype.mod=o.prototype.remainder=o.prototype.mod,o.prototype.pow=function(e){var t,r,n,a=F(e),o=this.value,i=a.value;if(0===i)return _[1]
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 3b 72 65 74 75 72 6e 20 74 2e 69 73 53 6d 61 6c 6c 3f 31 3a 67 28 72 2c 6e 29 7d 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6d 70 61 72 65 41 62 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 46 28 65 29 2c 72 3d 4d 61 74 68 2e 61 62 73 28 74 68 69 73 2e 76 61 6c 75 65 29 2c 6e 3d 74 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 74 2e 69 73 53 6d 61 6c 6c 3f 72 3d 3d 3d 28 6e 3d 4d 61 74 68 2e 61 62 73 28 6e 29 29 3f 30 3a 72 3e 6e 3f 31 3a 2d 31 3a 2d 31 7d 2c 69 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6d 70 61 72 65 41 62 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 76 61 6c 75 65 2c 72 3d 46 28 65 29 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 28 74 3d 74 3e 3d 30 3f 74 3a 2d 74 29 3d 3d 3d 28 72 3d 72 3e 3d 30 3f 72 Data Ascii: ;return t.isSmall?1:g(r,n)},E.prototype.compareAbs=function(e){var t=F(e),r=Math.abs(this.value),n=t.value;return t.isSmall?r===(n=Math.abs(n))?0:r>n?1:-1:-1},i.prototype.compareAbs=function(e){var t=this.value,r=F(e).value;return(t=t>=0?t:-t)===(r=r>=0?r
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 79 70 65 2e 67 74 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 67 72 65 61 74 65 72 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 73 73 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 30 3e 74 68 69 73 2e 63 6f 6d 70 61 72 65 28 65 29 7d 2c 69 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 74 3d 69 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 73 73 65 72 3d 45 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 74 3d 45 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 73 73 65 72 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 74 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 73 73 65 72 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 67 72 65 61 74 65 72 4f 72 45 71 75 61 6c 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 63 6f 6d 70 61 72 65 28 65 29 3e 3d 30 7d 2c 69 2e Data Ascii: ype.gt=o.prototype.greater,o.prototype.lesser=function(e){return 0>this.compare(e)},i.prototype.lt=i.prototype.lesser=E.prototype.lt=E.prototype.lesser=o.prototype.lt=o.prototype.lesser,o.prototype.greaterOrEquals=function(e){return this.compare(e)>=0},i.
2024-10-24 07:15:36 UTC	1369	IN	Data Raw: 73 55 6e 69 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 61 62 73 28 29 2e 76 61 6c 75 65 3d 3d 3d 42 69 67 49 6e 74 28 31 29 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 5a 65 72 6f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 31 7d 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 5a 65 72 6f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 30 3d 3d 3d 74 68 69 73 2e 76 61 6c 75 65 7d 2c 69 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 5a 65 72 6f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 76 61 6c 75 65 3d 3d 3d 42 69 67 49 6e 74 28 30 29 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 44 69 76 69 73 69 62 6c 65 42 79 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 46 28 65 Data Ascii: sUnit=function(){return this.abs().value===BigInt(1)},o.prototype.isZero=function(){return!1},E.prototype.isZero=function(){return 0===this.value},i.prototype.isZero=function(){return this.value===BigInt(0)},o.prototype.isDivisibleBy=function(e){var t=F(e

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.7	49767	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:36 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:36 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:36 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 71d2c1fc-001e-00a2-01de-21d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071536Z-16849878b78bkvbz1ry47zvsas00000007dg000000005ryz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:36 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.7	49768	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:36 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:36 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:36 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 34cbbb6f-001e-0046-0fdf-25da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071536Z-16849878b789m94j7902zfvfr0000000076000000000dbu5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:15:36 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.7	49770	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:36 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:36 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:36 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 94ed83ec-801e-0083-4bf2-24f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071536Z-15b8d89586fbt6nf34bm5uw08n00000002g0000000008yyd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:15:36 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.7	49769	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:36 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:36 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:36 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 250cc9c1-301e-000c-4ec3-20323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071536Z-16849878b78lhh9t0fb3392enw00000007ag000000002unn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:36 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.7	49776	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:36 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:36 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 33ade019-101e-0028-30f5-248f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071536Z-15b8d89586fhl2qtatrz3vfkf000000004dg00000000c2kk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:36 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.7	49778	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:37 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:37 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:37 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 40a513cc-e01e-0051-0ef3-2484b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071537Z-r197bdfb6b4qpk6v9629ad4b5s0000000c100000000041ep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:15:37 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.7	49780	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:37 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:37 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 8e6df999-101e-007a-77ef-24047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071537Z-15b8d89586fsx9lfqmgrbzpgmg0000000e20000000009bpa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:37 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.7	49779	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:37 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:37 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 13fbacc8-201e-0003-23f4-24f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071537Z-r197bdfb6b4sn8wg20e97vn7ps0000000p00000000004y1z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:37 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.7	49781	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:37 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:37 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:37 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 100b0a78-f01e-0003-754e-224453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071537Z-16849878b78q4pnrt955f8nkx8000000075000000000ekzh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:37 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.7	49782	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:37 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:37 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 6113d354-c01e-00a1-29f4-247e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071537Z-15b8d89586flzzks5bs37v2b90000000031g0000000013k7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:37 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.7	49784	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:38 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:38 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:38 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: acb2ef9b-e01e-001f-1f33-221633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071538Z-16849878b785f8wh85a0w3ennn00000007bg000000005td8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:38 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.7	49785	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:38 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:38 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:38 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 7cfbc72c-d01e-0082-6d55-22e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071538Z-16849878b785g992cz2s9gk35c00000007b000000000baym x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:15:38 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.7	49786	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:38 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:38 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:38 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 217788b5-401e-0016-11a2-2153e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071538Z-16849878b78hz7zj8u0h2zng1400000007f0000000006wmp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:38 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.7	49787	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:38 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:38 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:38 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: ee7a308c-c01e-00a1-620b-227e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071538Z-16849878b78dghrpt8v731n7r4000000076000000000dy0d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:38 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.7	49788	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:38 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:38 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:38 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: fc13fe58-401e-000a-0af3-244a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071538Z-15b8d89586fqckbz0ssbuzzp1n00000001xg000000001ms9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:38 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.7	49789	162.159.138.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:38 UTC	680	OUT	GET /assets/sentry.d30fc24f50e5e3e76b3e.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:38 UTC	970	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:38 GMT Content-Type: text/javascript Content-Length: 1131565 Connection: close CF-Ray: 8d782d472ec76b40-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "4f8f7ac8f509d88d00832626b0034b06" Last-Modified: Thu, 24 Oct 2024 03:15:20 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nVjzTPwlGHueeqB89o2L3P01S%2Bx8YKAE%2FBLTR464odt14UrDc9Ymeo5yELRxDu4C7nFzR2g6mdWB5WH6%2FXj09mbh1xJvDnXaM91OU3sYQQi%2FIX%2BjY%2FxUwo9t7woD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:38 UTC	399	IN	Data Raw: 28 28 29 3d 3e 7b 76 61 72 20 65 3d 7b 36 35 34 38 36 31 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 65 3d 72 2e 6e 6d 64 28 65 29 3b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 73 28 39 30 30 37 31 39 39 32 35 34 37 34 30 39 39 32 29 2c 72 3d 22 30 31 32 33 34 35 36 37 38 39 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 22 2c 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 42 69 67 49 6e 74 3b 66 75 6e 63 74 69 6f 6e 20 5f 28 65 2c 74 2c 72 2c 6e 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 65 3f 5f 5b 30 5d 3a 76 6f 69 64 20 30 21 3d 3d 74 3f 31 30 21 3d 2b 74 7c 7c 72 3f 59 28 65 2c 74 2c 72 2c 6e 29 3a 46 28 65 29 3a 46 28 Data Ascii: (()=>{var e={654861:function(e,t,r){e=r.nmd(e);var n=function(e){"use strict";var t=s(9007199254740992),r="0123456789abcdefghijklmnopqrstuvwxyz",a="function"==typeof BigInt;function _(e,t,r,n){return void 0===e?_[0]:void 0!==t?10!=+t\|\|r?Y(e,t,r,n):F(e):F(
2024-10-24 07:15:38 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 63 28 65 29 7b 72 65 74 75 72 6e 20 2d 39 30 30 37 31 39 39 32 35 34 37 34 30 39 39 32 3c 65 26 26 65 3c 39 30 30 37 31 39 39 32 35 34 37 34 30 39 39 32 7d 66 75 6e 63 74 69 6f 6e 20 73 28 65 29 7b 72 65 74 75 72 6e 20 65 3c 31 65 37 3f 5b 65 5d 3a 65 3c 31 65 31 34 3f 5b 65 25 31 65 37 2c 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 2f 31 65 37 29 5d 3a 5b 65 25 31 65 37 2c 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 2f 31 65 37 29 25 31 65 37 2c 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 2f 31 65 31 34 29 5d 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 65 29 7b 75 28 65 29 3b 76 61 72 20 72 3d 65 2e 6c 65 6e 67 74 68 3b 69 66 28 72 3c 34 26 26 30 3e 67 28 65 2c 74 29 29 73 77 69 74 63 68 28 72 29 7b 63 61 73 65 20 30 3a 72 65 74 75 72 6e 20 30 3b 63 61 73 65 Data Ascii: function c(e){return -9007199254740992<e&&e<9007199254740992}function s(e){return e<1e7?[e]:e<1e14?[e%1e7,Math.floor(e/1e7)]:[e%1e7,Math.floor(e/1e7)%1e7,Math.floor(e/1e14)]}function l(e){u(e);var r=e.length;if(r<4&&0>g(e,t))switch(r){case 0:return 0;case
2024-10-24 07:15:38 UTC	1369	IN	Data Raw: 74 68 69 73 2e 76 61 6c 75 65 2c 6e 3d 74 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 74 2e 69 73 53 6d 61 6c 6c 3f 6e 65 77 20 6f 28 54 28 72 2c 4d 61 74 68 2e 61 62 73 28 6e 29 29 2c 74 68 69 73 2e 73 69 67 6e 29 3a 6e 65 77 20 6f 28 41 28 72 2c 6e 29 2c 74 68 69 73 2e 73 69 67 6e 29 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 70 6c 75 73 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 46 28 65 29 2c 72 3d 74 68 69 73 2e 76 61 6c 75 65 3b 69 66 28 72 3c 30 21 3d 3d 74 2e 73 69 67 6e 29 72 65 74 75 72 6e 20 74 68 69 73 2e 73 75 62 74 72 61 63 74 28 74 2e 6e 65 67 61 74 65 28 29 29 3b 76 61 72 20 6e 3d 74 2e 76 61 6c 75 65 3b 69 66 28 74 2e 69 73 53 6d 61 Data Ascii: this.value,n=t.value;return t.isSmall?new o(T(r,Math.abs(n)),this.sign):new o(A(r,n),this.sign)},o.prototype.plus=o.prototype.add,E.prototype.add=function(e){var t=F(e),r=this.value;if(r<0!==t.sign)return this.subtract(t.negate());var n=t.value;if(t.isSma
2024-10-24 07:15:38 UTC	1369	IN	Data Raw: 74 79 70 65 2e 6d 69 6e 75 73 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 73 75 62 74 72 61 63 74 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 73 75 62 74 72 61 63 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 46 28 65 29 2c 72 3d 74 68 69 73 2e 76 61 6c 75 65 3b 69 66 28 72 3c 30 21 3d 3d 74 2e 73 69 67 6e 29 72 65 74 75 72 6e 20 74 68 69 73 2e 61 64 64 28 74 2e 6e 65 67 61 74 65 28 29 29 3b 76 61 72 20 6e 3d 74 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 74 2e 69 73 53 6d 61 6c 6c 3f 6e 65 77 20 45 28 72 2d 6e 29 3a 4c 28 6e 2c 4d 61 74 68 2e 61 62 73 28 72 29 2c 72 3e 3d 30 29 7d 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 69 6e 75 73 3d 45 2e 70 72 6f 74 6f 74 79 70 65 2e 73 75 62 74 72 61 63 74 2c 69 2e 70 72 6f 74 6f 74 79 70 65 2e 73 75 62 74 72 61 Data Ascii: type.minus=o.prototype.subtract,E.prototype.subtract=function(e){var t=F(e),r=this.value;if(r<0!==t.sign)return this.add(t.negate());var n=t.value;return t.isSmall?new E(r-n):L(n,Math.abs(r),r>=0)},E.prototype.minus=E.prototype.subtract,i.prototype.subtra
2024-10-24 07:15:38 UTC	1369	IN	Data Raw: 4d 61 74 68 2e 63 65 69 6c 28 6e 2f 32 29 3b 76 61 72 20 61 3d 74 2e 73 6c 69 63 65 28 6e 29 2c 5f 3d 74 2e 73 6c 69 63 65 28 30 2c 6e 29 2c 6f 3d 72 2e 73 6c 69 63 65 28 6e 29 2c 45 3d 72 2e 73 6c 69 63 65 28 30 2c 6e 29 2c 69 3d 65 28 5f 2c 45 29 2c 63 3d 65 28 61 2c 6f 29 2c 73 3d 65 28 41 28 5f 2c 61 29 2c 41 28 45 2c 6f 29 29 2c 6c 3d 41 28 41 28 69 2c 70 28 64 28 64 28 73 2c 69 29 2c 63 29 2c 6e 29 29 2c 70 28 63 2c 32 2a 6e 29 29 3b 72 65 74 75 72 6e 20 75 28 6c 29 2c 6c 7d 28 45 2c 69 29 2c 63 29 3a 6e 65 77 20 6f 28 66 28 45 2c 69 29 2c 63 29 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 74 69 6d 65 73 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 75 6c 74 69 70 6c 79 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 6d 75 6c 74 69 70 6c 79 42 79 53 6d 61 6c 6c Data Ascii: Math.ceil(n/2);var a=t.slice(n),_=t.slice(0,n),o=r.slice(n),E=r.slice(0,n),i=e(_,E),c=e(a,o),s=e(A(_,a),A(E,o)),l=A(A(i,p(d(d(s,i),c),n)),p(c,2*n));return u(l),l}(E,i),c):new o(f(E,i),c)},o.prototype.times=o.prototype.multiply,E.prototype._multiplyBySmall
2024-10-24 07:15:38 UTC	1369	IN	Data Raw: 6d 61 6c 6c 29 7b 69 66 28 31 3d 3d 3d 41 29 72 65 74 75 72 6e 5b 65 2c 5f 5b 30 5d 5d 3b 69 66 28 2d 31 3d 3d 41 29 72 65 74 75 72 6e 5b 65 2e 6e 65 67 61 74 65 28 29 2c 5f 5b 30 5d 5d 3b 76 61 72 20 54 3d 4d 61 74 68 2e 61 62 73 28 41 29 3b 69 66 28 54 3c 31 65 37 29 7b 72 3d 6c 28 28 6e 3d 44 28 4e 2c 54 29 29 5b 30 5d 29 3b 76 61 72 20 4c 3d 6e 5b 31 5d 3b 72 65 74 75 72 6e 28 65 2e 73 69 67 6e 26 26 28 4c 3d 2d 4c 29 2c 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 72 29 3f 28 65 2e 73 69 67 6e 21 3d 3d 63 2e 73 69 67 6e 26 26 28 72 3d 2d 72 29 2c 5b 6e 65 77 20 45 28 72 29 2c 6e 65 77 20 45 28 4c 29 5d 29 3a 5b 6e 65 77 20 6f 28 72 2c 65 2e 73 69 67 6e 21 3d 3d 63 2e 73 69 67 6e 29 2c 6e 65 77 20 45 28 4c 29 5d 7d 41 3d 73 28 54 29 7d 76 61 72 Data Ascii: mall){if(1===A)return[e,_[0]];if(-1==A)return[e.negate(),_[0]];var T=Math.abs(A);if(T<1e7){r=l((n=D(N,T))[0]);var L=n[1];return(e.sign&&(L=-L),"number"==typeof r)?(e.sign!==c.sign&&(r=-r),[new E(r),new E(L)]):[new o(r,e.sign!==c.sign),new E(L)]}A=s(T)}var
2024-10-24 07:15:38 UTC	1369	IN	Data Raw: 6c 65 6e 67 74 68 21 3d 3d 74 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 65 2e 6c 65 6e 67 74 68 3e 74 2e 6c 65 6e 67 74 68 3f 31 3a 2d 31 3b 66 6f 72 28 76 61 72 20 72 3d 65 2e 6c 65 6e 67 74 68 2d 31 3b 72 3e 3d 30 3b 72 2d 2d 29 69 66 28 65 5b 72 5d 21 3d 3d 74 5b 72 5d 29 72 65 74 75 72 6e 20 65 5b 72 5d 3e 74 5b 72 5d 3f 31 3a 2d 31 3b 72 65 74 75 72 6e 20 30 7d 66 75 6e 63 74 69 6f 6e 20 55 28 65 29 7b 76 61 72 20 74 3d 65 2e 61 62 73 28 29 3b 72 65 74 75 72 6e 21 74 2e 69 73 55 6e 69 74 28 29 26 26 28 21 21 28 74 2e 65 71 75 61 6c 73 28 32 29 7c 7c 74 2e 65 71 75 61 6c 73 28 33 29 7c 7c 74 2e 65 71 75 61 6c 73 28 35 29 29 7c 7c 21 28 74 2e 69 73 45 76 65 6e 28 29 7c 7c 74 2e 69 73 44 69 76 69 73 69 62 6c 65 42 79 28 33 29 7c 7c 74 2e 69 73 44 69 Data Ascii: length!==t.length)return e.length>t.length?1:-1;for(var r=e.length-1;r>=0;r--)if(e[r]!==t[r])return e[r]>t[r]?1:-1;return 0}function U(e){var t=e.abs();return!t.isUnit()&&(!!(t.equals(2)\|\|t.equals(3)\|\|t.equals(5))\|\|!(t.isEven()\|\|t.isDivisibleBy(3)\|\|t.isDi
2024-10-24 07:15:38 UTC	1369	IN	Data Raw: 22 2b 61 2e 74 6f 53 74 72 69 6e 67 28 29 2b 22 20 69 73 20 74 6f 6f 20 6c 61 72 67 65 2e 22 29 3b 69 66 28 74 68 69 73 2e 69 73 53 6d 61 6c 6c 26 26 63 28 74 3d 4d 61 74 68 2e 70 6f 77 28 6f 2c 69 29 29 29 72 65 74 75 72 6e 20 6e 65 77 20 45 28 52 28 74 29 29 3b 66 6f 72 28 72 3d 74 68 69 73 2c 6e 3d 5f 5b 31 5d 3b 21 30 26 69 26 26 28 6e 3d 6e 2e 74 69 6d 65 73 28 72 29 2c 2d 2d 69 29 2c 30 21 3d 3d 69 3b 29 7b 3b 69 2f 3d 32 2c 72 3d 72 2e 73 71 75 61 72 65 28 29 7d 72 65 74 75 72 6e 20 6e 7d 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 70 6f 77 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 70 6f 77 2c 69 2e 70 72 6f 74 6f 74 79 70 65 2e 70 6f 77 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 46 28 65 29 2c 72 3d 74 68 69 73 2e 76 61 6c 75 65 2c 6e 3d 74 Data Ascii: "+a.toString()+" is too large.");if(this.isSmall&&c(t=Math.pow(o,i)))return new E(R(t));for(r=this,n=_[1];!0&i&&(n=n.times(r),--i),0!==i;){;i/=2,r=r.square()}return n},E.prototype.pow=o.prototype.pow,i.prototype.pow=function(e){var t=F(e),r=this.value,n=t
2024-10-24 07:15:38 UTC	1369	IN	Data Raw: 74 2e 73 69 67 6e 3f 74 2e 73 69 67 6e 3f 31 3a 2d 31 3a 74 2e 69 73 53 6d 61 6c 6c 3f 74 68 69 73 2e 73 69 67 6e 3f 2d 31 3a 31 3a 67 28 72 2c 6e 29 2a 28 74 68 69 73 2e 73 69 67 6e 3f 2d 31 3a 31 29 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6d 70 61 72 65 54 6f 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6d 70 61 72 65 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6d 70 61 72 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 65 3d 3d 3d 31 2f 30 29 72 65 74 75 72 6e 20 2d 31 3b 69 66 28 65 3d 3d 3d 2d 31 2f 30 29 72 65 74 75 72 6e 20 31 3b 76 61 72 20 74 3d 46 28 65 29 2c 72 3d 74 68 69 73 2e 76 61 6c 75 65 2c 6e 3d 74 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 74 2e 69 73 53 6d 61 6c 6c 3f 72 3d 3d 6e 3f 30 3a 72 3e 6e 3f 31 3a 2d 31 3a 72 3c 30 Data Ascii: t.sign?t.sign?1:-1:t.isSmall?this.sign?-1:1:g(r,n)*(this.sign?-1:1)},o.prototype.compareTo=o.prototype.compare,E.prototype.compare=function(e){if(e===1/0)return -1;if(e===-1/0)return 1;var t=F(e),r=this.value,n=t.value;return t.isSmall?r==n?0:r>n?1:-1:r<0
2024-10-24 07:15:38 UTC	1369	IN	Data Raw: 73 73 65 72 4f 72 45 71 75 61 6c 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 30 3e 3d 74 68 69 73 2e 63 6f 6d 70 61 72 65 28 65 29 7d 2c 69 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 71 3d 69 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 73 73 65 72 4f 72 45 71 75 61 6c 73 3d 45 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 71 3d 45 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 73 73 65 72 4f 72 45 71 75 61 6c 73 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 71 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 73 73 65 72 4f 72 45 71 75 61 6c 73 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 45 76 65 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 31 26 74 68 69 73 2e 76 61 6c 75 65 5b 30 5d 29 3d 3d 30 7d 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 45 76 Data Ascii: sserOrEquals=function(e){return 0>=this.compare(e)},i.prototype.leq=i.prototype.lesserOrEquals=E.prototype.leq=E.prototype.lesserOrEquals=o.prototype.leq=o.prototype.lesserOrEquals,o.prototype.isEven=function(){return(1&this.value[0])==0},E.prototype.isEv

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.7	49791	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:38 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:38 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: cea37fdd-f01e-003f-5ff2-24d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071538Z-r197bdfb6b4kzncf21qcaynxz800000001n0000000002a6w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:39 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.7	49792	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:38 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:38 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 25ee231e-901e-0083-60ac-24bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071538Z-15b8d89586fxdh48qknu9dqk2g00000002hg00000000d9u7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:39 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.7	49793	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:38 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:38 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: e7a8c7ed-d01e-00ad-4ff5-24e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071538Z-r197bdfb6b4lbgfqwkqbrm672s000000013000000000a58c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:39 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.7	49790	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:38 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:38 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 7a3803bc-a01e-0021-4af4-24814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071538Z-15b8d89586fsx9lfqmgrbzpgmg0000000e500000000039az x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:39 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.7	49794	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:39 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-24 07:15:39 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=34167 Date: Thu, 24 Oct 2024 07:15:39 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.7	49795	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:39 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:39 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: d9732123-901e-007b-1098-25ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071539Z-15b8d89586fzhrwgk23ex2bvhw00000001gg0000000017g1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:39 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.7	49796	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:39 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:39 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: efcdf68a-a01e-0084-49f2-249ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071539Z-15b8d89586fx2hlt035xdehq580000000e1g00000000c2cv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:39 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.7	49798	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:39 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:39 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 096df01f-c01e-0066-45fd-24a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071539Z-r197bdfb6b4kzncf21qcaynxz800000001dg00000000hcds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:39 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.7	49799	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:39 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:39 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 4fea5f70-201e-0071-57f4-24ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071539Z-r197bdfb6b4r9fwfbdwymmgex80000000150000000003aqv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:39 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.7	49797	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:39 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:39 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:39 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 18d6d76d-f01e-0052-73f2-249224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071539Z-15b8d89586fmhkw4gksnr1w3ds0000000e50000000000dgw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:15:39 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.7	49802	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:40 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:40 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:40 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 28e3a13f-d01e-0049-4f16-25e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071540Z-r197bdfb6b4qpk6v9629ad4b5s0000000bvg00000000hvnu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:40 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.7	49800	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:40 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-24 07:15:40 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=34246 Date: Thu, 24 Oct 2024 07:15:40 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-24 07:15:40 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.7	49803	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:40 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:40 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: d2bab0c5-801e-0078-24f3-24bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071540Z-r197bdfb6b4vlqfn9hfre6k1s80000000c700000000054ww x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:40 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.7	49805	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:40 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:40 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:40 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: f6a2cc2d-401e-0015-3796-250e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071540Z-16849878b782558xg5kpzay6es00000007dg000000001mm6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:40 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.7	49804	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:40 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:40 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:40 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: c52d6895-f01e-001f-0bd3-205dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071540Z-16849878b78dkr6tqerbnpg1zc00000007dg000000005cc8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:40 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.7	49806	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:40 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:40 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:40 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 2f548e5b-201e-003c-5d24-2130f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071540Z-16849878b78dsttbr1qw36rxs800000007e0000000004d8w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:40 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.7	49801	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:41 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=CPvS493CNwvgbpM&MD=v1L4F4AC HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-24 07:15:41 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: de7532ce-92d4-43fe-b6b9-8ff5f7e68e67 MS-RequestId: 7162acfd-7260-4947-9099-c7be2d477142 MS-CV: MzNyAl1jWEWiW01Y.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 24 Oct 2024 07:15:41 GMT Connection: close Content-Length: 24490
2024-10-24 07:15:41 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-24 07:15:41 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.7	49807	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:41 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:41 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:41 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 2df5d45d-601e-003e-40f7-213248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071541Z-16849878b782558xg5kpzay6es000000078g00000000c59t x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:41 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.7	49809	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:41 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:41 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:41 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 8c481607-b01e-0053-3f2b-21cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071541Z-16849878b78fmrkt2ukpvh9wh400000007ag00000000864w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:41 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.7	49810	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:41 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:41 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:41 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 3e8b3e47-701e-006f-544e-22afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071541Z-16849878b78s2lqfdex4tmpp7800000007eg000000003cfe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:15:41 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.7	49811	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:41 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:41 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:41 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: f68a3f25-f01e-0052-02bd-259224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071541Z-16849878b78q4pnrt955f8nkx80000000780000000008t11 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:15:41 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.7	49812	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:41 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:41 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:41 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 5a802a50-001e-0049-3f00-255bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071541Z-15b8d89586flspj6y6m5fk442w000000049000000000fxdx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:41 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.7	49814	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:42 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:42 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:42 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: aaf6fada-701e-0053-683a-223a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071542Z-16849878b78x6gn56mgecg60qc00000000m0000000001a6g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:42 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.7	49815	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:42 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:42 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:42 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 9c2fdade-c01e-002b-16f2-246e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071542Z-15b8d89586fs9clcgrr6f2d6vg000000017g00000000dkw5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:42 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.7	49817	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:42 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:42 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:42 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: d0d0f8e5-601e-000d-298c-212618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071542Z-16849878b78gvgmlcfru6nuc54000000078000000000fc9z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:42 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.7	49818	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:42 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:43 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:42 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 9f3a3312-201e-0096-7bbe-20ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071542Z-16849878b78gvgmlcfru6nuc5400000007b00000000070b1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:43 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.7	49819	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:42 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:43 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:43 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 7902e772-301e-0000-2ff3-24eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071543Z-15b8d89586fs9clcgrr6f2d6vg00000001bg000000006aqk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:43 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.7	49820	162.159.138.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:43 UTC	684	OUT	GET /assets/webMinimal.183cbc8427e6b143ce21.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:43 UTC	965	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:43 GMT Content-Type: text/javascript Content-Length: 14624305 Connection: close CF-Ray: 8d782d6248bc4636-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "216cb783d60a3e7c57c9d9ffea99dc3f" Last-Modified: Thu, 24 Oct 2024 03:15:20 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FVU3E5VHhGTwLg0l%2BSvgd4gDVVOpd9bbwxfjPPRNTlwj8iiKsPOTFtMhllvJn4Bll4srP1kJmhrlozOxTzeCtP42ZZ%2BypDXtbJkH0ifP3Gy%2BNS2en6oIyJK2ljAH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:43 UTC	1369	IN	Data Raw: 28 28 29 3d 3e 7b 76 61 72 20 65 3d 7b 33 38 35 30 30 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 7b 22 2e 2f 64 65 2e 6a 73 6f 6e 61 22 3a 5b 22 36 34 34 37 35 33 22 2c 22 33 30 32 34 34 22 5d 2c 22 2e 2f 7a 68 2d 43 4e 2e 6a 73 6f 6e 61 22 3a 5b 22 34 39 34 30 36 32 22 2c 22 35 36 34 34 36 22 5d 2c 22 2e 2f 64 61 2e 6a 73 6f 6e 61 22 3a 5b 22 34 34 38 36 37 22 2c 22 35 37 33 38 37 22 5d 2c 22 2e 2f 65 6c 2e 6a 73 6f 6e 61 22 3a 5b 22 35 38 31 31 34 34 22 2c 22 35 35 36 30 31 22 5d 2c 22 2e 2f 74 72 2e 6a 73 6f 6e 61 22 3a 5b 22 31 34 36 38 37 38 22 2c 22 38 34 33 38 35 22 5d 2c 22 2e 2f 65 73 2d 45 53 2e 6a 73 6f 6e 61 22 3a 5b 22 38 37 32 35 35 30 22 2c 22 34 35 37 34 37 22 5d 2c 22 2e 2f 68 72 2e 6a 73 6f 6e 61 22 3a 5b 22 Data Ascii: (()=>{var e={385007:function(e,t,n){var r={"./de.jsona":["644753","30244"],"./zh-CN.jsona":["494062","56446"],"./da.jsona":["44867","57387"],"./el.jsona":["581144","55601"],"./tr.jsona":["146878","84385"],"./es-ES.jsona":["872550","45747"],"./hr.jsona":["
2024-10-24 07:15:43 UTC	1369	IN	Data Raw: 30 31 37 2d 31 31 2d 31 36 2e 6d 70 34 22 3a 22 32 32 31 38 32 35 22 2c 22 2e 2f 63 68 61 6e 6e 65 6c 2d 66 6f 6c 6c 6f 77 69 6e 67 2e 70 6e 67 22 3a 22 32 34 37 38 31 35 22 2c 22 2e 2f 64 69 73 63 6f 76 65 72 79 2e 6a 70 67 22 3a 22 37 37 38 36 30 38 22 2c 22 2e 2f 67 32 35 30 6b 2d 63 6c 2e 6d 70 34 22 3a 22 39 30 39 38 35 31 22 2c 22 2e 2f 68 79 70 65 73 71 75 61 64 2d 68 61 63 6b 2d 77 65 65 6b 2f 68 65 61 64 65 72 2e 70 6e 67 22 3a 22 38 31 39 30 39 31 22 2c 22 2e 2f 68 79 70 65 73 71 75 61 64 2d 68 61 63 6b 2d 77 65 65 6b 2f 70 61 6c 61 64 69 6e 73 2d 6c 6f 6f 74 2e 70 6e 67 22 3a 22 37 34 32 33 30 35 22 2c 22 2e 2f 6b 6f 2d 6e 65 77 2d 79 65 61 72 2e 6a 70 67 22 3a 22 32 36 35 39 32 31 22 2c 22 2e 2f 70 6f 6c 69 73 68 2d 77 65 65 6b 2e 70 6e 67 22 Data Ascii: 017-11-16.mp4":"221825","./channel-following.png":"247815","./discovery.jpg":"778608","./g250k-cl.mp4":"909851","./hypesquad-hack-week/header.png":"819091","./hypesquad-hack-week/paladins-loot.png":"742305","./ko-new-year.jpg":"265921","./polish-week.png"
2024-10-24 07:15:43 UTC	1369	IN	Data Raw: 63 6f 64 65 2e 73 76 67 22 3a 22 38 39 34 39 39 30 22 2c 22 2e 2f 69 63 6f 6e 2d 66 69 6c 65 2d 64 6f 63 75 6d 65 6e 74 2e 73 76 67 22 3a 22 36 37 34 37 32 30 22 2c 22 2e 2f 69 63 6f 6e 2d 66 69 6c 65 2d 69 6d 61 67 65 2e 73 76 67 22 3a 22 31 30 39 38 33 37 22 2c 22 2e 2f 69 63 6f 6e 2d 66 69 6c 65 2d 70 73 2e 73 76 67 22 3a 22 35 30 34 35 31 34 22 2c 22 2e 2f 69 63 6f 6e 2d 66 69 6c 65 2d 73 6b 65 74 63 68 2e 73 76 67 22 3a 22 33 39 32 38 30 37 22 2c 22 2e 2f 69 63 6f 6e 2d 66 69 6c 65 2d 73 70 72 65 61 64 73 68 65 65 74 2e 73 76 67 22 3a 22 32 39 31 34 31 30 22 2c 22 2e 2f 69 63 6f 6e 2d 66 69 6c 65 2d 75 6e 6b 6e 6f 77 6e 2e 73 76 67 22 3a 22 35 31 36 30 38 33 22 2c 22 2e 2f 69 63 6f 6e 2d 66 69 6c 65 2d 76 69 64 65 6f 2e 73 76 67 22 3a 22 34 33 30 35 Data Ascii: code.svg":"894990","./icon-file-document.svg":"674720","./icon-file-image.svg":"109837","./icon-file-ps.svg":"504514","./icon-file-sketch.svg":"392807","./icon-file-spreadsheet.svg":"291410","./icon-file-unknown.svg":"516083","./icon-file-video.svg":"4305
2024-10-24 07:15:43 UTC	1369	IN	Data Raw: 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 31 66 33 66 65 2d 33 32 2e 70 6e 67 22 3a 22 35 34 32 37 31 31 22 2c 22 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 31 66 33 66 65 2d 34 30 2e 70 6e 67 22 3a 22 38 35 35 32 36 36 22 2c 22 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 31 66 33 66 65 2d 34 38 2e 70 6e 67 22 3a 22 38 39 37 39 30 36 22 2c 22 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 31 66 33 66 66 2d 33 32 2e 70 6e 67 22 3a 22 32 30 39 33 36 39 22 2c 22 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 31 66 33 66 66 2d 34 30 2e 70 6e 67 22 3a 22 38 36 32 38 36 31 22 2c 22 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 31 66 33 66 66 2d 34 38 2e 70 6e 67 22 3a 22 33 30 30 38 37 38 22 2c 22 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 65 6d 6f 6a 69 2d 33 32 2e 70 6e 67 22 Data Ascii: ./spritesheet-1f3fe-32.png":"542711","./spritesheet-1f3fe-40.png":"855266","./spritesheet-1f3fe-48.png":"897906","./spritesheet-1f3ff-32.png":"209369","./spritesheet-1f3ff-40.png":"862861","./spritesheet-1f3ff-48.png":"300878","./spritesheet-emoji-32.png"
2024-10-24 07:15:43 UTC	1369	IN	Data Raw: 61 6c 6c 5f 72 69 6e 67 69 6e 67 5f 73 6e 6f 77 73 67 69 76 69 6e 67 2e 6d 70 33 22 3a 22 33 36 36 34 34 22 2c 22 2e 2f 63 6c 69 70 5f 65 72 72 6f 72 2e 6d 70 33 22 3a 22 34 35 35 39 34 22 2c 22 2e 2f 63 6c 69 70 5f 73 61 76 65 2e 6d 70 33 22 3a 22 31 32 31 34 32 30 22 2c 22 2e 2f 64 64 72 2d 64 6f 77 6e 2e 6d 70 33 22 3a 22 38 37 39 36 32 22 2c 22 2e 2f 64 64 72 2d 6c 65 66 74 2e 6d 70 33 22 3a 22 32 35 35 32 33 37 22 2c 22 2e 2f 64 64 72 2d 72 69 67 68 74 2e 6d 70 33 22 3a 22 38 35 36 31 36 33 22 2c 22 2e 2f 64 64 72 2d 75 70 2e 6d 70 33 22 3a 22 37 32 32 32 33 37 22 2c 22 2e 2f 64 65 61 66 65 6e 2e 6d 70 33 22 3a 22 35 38 35 33 38 39 22 2c 22 2e 2f 64 69 73 63 6f 64 6f 2e 6d 70 33 22 3a 22 33 36 31 35 31 30 22 2c 22 2e 2f 64 69 73 63 6f 6e 6e 65 63 74 Data Ascii: all_ringing_snowsgiving.mp3":"36644","./clip_error.mp3":"45594","./clip_save.mp3":"121420","./ddr-down.mp3":"87962","./ddr-left.mp3":"255237","./ddr-right.mp3":"856163","./ddr-up.mp3":"722237","./deafen.mp3":"585389","./discodo.mp3":"361510","./disconnect
2024-10-24 07:15:43 UTC	1369	IN	Data Raw: 2e 2f 73 74 61 67 65 5f 77 61 69 74 69 6e 67 2e 6d 70 33 22 3a 22 36 31 37 35 31 30 22 2c 22 2e 2f 73 74 72 65 61 6d 5f 65 6e 64 65 64 2e 6d 70 33 22 3a 22 33 30 37 33 33 34 22 2c 22 2e 2f 73 74 72 65 61 6d 5f 73 74 61 72 74 65 64 2e 6d 70 33 22 3a 22 39 31 31 33 36 38 22 2c 22 2e 2f 73 74 72 65 61 6d 5f 75 73 65 72 5f 6a 6f 69 6e 65 64 2e 6d 70 33 22 3a 22 31 39 35 31 32 39 22 2c 22 2e 2f 73 74 72 65 61 6d 5f 75 73 65 72 5f 6c 65 66 74 2e 6d 70 33 22 3a 22 38 32 38 36 36 30 22 2c 22 2e 2f 73 75 63 63 65 73 73 2e 6d 70 33 22 3a 22 34 39 39 33 35 33 22 2c 22 2e 2f 75 6e 64 65 61 66 65 6e 2e 6d 70 33 22 3a 22 39 33 39 38 39 31 22 2c 22 2e 2f 75 6e 6d 75 74 65 2e 6d 70 33 22 3a 22 33 36 30 33 39 34 22 2c 22 2e 2f 75 73 65 72 5f 6a 6f 69 6e 2e 6d 70 33 22 3a Data Ascii: ./stage_waiting.mp3":"617510","./stream_ended.mp3":"307334","./stream_started.mp3":"911368","./stream_user_joined.mp3":"195129","./stream_user_left.mp3":"828660","./success.mp3":"499353","./undeafen.mp3":"939891","./unmute.mp3":"360394","./user_join.mp3":
2024-10-24 07:15:43 UTC	1369	IN	Data Raw: 77 61 7c 61 62 61 63 7c 61 63 28 65 72 7c 6f 6f 7c 73 5c 2d 29 7c 61 69 28 6b 6f 7c 72 6e 29 7c 61 6c 28 61 76 7c 63 61 7c 63 6f 29 7c 61 6d 6f 69 7c 61 6e 28 65 78 7c 6e 79 7c 79 77 29 7c 61 70 74 75 7c 61 72 28 63 68 7c 67 6f 29 7c 61 73 28 74 65 7c 75 73 29 7c 61 74 74 77 7c 61 75 28 64 69 7c 5c 2d 6d 7c 72 20 7c 73 20 29 7c 61 76 61 6e 7c 62 65 28 63 6b 7c 6c 6c 7c 6e 71 29 7c 62 69 28 6c 62 7c 72 64 29 7c 62 6c 28 61 63 7c 61 7a 29 7c 62 72 28 65 7c 76 29 77 7c 62 75 6d 62 7c 62 77 5c 2d 28 6e 7c 75 29 7c 63 35 35 5c 2f 7c 63 61 70 69 7c 63 63 77 61 7c 63 64 6d 5c 2d 7c 63 65 6c 6c 7c 63 68 74 6d 7c 63 6c 64 63 7c 63 6d 64 5c 2d 7c 63 6f 28 6d 70 7c 6e 64 29 7c 63 72 61 77 7c 64 61 28 69 74 7c 6c 6c 7c 6e 67 29 7c 64 62 74 65 7c 64 63 5c 2d 73 7c 64 Data Ascii: wa\|abac\|ac(er\|oo\|s\-)\|ai(ko\|rn)\|al(av\|ca\|co)\|amoi\|an(ex\|ny\|yw)\|aptu\|ar(ch\|go)\|as(te\|us)\|attw\|au(di\|\-m\|r \|s )\|avan\|be(ck\|ll\|nq)\|bi(lb\|rd)\|bl(ac\|az)\|br(e\|v)w\|bumb\|bw\-(n\|u)\|c55\/\|capi\|ccwa\|cdm\-\|cell\|chtm\|cldc\|cmd\-\|co(mp\|nd)\|craw\|da(it\|ll\|ng)\|dbte\|dc\-s\|d
2024-10-24 07:15:43 UTC	1369	IN	Data Raw: 7c 6d 35 29 7c 74 78 5c 2d 39 7c 75 70 28 5c 2e 62 7c 67 31 7c 73 69 29 7c 75 74 73 74 7c 76 34 30 30 7c 76 37 35 30 7c 76 65 72 69 7c 76 69 28 72 67 7c 74 65 29 7c 76 6b 28 34 30 7c 35 5b 30 2d 33 5d 7c 5c 2d 76 29 7c 76 6d 34 30 7c 76 6f 64 61 7c 76 75 6c 63 7c 76 78 28 35 32 7c 35 33 7c 36 30 7c 36 31 7c 37 30 7c 38 30 7c 38 31 7c 38 33 7c 38 35 7c 39 38 29 7c 77 33 63 28 5c 2d 7c 20 29 7c 77 65 62 63 7c 77 68 69 74 7c 77 69 28 67 20 7c 6e 63 7c 6e 77 29 7c 77 6d 6c 62 7c 77 6f 6e 75 7c 78 37 30 30 7c 79 61 73 5c 2d 7c 79 6f 75 72 7c 7a 65 74 6f 7c 7a 74 65 5c 2d 2f 69 2e 74 65 73 74 28 65 2e 73 75 62 73 74 72 28 30 2c 34 29 29 7d 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 28 30 2c 74 2e 69 73 53 61 66 61 72 Data Ascii: \|m5)\|tx\-9\|up(\.b\|g1\|si)\|utst\|v400\|v750\|veri\|vi(rg\|te)\|vk(40\|5[0-3]\|\-v)\|vm40\|voda\|vulc\|vx(52\|53\|60\|61\|70\|80\|81\|83\|85\|98)\|w3c(\-\| )\|webc\|whit\|wi(g \|nc\|nw)\|wmlb\|wonu\|x700\|yas\-\|your\|zeto\|zte\-/i.test(e.substr(0,4))},e.exports=function(){return!(0,t.isSafar
2024-10-24 07:15:43 UTC	1369	IN	Data Raw: 65 6d 69 62 6f 6c 64 69 74 61 6c 69 63 2e 77 6f 66 66 32 22 3a 5b 22 34 38 30 38 35 34 22 5d 2c 22 2e 2f 73 6f 75 72 63 65 2d 63 6f 64 65 2d 70 72 6f 2f 73 6f 75 72 63 65 63 6f 64 65 70 72 6f 2d 37 30 30 2d 62 6f 6c 64 2e 77 6f 66 66 32 22 3a 5b 22 37 31 31 33 31 33 22 5d 2c 22 2e 2f 6e 6f 74 6f 2d 73 61 6e 73 2f 6e 6f 74 6f 73 61 6e 73 2d 34 30 30 2d 6e 6f 72 6d 61 6c 2e 77 6f 66 66 32 22 3a 5b 22 31 33 34 31 33 31 22 5d 2c 22 2e 2f 61 62 63 2d 67 69 6e 74 6f 2d 6e 6f 72 64 2f 61 62 63 67 69 6e 74 6f 6e 6f 72 64 2d 38 30 30 2d 65 78 74 72 61 62 6f 6c 64 2e 77 6f 66 66 32 22 3a 5b 22 38 31 34 37 32 37 22 5d 2c 22 2e 2f 6e 6f 74 6f 2d 73 61 6e 73 2f 6e 6f 74 6f 73 61 6e 73 2d 37 30 30 2d 62 6f 6c 64 69 74 61 6c 69 63 2e 77 6f 66 66 32 22 3a 5b 22 33 37 36 Data Ascii: emibolditalic.woff2":["480854"],"./source-code-pro/sourcecodepro-700-bold.woff2":["711313"],"./noto-sans/notosans-400-normal.woff2":["134131"],"./abc-ginto-nord/abcgintonord-800-extrabold.woff2":["814727"],"./noto-sans/notosans-700-bolditalic.woff2":["376
2024-10-24 07:15:43 UTC	1369	IN	Data Raw: 38 38 33 22 2c 22 2e 2f 68 72 22 3a 22 36 30 31 32 30 33 22 2c 22 2e 2f 68 72 2e 6a 73 6f 6e 22 3a 22 36 30 31 32 30 33 22 2c 22 2e 2f 68 75 22 3a 22 32 37 35 31 31 38 22 2c 22 2e 2f 68 75 2e 6a 73 6f 6e 22 3a 22 32 37 35 31 31 38 22 2c 22 2e 2f 69 64 22 3a 22 31 32 36 34 32 22 2c 22 2e 2f 69 64 2e 6a 73 6f 6e 22 3a 22 31 32 36 34 32 22 2c 22 2e 2f 69 74 22 3a 22 33 39 31 35 37 37 22 2c 22 2e 2f 69 74 2e 6a 73 6f 6e 22 3a 22 33 39 31 35 37 37 22 2c 22 2e 2f 6a 61 22 3a 22 38 33 30 36 36 36 22 2c 22 2e 2f 6a 61 2e 6a 73 6f 6e 22 3a 22 38 33 30 36 36 36 22 2c 22 2e 2f 6b 6f 22 3a 22 36 37 36 35 33 22 2c 22 2e 2f 6b 6f 2e 6a 73 6f 6e 22 3a 22 36 37 36 35 33 22 2c 22 2e 2f 6c 74 22 3a 22 37 32 38 31 30 39 22 2c 22 2e 2f 6c 74 2e 6a 73 6f 6e 22 3a 22 37 32 38 Data Ascii: 883","./hr":"601203","./hr.json":"601203","./hu":"275118","./hu.json":"275118","./id":"12642","./id.json":"12642","./it":"391577","./it.json":"391577","./ja":"830666","./ja.json":"830666","./ko":"67653","./ko.json":"67653","./lt":"728109","./lt.json":"728

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.7	49822	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:43 UTC	883	OUT	GET /assets/591980d24607547de30a.css HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:43 UTC	961	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:43 GMT Content-Type: text/css Content-Length: 41018 Connection: close CF-Ray: 8d782d66cb9c6b36-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "fbec530f567cb32c81348642102c8348" Last-Modified: Fri, 11 Oct 2024 19:21:44 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M2Ao1c2qxW%2FhBwhoTccxXlL3xT7WI0fByS9%2BLWq1DCIgbcAycXDQTYaG56QszjkUftl%2FO3HVkOoKyPLaefcpYM32%2B9%2B9UPiOqu258TQq7pHI6JgqldRcse5wKe9%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:43 UTC	1369	IN	Data Raw: 2e 64 69 73 63 6f 72 64 4c 6f 67 6f 5f 62 38 33 61 30 35 7b 68 65 69 67 68 74 3a 33 36 70 78 3b 77 69 64 74 68 3a 31 31 32 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 61 73 73 65 74 73 2f 32 33 61 37 61 33 66 64 36 36 32 34 33 34 32 31 31 37 62 66 2e 73 76 67 29 6e 6f 2d 72 65 70 65 61 74 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 66 6c 65 78 2d 73 68 72 69 6e 6b 3a 30 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 36 70 78 7d 2e 61 75 74 68 42 6f 78 5f 62 38 33 61 30 35 7b 77 69 64 74 68 3a 34 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 63 75 73 74 6f 6d 2d 61 75 74 68 2d 62 6f 78 2d 61 75 74 68 2d 62 6f 78 2d 70 61 64 64 69 6e 67 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 38 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 76 61 72 28 2d Data Ascii: .discordLogo_b83a05{height:36px;width:112px;background:url(/assets/23a7a3fd6624342117bf.svg)no-repeat;display:none;flex-shrink:0;margin-bottom:16px}.authBox_b83a05{width:480px;padding:var(--custom-auth-box-auth-box-padding);font-size:18px;box-shadow:var(-
2024-10-24 07:15:43 UTC	1369	IN	Data Raw: 64 65 72 2d 72 61 64 69 75 73 3a 30 3b 6f 76 65 72 66 6c 6f 77 3a 73 63 72 6f 6c 6c 7d 2e 69 73 2d 6d 6f 62 69 6c 65 20 2e 61 75 74 68 42 6f 78 5f 62 38 33 61 30 35 20 2e 64 69 73 63 6f 72 64 4c 6f 67 6f 5f 62 38 33 61 30 35 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 74 6f 70 3a 31 36 70 78 7d 40 6d 65 64 69 61 28 6d 61 78 2d 77 69 64 74 68 3a 38 33 30 70 78 29 7b 2e 69 73 2d 6d 6f 62 69 6c 65 20 2e 61 75 74 68 42 6f 78 5f 62 38 33 61 30 35 2e 61 75 74 68 42 6f 78 45 78 70 61 6e 64 65 64 5f 62 38 33 61 30 35 7b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 7d 7d 2e 69 73 2d 6d 6f 62 69 6c 65 20 2e 61 75 74 68 42 6f 78 5f 62 38 33 61 30 35 20 2e 63 65 6e 74 65 72 69 6e 67 57 72 61 70 70 65 72 5f 62 38 33 61 30 35 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 Data Ascii: der-radius:0;overflow:scroll}.is-mobile .authBox_b83a05 .discordLogo_b83a05{display:block;top:16px}@media(max-width:830px){.is-mobile .authBox_b83a05.authBoxExpanded_b83a05{max-width:none}}.is-mobile .authBox_b83a05 .centeringWrapper_b83a05{position:relat
2024-10-24 07:15:43 UTC	1369	IN	Data Raw: 2d 74 65 78 74 2d 6d 75 74 65 64 29 7d 2e 6a 6f 69 6e 69 6e 67 41 73 5f 62 38 33 61 30 35 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 2e 6a 6f 69 6e 69 6e 67 41 73 41 76 61 74 61 72 5f 62 38 33 61 30 35 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 31 34 70 78 7d 2e 6a 6f 69 6e 69 6e 67 41 73 55 73 65 72 6e 61 6d 65 5f 62 38 33 61 30 35 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 7d 2e 73 70 69 6e 6e 65 72 56 69 64 65 6f 5f 62 38 33 61 30 35 7b 77 69 64 74 68 3a 32 30 30 70 78 3b 68 65 69 67 68 74 3a 32 30 30 70 78 7d 2e 69 6d 61 67 65 5f 62 38 33 61 30 Data Ascii: -text-muted)}.joiningAs_b83a05{margin-top:20px;height:100%;display:flex;justify-content:center;align-items:center}.joiningAsAvatar_b83a05{margin-left:14px}.joiningAsUsername_b83a05{margin-left:5px}.spinnerVideo_b83a05{width:200px;height:200px}.image_b83a0
2024-10-24 07:15:43 UTC	1369	IN	Data Raw: 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 65 63 6f 6e 64 61 72 79 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 38 70 78 7d 2e 77 68 61 74 49 74 65 6d 5f 64 64 61 36 35 62 7b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 6d 6f 64 69 66 69 65 72 2d 61 63 63 65 6e 74 29 7d 2e 70 68 6f 6e 65 46 69 65 6c 64 50 6f 70 6f 75 74 5f 66 66 37 36 31 62 7b 77 69 64 74 68 3a 32 32 30 70 78 3b 68 65 69 67 68 74 3a 32 34 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 34 30 70 78 3b 6c 65 66 74 3a 30 7d 2e 70 68 6f 6e 65 46 69 65 6c 64 50 6f 70 6f 75 74 Data Ascii: {background-color:var(--background-secondary);border-radius:4px;margin-bottom:8px}.whatItem_dda65b{border-top:1px solid var(--background-modifier-accent)}.phoneFieldPopout_ff761b{width:220px;height:240px;position:absolute;top:40px;left:0}.phoneFieldPopout
2024-10-24 07:15:43 UTC	1369	IN	Data Raw: 69 67 68 74 54 65 78 74 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 48 69 67 68 6c 69 67 68 74 3b 63 6f 6c 6f 72 3a 48 69 67 68 6c 69 67 68 74 7d 2e 69 6e 70 75 74 5f 63 63 36 64 64 64 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 2e 69 6e 70 75 74 57 72 61 70 70 65 72 5f 63 63 36 64 64 64 7b 66 6c 65 78 2d 67 72 6f 77 3a 31 7d 2e 69 6e 70 75 74 46 69 65 6c 64 5f 63 63 36 64 64 64 7b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 2e 65 6e 61 62 6c 65 2d 66 6f 72 63 65 64 2d 63 6f 6c 6f 72 73 20 2e 69 6e 70 75 74 5f 63 63 36 64 64 64 7b 62 6f 72 64 65 72 3a 6e 6f 6e 65 7d 2e 69 6d 61 67 65 5f 61 34 64 39 62 64 7b 68 65 69 67 68 74 Data Ascii: ightText;border-color:Highlight;color:Highlight}.input_cc6ddd{display:flex;align-items:center}.inputWrapper_cc6ddd{flex-grow:1}.inputField_cc6ddd{border:none;background-color:transparent}.enable-forced-colors .input_cc6ddd{border:none}.image_a4d9bd{height
2024-10-24 07:15:43 UTC	1369	IN	Data Raw: 31 36 70 78 7d 2e 74 69 74 6c 65 5f 65 37 33 35 32 38 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 34 70 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 68 65 61 64 65 72 2d 70 72 69 6d 61 72 79 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 7d 40 6d 65 64 69 61 28 6d 69 6e 2d 68 65 69 67 68 74 3a 36 34 30 70 78 29 7b 2e 74 69 74 6c 65 5f 65 37 33 35 32 38 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 7d 7d 2e 61 63 74 69 76 69 74 79 43 6f 75 6e 74 5f 65 37 33 35 32 38 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 34 70 78 7d 40 6d 65 64 69 61 28 6d 69 6e 2d 68 65 69 67 68 74 3a 36 34 30 70 78 29 7b 2e 61 63 74 69 Data Ascii: 16px}.title_e73528{margin-top:4px;display:flex;align-items:center;justify-content:center;color:var(--header-primary);font-weight:600}@media(min-height:640px){.title_e73528{margin-top:8px}}.activityCount_e73528{margin-top:4px}@media(min-height:640px){.acti
2024-10-24 07:15:43 UTC	1369	IN	Data Raw: 69 6d 65 5f 64 36 61 34 37 35 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 6e 65 77 42 61 64 67 65 5f 64 36 61 34 37 35 7b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 72 61 6e 64 2d 32 36 30 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 32 70 78 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 66 6c 65 78 2d 73 68 72 69 6e 6b 3a 30 3b 68 65 69 67 68 74 3a 32 30 70 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 30 20 36 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 65 78 74 2d 74 6f 70 7d 2e 6e 65 77 42 61 64 67 65 54 Data Ascii: ime_d6a475{display:inline-block}.newBadge_d6a475{align-items:center;background-color:var(--brand-260);border-radius:12px;display:inline-flex;flex-shrink:0;height:20px;justify-content:center;margin-right:8px;padding:0 6px;vertical-align:text-top}.newBadgeT
2024-10-24 07:15:43 UTC	1369	IN	Data Raw: 2e 65 76 65 6e 74 4e 61 6d 65 5f 61 34 65 63 36 32 7b 63 6f 6c 6f 72 3a 42 75 74 74 6f 6e 54 65 78 74 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 2e 77 72 61 70 70 65 72 5f 61 37 31 61 31 63 7b 63 75 72 73 6f 72 3a 64 65 66 61 75 6c 74 3b 2d 77 65 62 6b 69 74 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 2d 6d 6f 7a 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 65 63 6f 6e 64 61 72 79 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 3b 70 61 Data Ascii: .eventName_a4ec62{color:ButtonText;-webkit-text-decoration:underline;text-decoration:underline}.wrapper_a71a1c{cursor:default;-webkit-user-select:none;-moz-user-select:none;user-select:none;background-color:var(--background-secondary);border-radius:4px;pa
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 78 3b 68 65 69 67 68 74 3a 38 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 7d 2e 73 74 61 74 75 73 57 72 61 70 70 65 72 5f 61 37 31 61 31 63 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 3a 30 20 31 20 61 75 74 6f 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 66 6c 65 78 2d 66 6c 6f 77 3a 6e 6f 77 72 61 70 3b 6d 69 6e 2d 77 69 64 74 68 3a 30 7d 2e 73 74 61 74 75 73 4f 6e 6c 69 6e 65 5f 61 37 31 61 31 63 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 67 72 65 65 6e 2d 33 36 30 29 7d 2e 73 74 61 74 75 73 4f 66 66 6c 69 6e 65 5f 61 37 31 61 31 63 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 70 72 69 6d 61 72 79 2d 34 30 30 29 7d 2e 63 6f 75 6e 74 5f 61 37 31 61 31 63 7b Data Ascii: x;height:8px;border-radius:50%}.statusWrapper_a71a1c{display:flex;flex:0 1 auto;align-items:center;flex-flow:nowrap;min-width:0}.statusOnline_a71a1c{background-color:var(--green-360)}.statusOffline_a71a1c{background-color:var(--primary-400)}.count_a71a1c{
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 2d 68 65 69 67 68 74 3a 32 30 70 78 3b 61 6c 69 67 6e 2d 73 65 6c 66 3a 63 65 6e 74 65 72 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 65 6c 6c 69 70 73 69 73 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 66 6c 65 78 3a 31 20 30 20 61 75 74 6f 7d 2e 62 75 74 74 6f 6e 5f 61 37 31 61 31 63 2e 62 75 74 74 6f 6e 53 69 7a 65 5f 61 37 31 61 31 63 7b 68 65 69 67 68 74 3a 34 30 70 78 7d 2e 67 75 69 6c 64 49 63 6f 6e 45 78 70 69 72 65 64 5f 61 37 31 61 31 63 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 65 63 6f 6e 64 61 72 79 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 35 30 70 78 20 32 36 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d Data Ascii: -height:20px;align-self:center;white-space:nowrap;text-overflow:ellipsis;overflow:hidden;flex:1 0 auto}.button_a71a1c.buttonSize_a71a1c{height:40px}.guildIconExpired_a71a1c{background-color:var(--background-secondary);background-size:50px 26px;background-

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.7	49821	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:43 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:44 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:44 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 55d9b643-201e-003f-330b-226d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071544Z-16849878b787psctgubawhx7k8000000073g00000000fbn9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:44 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.7	49828	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:44 UTC	883	OUT	GET /assets/2917679ca8a08c390036.css HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:44 UTC	961	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:44 GMT Content-Type: text/css Content-Length: 957 Connection: close CF-Ray: 8d782d6879ec6b8f-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "20ddaa519e404695d0657d3868d2701f" Last-Modified: Tue, 25 Jun 2024 20:41:32 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hwWc2P%2BlFLjE9B4jbpmt63eSl6MrtqHuoTx1CP5dRxxhvJb4kQn7D%2BGHyR3iP9Zap2E8BGyj7Rtsc%2FLpNMeDtMTTa8R%2BvVGi1wxW%2FmQ%2FPm1tMzX%2B09kcfEOFWZnz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:44 UTC	408	IN	Data Raw: 2e 77 72 61 70 70 65 72 5f 63 64 32 32 65 37 2c 2e 61 63 74 69 76 65 57 72 61 70 70 65 72 5f 63 64 32 32 65 37 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 6c 65 66 74 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 7a 2d 69 6e 64 65 78 3a 31 30 30 32 7d 2e 77 72 61 70 70 65 72 5f 63 64 32 32 65 37 7b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 7d 2e 76 69 64 65 6f 57 72 61 70 70 65 72 5f 63 64 32 32 65 37 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 2d 35 30 25 29 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 7a 2d 69 6e 64 65 78 3a 32 30 30 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a Data Ascii: .wrapper_cd22e7,.activeWrapper_cd22e7{height:100%;left:0;position:absolute;top:0;width:100%;z-index:1002}.wrapper_cd22e7{pointer-events:none}.videoWrapper_cd22e7{position:absolute;transform:translate(-50%,-50%);top:50%;left:50%;z-index:200;pointer-events:
2024-10-24 07:15:44 UTC	549	IN	Data Raw: 74 65 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 3b 7a 2d 69 6e 64 65 78 3a 32 30 30 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 7d 2e 67 61 64 69 65 6e 74 48 69 67 68 6c 69 67 68 74 5f 63 64 32 32 65 37 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 39 30 64 65 67 2c 76 61 72 28 2d 2d 70 72 65 6d 69 75 6d 2d 74 69 65 72 2d 32 2d 70 75 72 70 6c 65 2d 66 6f 72 2d 67 72 61 64 69 65 6e 74 73 29 30 25 2c 76 61 72 28 2d 2d 70 72 65 6d 69 75 6d 2d Data Ascii: te;pointer-events:none;z-index:200;top:0;left:0;width:100%;height:100%}.gadientHighlight_cd22e7{position:absolute;width:100%;height:100%;pointer-events:none;background-image:linear-gradient(90deg,var(--premium-tier-2-purple-for-gradients)0%,var(--premium-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.7	49829	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:44 UTC	909	OUT	GET /assets/8234e0a75aa9afb205bd.woff2 HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://discord.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:44 UTC	967	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:44 GMT Content-Type: font/woff2 Content-Length: 43364 Connection: close CF-Ray: 8d782d688fd0e946-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "281bba49537cf936d1a0df10fb719f63" Last-Modified: Wed, 05 Jun 2024 19:27:59 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BEcK5kiSLTDDGWdjL7Pu5Sqwxib9AoCSybtYU8ps3465EmT1yhsg%2F4F%2Fj0u5tMZFMFXfgAjdoBUYYeYKo%2FP4Sq28OgljOEo53Y7HSXwv%2FtThc92%2BBpA0%2B%2FusBE4X"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 a9 64 00 11 00 00 00 01 97 38 00 00 a9 00 00 03 00 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 82 78 1b 81 aa 40 1c a1 5c 06 60 00 8e 58 08 82 3e 09 9f 03 11 0c 0a 83 b6 0c 82 f9 22 01 36 02 24 03 9a 0c 0b 8d 08 00 04 20 05 95 05 07 b5 4b 0c 83 0e 5b 1e 71 91 02 aa 63 ed 9f 01 10 35 aa 6e 43 00 a8 fc 55 97 9b e7 1d 3f c1 94 ab 71 1c 7a 6e 1d 3c a9 96 2d ea 01 dc 61 a3 9c 43 cd b3 ad 4a 3b ec c5 38 fb ff ff ff ff 73 93 85 1c d6 ce d2 99 4d 12 40 35 a1 75 ff 46 97 94 11 14 29 17 27 a2 4e f3 02 39 7b 55 92 27 09 e7 75 81 0d f6 7c d8 3b 57 ae f3 99 9d f2 91 1f 67 7a 3b 6d 0e 6f 92 bc 26 41 82 b7 bb f7 be 6f da 2e 8b 93 9b ea bc c6 bb b0 94 56 6d 2f 90 f6 04 01 61 9a 56 4e 46 8b fb ac f0 b5 b4 ba fc 54 2f 24 Data Ascii: wOF2d8x@\`X>"6$ K[qc5nCU?qzn<-aCJ;8sM@5uF)'N9{U'u\|;Wgz;mo&Ao.Vm/aVNFT/$
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 80 14 53 25 e7 40 56 0a d3 e5 54 4e aa 7c 2c da cb e9 65 97 5d 6b cb fa df bd ef e1 ff ff de ff 00 f8 3f 20 02 1f 24 05 82 a2 0d 42 b4 0d 82 a2 06 a4 1a 9a 3d 00 29 4f 40 4a 93 43 29 4d 72 9a d2 e5 49 9b e9 60 53 21 39 32 45 75 ca a5 29 bd d7 cd 26 cb 2c b3 da b6 b6 d8 66 b1 db cc 32 27 cb f8 7d 7b eb 67 f7 ed 23 c4 68 3c 59 83 73 d3 75 ab 5f 4d 4d 6d cf 90 62 98 ee d7 f3 a6 27 ee 2e 31 a9 2c 7c 52 ff a0 38 28 84 44 e3 b1 1a 89 fc 12 a9 39 1e 84 17 c0 d3 bb fc 9f 7d 3b f7 d3 12 93 71 9b 83 50 8e 7d 2a 97 ba 03 dd 21 14 68 8b b0 dd a2 51 95 e7 f9 f6 ba ec 5c 47 24 6e 90 11 32 de f1 3f f5 d1 07 95 83 eb 45 55 b5 55 9a f5 41 6e 69 72 2d c2 2d 3c 7d 63 ab c2 db 90 a6 fd 52 e9 4d 6c 05 1f 64 20 41 54 0d 8d 1a 21 ea 9d 7d ee 53 a9 93 fd 8b 72 f4 90 7a e3 8c 09 Data Ascii: S%@VTN\|,e]k? $B=)O@JC)MrI`S!92Eu)&,f2'}{g#h<Ysu_MMmb'.1,\|R8(D9};qP}*!hQ\G$n2?EUUAnir--<}cRMld AT!}Srz
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: ce 78 e9 50 de 41 bf 29 da 45 33 a6 04 00 75 bb 25 ad 2e b9 7f 2a 5f 7f c4 03 66 de e3 6d 10 70 00 dd 0d bc ee 7e 5f c1 3b af 2e f1 3b 10 c9 df 4e 65 af f3 fa e8 e6 87 14 35 7b 6d 69 d0 a0 6b 03 0d 03 b2 a1 ab 2e d0 7b f1 15 94 25 d4 03 d4 f5 eb 4b c2 b9 7b 0d 2c 9b 48 28 d1 bf 44 47 eb f2 62 c0 9a b9 82 e8 d6 a9 b4 a7 99 ed 32 ef 9d fd f6 1a dc 94 af 2c 50 3c 55 ac fd 25 70 08 5d 9a b7 90 cc 6f 23 43 2b 77 bf 17 3a f1 16 39 a0 c1 03 c0 74 6b ef 2b 99 bb 7b e8 ab 93 55 14 d8 5e 2c bf 63 01 c1 dd a2 c6 1d 36 61 fa b4 c2 5c 1d 48 2b 57 3e 9f ac b6 db 09 13 6f a7 17 e2 00 da 0c 9c 0a 01 f9 e9 00 f8 40 d8 40 a3 e5 09 13 ba 9f c8 d1 76 b1 5b 6b 67 86 ed ca 9a bf 36 3f f0 28 01 ab dd 89 82 76 b0 01 0c 86 cc 8c cf 0d a1 e8 30 d0 7a 9f 2e ae cc f0 b0 ed 06 f4 0f Data Ascii: xPA)E3u%.*_fmp~_;.;Ne5{mik.{%K{,H(DGb2,P<U%p]o#C+w:9tk+{U^,c6a\H+W>o@@v[kg6?(v0z.
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: c9 eb 66 9e 76 3d f9 ad 4f 01 68 0a db 95 22 f4 52 dc ed 94 40 04 42 a0 3f 78 48 80 5c 90 3f 7a 09 0a 35 17 0c 30 4f 86 4c 54 01 d6 f8 f6 67 fc 92 bf 13 4e 3a e5 74 39 f3 c5 60 a3 bf 9b 1b de 0e c2 9a ce 74 a5 3b 3d 19 cc 54 96 b2 02 44 cd 25 97 5d 71 cd 75 37 dc 74 cb ed a3 1b 9d fa c2 7f 0f 50 51 0c 8a 45 71 28 0b ca 8a b2 a1 ec 28 07 ca 89 e2 51 02 57 f8 8e 6c 74 fa 17 b1 91 1a e9 91 1f d2 28 8c e2 28 8d f2 a8 8c ea ec 1d b5 51 bf 77 10 b0 05 2b 30 83 0d 34 4f a6 c0 64 c9 15 24 2b 2f 40 10 01 9c ed fd b3 5b 7b bc 3b ba bb fb 7a f0 fa 23 d7 3c d5 d7 3d db 0b bd dc 6b bd f9 f3 77 26 ef f7 d1 f5 4f 6f 5d fd e2 c3 09 02 4b 22 ac 08 48 22 01 9b 78 80 49 52 90 fa 1c 6a 98 d1 c5 bf 40 10 38 c1 20 0a 24 ae a4 e3 37 3e 16 80 4a 03 d4 3c 80 2e 01 74 15 a0 bf 01 Data Ascii: fv=Oh"R@B?xH\?z50OLTgN:t9`t;=TD%]qu7tPQEq((QWlt((Qw+04Od$+/@[{;z#<=kw&Oo]K"H"xIRj@8 $7>J<.t
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 54 38 08 8b 2c 97 1a 49 8c fc ca fd 02 9b 86 0f 61 07 de ee d0 57 72 ad 41 89 28 42 a2 8a 2e 86 c4 99 5a 72 29 e1 6f 19 bc 0c f0 68 50 7b 00 5e 8e 02 1a 26 4f a5 e8 63 b8 62 36 05 ff 19 c7 98 50 85 21 7f 4b 17 3b 95 38 5a ae f0 00 5a c0 4c 1c 9c 76 e4 ec bd 10 3a 6b 0c bf 40 3f 00 a3 36 8d da a5 0b b8 10 c8 42 c1 8b 03 2d 1e 76 c9 c0 a5 76 a1 46 5d 66 56 a6 4e d3 5b 89 52 2c 46 af 1a ed 73 68 a7 09 c0 ce 7c 00 48 d6 91 58 0b fd 29 4d 08 91 e2 3c 20 10 5e 4b 75 a0 e7 b9 c0 f0 95 76 df 5b 81 00 56 cb e7 84 1c 97 2b 00 8f 18 21 ab 85 63 e4 50 11 31 e6 09 77 42 e0 13 ae 1c 29 37 3c 51 a0 3c 31 c0 89 23 9c 44 97 b2 5c 07 64 83 ce 79 67 0d 4e 36 e0 4f 0e fa e4 bb a4 b7 51 8e ff ce 1a dc 5e 42 4e 0d 70 ea a0 d3 38 11 43 3a d6 35 dc 8a 9b 10 3a 68 79 05 0f e6 fa Data Ascii: T8,IaWrA(B.Zr)ohP{^&Ocb6P!K;8ZZLv:k@?6B-vvF]fVN[R,Fsh\|HX)M< ^Kuv[V+!cP1wB)7<Q<1#D\dygN6OQ^BNp8C:5:hy
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 92 a6 da 5e 6b 11 3c 1b dd b6 d6 0f d1 cf 43 6f d8 ef 3e 8d 48 3b 3b e6 63 ed 5b c9 b1 c4 9e f2 af 17 1f 4d 4f 1e 9a 17 ee 4a dd bd 4b 6d 51 4e c7 72 e7 2d 84 0e d0 45 c0 a5 5a 0b 86 ba 56 01 a7 51 02 2a 5b 9d d6 98 e6 28 8d 01 58 81 c2 62 88 58 f4 be 63 b4 4c f8 94 d3 96 39 56 97 e6 46 8f 04 ba 66 9b 6e b2 06 8d 8a 08 f5 05 72 57 f2 ac 51 cf 4a 7d 7e 89 2c 57 bc ad 1e 2a 8f 7a 4e 9e b5 46 f9 d9 fa cd f6 28 d0 63 ec c0 ee fc 80 24 d5 c2 69 dd eb 2b 7a 01 ff 10 60 d7 5e aa 5f cf cd 5d e0 31 f3 8d 5a b3 c0 a8 47 fa 7b e5 37 80 fa 08 8e 23 cb 25 93 66 84 98 6c 59 e9 a3 00 3e c9 72 5e a9 b8 6c 57 ee 26 cf 09 35 42 bd 3f eb 08 f2 d8 bc d0 2a 36 d0 a6 c2 25 91 a5 71 5b 18 72 ff cb dc 6a 37 c7 6d c2 84 a8 a9 94 5d 1f 2d 41 11 55 64 75 a5 ac 85 68 42 3d 2f 37 45 Data Ascii: ^k<Co>H;;c[MOJKmQNr-EZVQ[(XbXcL9VFfnrWQJ}~,WzNF(c$i+z`^_]1ZG{7#%flY>r^lW&5B?*6%q[rj7m]-AUduhB=/7E
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: a1 9c 51 43 c5 f4 72 88 5a 94 5a 4c 2a 34 1e 0c 40 a9 56 b7 a5 03 8a f9 19 3d 15 f6 73 68 4c 40 43 b7 f0 bc 88 70 a4 9f ec 1c 4d c1 9e 01 79 e0 0f 56 e4 3c 7c ed 5e b4 b9 f8 4f a6 56 fc ae 1a ef 2b 14 26 f1 08 a8 18 1b b0 96 15 54 74 62 ed 4f ad ea 7e 60 95 b1 4e 8f a7 68 80 c9 da 4a 22 ee 36 3e ed e2 d0 b4 ca 58 c5 ff 27 69 fc 8b 67 65 81 c8 b6 f1 7b 0e a9 05 88 0f c5 df 3a fc 41 6b 0e cf 09 b0 39 a2 2b fb dd e9 22 b5 05 90 0c 18 0c 82 9c 8c 81 53 09 74 03 8d a8 90 90 cb 00 39 eb 2a 4f df 20 3a d4 e3 8c 89 1f a5 a4 b0 0e 11 35 35 28 47 27 60 7d e8 af 89 a9 64 1e ca 47 13 39 2d 31 c5 47 30 ec d4 1d 72 07 89 a9 49 b6 03 9c b4 f7 43 5b b4 4a 4c 15 af 0b e5 ee 3a d2 f8 60 5f 66 02 7c 55 8f e7 3d dc 1e 77 e1 11 d7 29 bb 0c 15 e1 94 5b c6 b9 67 a9 27 c0 9c 1a Data Ascii: QCrZZL4@V=shL@CpMyV<\|^OV+&TtbO~`NhJ"6>X'ige{:Ak9+"St9O :55(G'`}dG9-1G0rIC[JL:`_f\|U=w)[g'
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 47 e6 1b 3b 6c bb 1c 26 a7 73 e6 ec 38 87 71 63 c8 76 48 ce f3 30 eb 41 96 d9 03 6b f0 bd 50 e7 b7 b0 45 64 df 09 93 9b 86 fb f4 38 16 1a 4e 17 d3 1d 36 d3 66 cc 9a 3b a3 90 95 1e 86 18 49 19 b3 62 ae cf e1 92 e4 b6 56 6d da 75 68 7a 1c b5 ea d4 6b f0 da 9b f8 b7 2c f7 26 6d 76 7e ec 34 d0 61 1c e4 78 8b 40 16 33 db eb cd 10 3f 1d f9 cf 68 75 a6 d9 5b d2 fc f4 f4 62 5c e8 bb 43 96 77 ac b9 68 ba 19 66 ea d6 63 96 c1 85 5f cb f9 73 bb c1 89 a3 39 6d ee af de 3c 56 2f 40 96 45 6c 9f 00 75 74 51 95 6a 35 bf 52 57 2b ef ce cf 16 cf fe c4 f4 47 44 52 b8 68 4e d3 e0 d8 67 21 33 fb c8 9a 8c 4b cc a6 ff fc 24 5a 0c 39 f3 76 5e a8 18 e9 1e 2a 46 d7 ac d3 80 49 ab 52 b0 ba 4b 2f 87 02 ed 8d c9 68 0b 65 3a fa 16 b8 49 3d 9d ff 1b ba 57 ca f0 f5 cb c1 92 99 ec e1 6c Data Ascii: G;l&s8qcvH0AkPEd8N6f;IbVmuhzk,&mv~4ax@3?hu[b\Cwhfc_s9m<V/@ElutQj5RW+GDRhNg!3K$Z9v^*FIRK/he:I=Wl
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 5e 04 00 12 66 fb 8e 34 24 0b 93 da e2 33 f5 05 01 bc 1b e0 eb 1d de de c0 1c 84 b2 a3 9c 28 01 25 56 75 b8 4d e8 68 69 ae 4f dd d8 59 95 ed 98 f3 9f 5a df 13 ff 60 5e 7c 9d d7 7d bd d7 1f 98 5f 07 d6 b3 9f cc e7 4e 2d 67 8d 5e 8f 3f 61 3d 74 6c 3e b1 e2 e9 40 8f 7e 66 5f e7 7f ce 4c be d8 34 e0 ef 44 c6 f7 a7 61 23 be 0f 81 5d 26 74 1a d4 ad 67 6c 08 0e 61 85 df a6 1a 06 31 e2 64 90 1c 70 90 21 13 f6 1c 39 f1 e0 c9 5b a8 ab ae 09 17 27 d9 63 4f e4 2b f0 bc 71 43 7e 8c e8 c1 3c 6b d4 ef bb 51 13 36 6c fa 6b 27 76 88 87 44 38 78 14 32 0a 4a 5a 00 58 42 ad 8c ac 56 5f 4e d7 dd 11 e0 b6 af 7e db f5 07 d3 8b 4c b8 e8 44 86 3c 1a 17 fc 39 cd 65 27 db 64 58 ad 66 47 56 36 81 91 f9 39 25 dc af de 69 d2 a2 37 3e 58 38 11 c6 43 88 08 29 da 14 28 d3 40 61 c6 82 25 Data Ascii: ^f4$3(%VuMhiOYZ`^\|}_N-g^?a=tl>@~f_L4Da#]&tgla1dp!9['cO+qC~<kQ6lk'vD8x2JZXBV_N~LD<9e'dXfGV69%i7>X8C)(@a%
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: bb 75 4a b7 6c 70 ea 6f e0 65 51 2e ae e9 41 f0 4c 67 ca cd 90 ee 64 30 e3 8d ce 7b 74 7a 4a 46 af 08 e9 23 4d 45 53 07 03 42 c4 e4 5e 41 7b 95 3c 93 90 99 fc 4c 76 a6 8a 24 e2 32 d4 f3 7b 88 f4 3d e8 ab 9d cd ce 7a 04 91 6d c0 76 8b 7f 16 97 5c d2 f1 6b cd 78 42 04 d7 97 a5 59 f8 08 95 c1 71 04 d3 f7 4c 62 d0 6b ad 3f ce 0f 35 a8 4c 30 e9 1e 9c 34 7a 83 e4 9e b8 fe 33 39 10 5c 47 5a f4 53 7a c3 c6 69 dc 0d 78 60 0d 5b ed 3f 58 f7 3f f0 d8 7a a9 43 a5 93 18 21 db 50 7a a4 65 30 91 1a e0 48 33 76 f0 00 cc 10 60 8e 1f 76 55 e1 5f ca b8 12 8d cf f1 8c 47 92 dc 1d 4d 69 1a 0d 4d bd d1 95 a9 b5 13 0f 4e 1a b9 27 59 c5 66 64 e2 99 a0 f5 1e 33 d3 c5 b2 75 ad a0 12 78 d2 82 95 59 b4 3b ec 32 31 16 82 82 c4 e6 2e 2f 7c f2 62 8f 8e 72 39 cb 42 a1 47 dc c1 eb 1b 8a Data Ascii: uJlpoeQ.ALgd0{tzJF#MESB^A{<Lv$2{=zmv\kxBYqLbk?5L04z39\GZSzix`[?X?zC!Pze0H3v`vU_GMiMN'Yfd3uxY;21./\|br9BG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.7	49826	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:44 UTC	909	OUT	GET /assets/b21c5111a12372139409.woff2 HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://discord.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:44 UTC	959	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:44 GMT Content-Type: font/woff2 Content-Length: 39724 Connection: close CF-Ray: 8d782d689b4547a3-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "ff5eccde83f118cea0224ebbb9dc3179" Last-Modified: Wed, 05 Jun 2024 19:27:57 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3wNEPigCetlec1W0kX7LxWJSID%2FKH6qtF6WGvZTML8WNwzSm9G%2BytTIbIJgQyTYgbuwx%2BHsaij7obh%2BQOrvOq4kCkaPUwRPrIo0zxWIhDqTJ1KN3y2aMLamoCFK6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:44 UTC	410	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 9b 2c 00 11 00 00 00 01 7c 50 00 00 9a c6 00 02 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 83 04 1b 81 9a 02 1c a0 20 06 60 00 8e 50 08 82 40 09 8d 57 11 0c 0a 83 a6 04 82 e9 3c 01 36 02 24 03 99 60 0b 8c 72 00 04 20 05 93 3c 07 b4 46 0c 83 60 5b 70 56 71 85 9a 77 ff 53 49 86 ba 2b 9e 53 7f 66 3b 64 53 c3 b6 69 f1 b3 9e ab 20 43 d4 b7 62 6a d8 36 8d 88 77 3b 80 2f d5 fe e1 b2 ff ff ff 4f 4d 26 cf b8 bf 5b b9 6d 6f 2d a1 c0 c7 87 0c 8f 88 34 46 60 04 0f 84 53 65 52 f8 58 7a 50 ae 67 0f ac 6a 0a b9 4c f5 96 a2 0b a2 53 18 54 28 61 c5 15 79 a3 44 90 d3 06 6f 64 bb 2f 29 e3 02 f7 d8 e1 7c 6c f7 1d 0f 7a 6e f4 d2 91 ef a0 54 d0 e2 bc 92 4f 70 5a 50 08 bc b0 b3 63 5c 8c f2 c3 da 25 92 48 96 cb ba 79 04 09 Data Ascii: wOF2,\|PB `P@W<6$`r <F`[pVqwSI+Sf;dSi Cbj6w;/OM&[mo-4F`SeRXzPgjLST(ayDod/)\|lznTOpZPc\%Hy
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 88 28 31 ad 6a 65 8b 23 ae 7e 5f a8 88 df fc ff ea 9a 85 13 21 d7 85 e4 99 f9 37 13 65 7f 9e e6 f4 fd ff cf 73 b9 5c 84 60 47 d0 5e b3 15 af 68 d2 42 b2 04 93 09 74 52 a3 4e d5 c0 2b 22 78 55 81 0e e6 ca a8 33 aa 46 7d 30 f8 ff df cd 7a f7 bd 90 40 5e 92 06 69 42 5e 0a 13 b4 0e 75 26 1d ab 0f 9d b3 5f 7b 98 24 5d 0e ab 8c 88 af 98 fe b9 7f 8a 38 6b c6 9a 8c 18 fc 3f ff 63 cf ff e6 5e e7 7e 15 a0 fd 41 32 cd d6 18 54 95 24 16 69 10 09 9d fa 13 59 63 78 21 62 7e 06 78 bb fd bb 33 3a 67 ee 5b ce ba 21 c9 58 95 ce b8 b3 66 67 74 ec 64 75 66 12 92 cc fb 92 75 5a 57 21 d9 19 97 8c 79 f9 c6 aa 28 5d d6 8f 24 d9 49 66 5f fc 9f cd f6 67 36 39 b7 45 66 de 27 7b e2 98 6e 64 43 0e d3 59 74 36 f1 ee 2a c4 3b ee 0d 5c 05 15 4d f5 17 0d dd 15 0d 45 27 da 5e 49 cb dc fb Data Ascii: (1je#~_!7es\`G^hBtRN+"xU3F}0z@^iB^u&_{$]8k?c^~A2T$iYcx!b~x3:g[!XfgtdufuZW!y(]$If_g69Ef'{ndCYt6*;\ME'^I
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 35 9e 3c 93 28 2a 8d a5 65 b0 b6 1c 36 54 c0 e6 1e 79 3b 43 20 cb 04 b2 5a 87 3d 95 73 a0 1a 8e f6 8a da 9a a9 af 8d 86 3a bd cf 11 c8 ef 05 f2 27 1d 7e ed 1d 7f 34 ce df 7d e4 72 73 5c ed 3b 77 5a e3 61 db 3c 6f d7 7b 85 00 df e8 d0 de 91 d2 d9 b1 5a 40 16 90 88 84 5c 42 18 4a 14 73 49 e0 55 52 28 25 87 a5 60 04 15 9e a8 d2 f0 fa f2 67 86 80 00 16 e8 85 05 72 f6 b9 56 4e 20 ce 51 f7 8e 08 01 41 72 6f 1c 15 06 8a 42 88 3d 16 74 86 1b 49 c8 1c 58 94 a2 16 6d 42 6e eb 1f 11 06 4a 04 e3 47 65 dc a0 b4 6a 70 e8 88 f3 4e f4 0d e0 73 d0 99 e7 39 20 80 f3 28 80 70 31 94 5a 4a d7 ea b7 30 a5 7b a5 47 a5 b6 cd 2f c1 70 10 fe 6b 64 31 d7 2b 39 37 bf e2 34 ef 34 ce 5a d3 c9 38 50 94 47 07 fe 33 ae 63 8a 00 41 1c 67 38 09 b1 b3 1c 04 71 d1 45 37 c1 5d 62 6b 25 ba 57 Data Ascii: 5<(*e6Ty;C Z=s:'~4}rs\;wZa<o{Z@\BJsIUR(%`grVN QAroB=tIXmBnJGejpNs9 (p1ZJ0{G/pkd1+9744Z8PG3cAg8qE7]bk%W
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: b4 ab 91 cf 4a 3f 49 a2 dc c9 12 52 a2 73 ea 97 fa a7 eb 09 fa 76 e7 b0 16 9e 3a 0e 2a 65 1e fb 8d 19 d1 6c 32 42 8b d3 e1 1c d3 5e ae 46 2a d2 7d d6 ec 4b e7 4b 32 87 13 da 24 9d 1c b1 c2 8c 5e 99 8e 9c b7 15 7c d5 af a7 38 79 45 a6 9c fe cc a6 74 13 a2 e2 65 5e 1d f9 5b 8a 78 70 6e 30 e9 6f cd 9f 9a 03 29 4c 7d 5c 11 b8 51 fa 2a 8d 1f 10 92 de 6c 0d 25 73 1d 39 7d 5b 60 83 c1 eb 8d aa 91 7e 64 4e 5e da ab c6 70 56 54 5a 8f a6 eb 67 e3 90 d4 ea 37 56 83 f6 7f 5e 76 82 9d b3 ef 3d 1d 46 57 96 ec 48 e5 e5 fa b2 7a f7 04 bf 1b 83 73 98 4e 1f 8d 9a 0a 34 bb 3d 35 d4 b0 dd 12 fc e1 a1 13 94 8a 9f ee ca ab c6 5e 5d 6f c3 ac 00 3c b0 6a 03 76 93 c9 d8 ca 1a 59 28 56 3a 54 82 e0 d2 51 ee ac c0 5f 81 7b 83 50 b0 86 61 0a c8 3b da 21 dd 31 bf ab f3 31 0d dd 4a 9d Data Ascii: J?IRsv:el2B^F}KK2$^\|8yEte^[xpn0o)L}\Q*l%s9}[`~dN^pVTZg7V^v=FWHzsN4=5^]o<jvY(V:TQ_{Pa;!11J
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 32 47 bb 47 65 0b 90 f3 48 43 24 c1 da 40 e7 10 bf 6c 22 40 43 a6 05 56 6d 51 97 cc 42 6a 42 53 d9 c9 ba e5 a0 3f b1 ac 4d ed a0 97 8d c0 b0 18 53 2e 04 69 5f ee 04 5f 42 04 29 85 8c 58 1c 2b fe 53 7d 40 0b 25 b6 98 6d 30 0c 6f 8a 42 dc 12 56 ec c0 04 d9 29 a2 ec e9 a7 20 51 15 53 2b e2 9b 11 60 93 31 ad 17 8e c5 a4 6d 4d 24 26 67 c3 8c 44 22 68 c8 d9 dd c6 30 a4 3a 12 ed c2 12 7e 24 14 55 cb 6a 8c 9f 29 63 4b 8f e6 15 c4 58 a6 f6 58 a9 7c df 77 ec e1 20 3b 02 b8 9d d1 af 74 4d 06 66 fb 54 b6 bb f0 3c dc 44 6a 91 34 ad 7e c9 4c 46 20 cc 14 2d c8 0a 0e 6c 97 70 c1 34 e6 f7 cd 62 1e 1f f0 29 0f 16 1f df 45 90 12 15 49 36 8d 6c 5f 4e cc e8 91 15 1f 15 fc e1 8f 50 c9 90 52 5c d3 0e 63 14 e3 4e ad 14 d3 44 45 49 5f 21 d6 21 8a 51 bc 92 95 b1 8d 5b bf a5 6c 15 Data Ascii: 2GGeHC$@l"@CVmQBjBS?MS.i__B)X+S}@%m0oBV) QS+`1mM$&gD"h0:~$Uj)cKXX\|w ;tMfT<Dj4~LF -lp4b)EI6l_NPR\cNDEI_!!Q[l
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 80 0a 81 01 5f 2e 3d 05 59 08 41 c0 bd d2 8c b9 7e a8 81 96 7f 68 8a ea 8b aa 01 9d e2 e9 be c4 3d 04 6e 6e b9 94 06 d2 98 49 d7 5a ea 3c 9d 27 13 b2 48 ec 2c 3d 66 92 8f 08 ec f4 44 61 22 2a ab a4 b4 71 09 69 c8 42 1e aa e8 69 71 e9 b0 07 35 d4 a3 03 4d 18 b4 ef ca a2 9e 5d de 6a 1d 37 5a ee 84 88 53 13 73 6b 1d 03 4d d3 7c 7e a9 09 4e 6b 3c 3a 82 b6 e5 81 69 45 64 80 a6 10 52 99 9d 18 a5 47 00 24 3e 0d b9 1a a3 04 35 ab 22 42 f3 3a 6f ef 1d 21 5e 41 df 1a 95 b3 08 a2 f9 b6 60 72 17 66 a5 e2 c9 aa ea 30 32 26 4b b3 be a5 24 e1 e7 74 9b 2a 70 9e e5 20 c6 57 1d c9 c8 20 53 26 54 62 b2 fe d0 17 93 0a 8f 6c 81 14 67 f4 67 d7 44 d1 7e 69 05 76 3a 60 81 07 82 61 51 36 17 5d a5 81 6a 88 99 b4 58 7a 8c ca f5 4e c7 c9 09 27 a6 03 e8 2c 8d d8 5e 30 db d1 5b 34 16 Data Ascii: _.=YA~h=nnIZ<'H,=fDa"qiBiq5M]j7ZSskM\|~Nk<:iEdRG$>5"B:o!^A`rf02&K$tp W S&TblggD~iv:`aQ6]jXzN',^0[4
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 4b 89 59 3d 19 2b 80 73 e4 77 87 b5 b8 f2 a3 fb 09 52 4e ee 7a cb b2 f6 f5 0d 87 7e 66 49 1c c2 e3 39 4c 1e c2 e4 12 10 4b 36 fe 3b 29 f0 50 8f 71 39 04 50 22 87 7a 8e 56 66 46 a6 ba 7b c1 86 7a 79 1a 6b 8a 6a 23 4a 63 06 b5 62 42 2e 27 ba d3 53 b2 47 16 e5 33 53 1e c2 cb 50 2e 75 f0 a4 a6 2a 3c 6a ce c1 53 1b 54 74 4a ee 81 ea 80 2a 71 d0 e2 c5 53 3a 94 c4 a9 5b 58 72 f7 ca 1e fb c8 2c 99 e3 30 5d d3 55 69 12 d3 ee 94 1e 98 6a 28 c0 5a 9b 08 1c 2e e6 ac a9 d6 13 ca 89 4b 66 0d 80 9a 74 d1 f0 94 27 14 8f 05 aa 8a 90 78 3d 32 c7 aa 57 26 bc 6a be 80 52 e5 23 9a b6 12 de 00 16 c8 66 f9 e4 0d c0 ee 76 13 1c 14 2c 1d 7f 05 3c b5 35 4d 87 cb 69 5a ac 32 0f d2 7d 81 19 65 2a 1b 0d aa b5 12 b4 9c 78 85 ea 3e 6e 5c 73 e8 54 9d ef e0 ce 59 76 6d 11 54 9e 87 76 0c Data Ascii: KY=+swRNz~fI9LK6;)Pq9P"zVfF{zykj#JcbB.'SG3SP.u<jSTtJqS:[Xr,0]Uij(Z.Kft'x=2W&jR#fv,<5MiZ2}e*x>n\sTYvmTv
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 2a c6 2e 04 57 dd d9 09 dc 18 7c 46 e9 46 c1 48 64 57 d8 eb 83 b1 38 a5 85 ed e9 a2 59 e0 33 4c 37 4e 2a 93 6a ab 1b 42 fd 9b 68 3d ea 2e 77 24 57 c8 a7 9c 6e 9c cc 91 e9 1c 8d 9d 03 53 8c 11 f7 37 12 cd 03 9f 83 ba 71 0a b7 52 ef 6c 0a 0f 4e b3 66 32 dc 3d b1 02 f0 49 a9 1b a7 f2 e4 06 57 73 64 68 33 67 a5 e3 c3 1b 17 c0 67 a9 6e bc 84 af 30 ba 5b 36 0e cf f0 76 36 3d 7d 89 3f e0 d3 56 37 5e 2a 50 56 79 fc 5d 23 09 c1 c9 e7 97 3f 69 00 9f c7 ba 71 9a 50 65 f2 b6 76 8f 6e 11 dd 62 79 07 52 ff c0 27 b6 7e 6b a1 8b d4 66 5f 5b 0f d5 ad c0 4a 5b d5 38 a6 c1 0f 9a b4 7a 00 15 05 1e ee 45 ab b0 92 6a 6b ab bf 0f 7d 69 b5 44 dd a4 e8 63 80 41 86 19 61 8c 71 a6 c0 de e3 61 51 c5 95 f4 b9 c9 a6 9a 6e e6 ed 8b b5 f3 a1 78 a9 1f 2d c3 99 75 2f c1 5a db 6b 97 68 2f Data Ascii: .W\|FFHdW8Y3L7NjBh=.w$WnS7qRlNf2=IWsdh3ggn0[6v6=}?V7^*PVy]#?iqPevnbyR'~kf_[J[8zEjk}iDcAaqaQnx-u/Zkh/
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: dd fe 8e d3 f6 b4 97 54 4f 42 7e 26 80 ae 76 46 6f 35 e5 45 a7 d7 94 9b 92 aa 65 a2 66 cc 47 a3 44 5b de e8 d2 e3 63 a2 71 f2 4a 25 9c 64 d2 c1 3b 9b 72 98 d4 33 cf 38 d3 cc 52 88 52 50 5e f9 14 5d e0 38 8a 2a a7 2d 6d 6b 7b 4f 14 73 b1 b7 75 f5 4e 1f 1a 69 bc 8f 4d b5 d1 d7 16 5b c5 d1 df 4e 00 09 59 44 08 28 2c f8 3d e6 19 91 58 b0 e4 43 4b 73 e2 bd 8f ab 3b 48 63 c9 f7 39 44 d3 21 9b 09 d6 64 e8 be a4 d8 5c 5a fd 4c a5 85 ce b4 96 76 5b a9 f6 2d 83 76 d3 6f a7 73 ed 67 d8 5e 46 fd e9 42 87 59 83 64 89 3b 93 8e b3 72 2a 62 47 11 70 65 8b 37 7b fc 2e 47 42 39 13 c9 89 70 2e 44 bb 44 2c 37 92 79 90 ce 9d 54 97 c9 14 49 3d 6f b0 22 9c 2e c6 d9 6e d2 2d 81 7e f1 f4 ba c5 b0 64 17 ba ed 7c 49 ce 95 c1 b4 74 26 a5 31 8e c1 b5 87 5c ca 62 de 63 e4 1e 70 ee 91 Data Ascii: TOB~&vFo5EefGD[cqJ%d;r38RRP^]8-mk{OsuNiM[NYD(,=XCKs;Hc9D!d\ZLv[-vosg^FBYd;rbGpe7{.GB9p.DD,7yTI=o".n-~d\|It&1\bcp
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: cb 63 5e 5b 33 12 6b e9 13 79 13 35 ed b3 dc c4 be 6f 56 03 5d 3f 28 c3 c1 95 32 f7 5f 54 87 5d d5 86 2e a8 c7 ee 03 bb 70 00 4e b2 93 97 32 cb 8d 8b 39 74 31 b2 b5 97 c6 3e 5b 7b f9 35 f5 b9 0f e0 b4 76 49 c5 9c 65 c2 89 9f 1f ab e3 c9 95 2e 13 88 72 c7 94 3c 0a eb 46 87 e3 7a 10 46 88 a7 6c 19 23 86 47 81 b8 3e 4a cc 78 4b 17 59 ac 64 a8 13 33 69 9e 63 4d c7 3c 44 5a 19 f6 8e b0 a6 3c e7 45 d5 b4 1b ce 7e b4 70 3f 38 3d d0 ad 4f c1 11 24 52 66 99 62 da 31 9c a2 a6 dd b8 a8 2a 6e 32 9c 30 46 0b b3 05 59 06 42 e7 77 af 0e 03 20 30 3c 42 3f f1 0a 00 75 3c 00 e3 3b 01 ee 0b ec f9 1c 82 83 5f 04 c0 c6 1f 20 58 75 2f e0 c4 d3 01 0c 00 f6 73 af c0 df e7 1d 90 d3 c1 2a f9 c8 ac d6 70 bb 5b 29 80 eb 48 b8 e2 55 f3 92 90 5a 84 5a 94 3d c9 c3 ce d7 e8 42 4e d3 d7 Data Ascii: c^[3ky5oV]?(2_T].pN29t1>[{5vIe.r<FzFl#G>JxKYd3icM<DZ<E~p?8=O$Rfb1n20FYBw 0<B?u<;_ Xu/sp[)HUZZ=BN

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.7	49823	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:44 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:44 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:44 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 1f9beeb1-d01e-0014-170b-22ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071544Z-16849878b78q4pnrt955f8nkx800000007b0000000001x7g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:44 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.7	49825	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:44 UTC	909	OUT	GET /assets/8bd8143eff37936894aa.woff2 HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://discord.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:44 UTC	961	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:44 GMT Content-Type: font/woff2 Content-Length: 45868 Connection: close CF-Ray: 8d782d689d40e987-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "d295c40af6fca08f8e0eb5425351f431" Last-Modified: Wed, 05 Jun 2024 19:27:55 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5qcalj1NF04hIefvNJJ8Ot9yUSl0aykPEblo4OTmZs%2FP7E3Kv8Kojgj0kf1%2B3pMmoqBgSzLo%2FYhKbiTg2RlbX%2FSSQmlNPqPLWQDVQlD7Na63lmonu4MhDEdN%2B7hz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 b3 2c 00 11 00 00 00 01 a8 94 00 00 b2 c8 00 03 00 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 82 78 1b 81 cf 10 1c a1 5c 06 60 00 8e 58 08 82 40 09 9f 03 11 0c 0a 83 b3 54 82 f8 40 01 36 02 24 03 9a 0c 0b 8d 08 00 04 20 05 94 61 07 b5 4b 0c 83 78 5b 54 83 91 01 35 c7 ee 7f 28 a0 da 56 d9 4d aa fa 6d e0 04 d4 87 7b 81 39 86 a0 d3 ea b7 73 34 39 92 f8 79 62 6a d8 ee 1e 80 da 09 89 3e 7d db 6d cb b2 ff ff ff ff cf 4f 26 72 d8 25 e6 92 54 8b 81 51 ec 7f ff 03 35 c2 34 33 b8 79 44 ea d8 75 99 25 12 53 df 77 5e 90 42 f6 2e c2 bb ce 82 2a 31 70 7c 62 32 c4 bc 88 67 87 d4 9c cd 57 75 71 cd b7 42 1b 16 c3 32 a6 65 7e 09 33 0a 12 3e 11 49 c9 a6 8e 54 4c 50 db f5 63 aa 83 f9 8e b9 63 24 38 fc e9 54 6c 65 c5 09 17 Data Ascii: wOF2,x\`X@T@6$ aKx[T5(VMm{9s49ybj>}mO&r%TQ543yDu%Sw^B.*1p\|b2gWuqB2e~3>ITLPcc$8Tle
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 0b 9e cc 23 a1 30 d4 64 89 21 69 d4 ff 33 d5 2a ad 06 c4 19 b9 79 47 8e b7 d2 59 e9 5c bc c6 47 33 59 d6 f5 ab 0a dd 55 bf 9b 00 1a 20 d5 40 93 33 24 28 ed 92 e0 18 5a 19 50 06 8d 02 a9 06 48 dd 50 5a 47 69 9d 3b 63 0c 49 80 94 5d 4a 7e 9c 8f ee 7c ee cc 1a 1f 9d 0d 5d 10 5e 38 17 85 17 64 17 65 9b a6 97 e7 f7 7f aa 96 ed ff 18 fe 15 86 22 fc 84 c5 25 dd 3a d1 51 eb 90 5f bf 56 51 39 87 2e 65 62 06 20 f8 39 18 69 21 8a 4a 58 6e a2 93 76 2f 49 ba c4 75 52 ba 67 5c e6 85 58 39 a4 36 55 ae 2e 26 6d e5 14 53 51 da af 77 d9 6f 79 45 e9 a6 70 77 45 6d 9e ff e7 fa 9f de fd be 25 38 18 8e 63 fd cf 7b 7f e0 e8 e2 5b d1 10 66 38 71 22 01 5b f0 7c 2d 2d e9 4e bf 93 c3 0c 99 76 6c 01 e8 5a 74 80 45 0a 4e 23 69 43 bf 93 c3 7c 87 a9 95 73 96 53 64 72 c8 80 18 ba 8e 20 Data Ascii: #0d!i3*yGY\G3YU @3$(ZPHPZGi;cI]J~\|]^8de"%:Q_VQ9.eb 9i!JXnv/IuRg\X96U.&mSQwoyEpwEm%8c{[f8q"[\|--NvlZtEN#iC\|sSdr
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 95 d4 df da 67 57 e0 9b 4f 0e 39 22 0b 66 a7 19 c4 f4 b3 80 57 c1 f0 f6 59 10 e3 6a 17 e7 e8 82 2b 2e fd a3 a2 5f eb 21 57 ed 85 35 e7 0c 42 b2 b4 19 bc e6 a2 15 5d a8 e8 94 08 6d 3a fe 87 a9 1f c1 81 87 11 b4 11 c8 e4 1f 7a 3b 4f 9f 67 af 45 60 ff fd 40 0e 68 e6 01 72 83 4c f9 ea a9 18 24 b9 29 27 08 58 e8 0d 74 5a e1 4f be b0 9b a6 d6 dd 99 6a ea dc 4b 62 e0 b7 0a 80 5a 33 79 2c d6 ab 41 17 14 d7 b1 33 47 48 95 da a2 07 6c ed b8 f5 a3 35 47 bf 77 d5 c7 a0 54 d2 fa 90 b7 dd 9f c1 1a fc 42 1a 02 39 09 bd 1b 2e a2 8c 4c 30 96 71 7d 20 be 6a 07 0c d3 d8 5d b5 8b b7 c1 3a d8 f5 25 67 f5 b6 39 44 ca aa 7c cc d8 8b 6c 2f bc 35 57 ed 18 96 16 dc da 57 22 4b b1 c1 92 dd af 75 36 6f 6c e4 38 49 2e 70 58 9a bd c0 3f 42 3e 65 f0 ca ba e5 ff 71 64 84 70 be f9 a9 e7 Data Ascii: gWO9"fWYj+._!W5B]m:z;OgE`@hrL$)'XtZOjKbZ3y,A3GHl5GwTB9.L0q} j]:%g9D\|l/5WW"Ku6ol8I.pX?B>eqdp
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 6d e4 37 da 4c 6c 95 c7 3f 58 87 e9 66 33 94 38 c9 d5 9f bf 6d 80 cb de f0 93 e2 d3 f1 4d 66 7b 2d 02 87 33 52 35 d7 5a c3 09 31 a1 dc 34 33 0d 50 5f 4e 33 b0 bb 8b 14 c2 13 0a 62 ce f1 a9 2d 5e 93 78 b7 ee 6f 45 3f 53 c6 94 43 4e 56 cc cb ad 75 c2 4e b3 88 63 72 b9 fa 45 fc 94 9d fd 15 86 41 1f e4 d0 3a d4 d4 7f 64 cd a7 43 ef 35 1c 34 d0 74 fd 0d 65 63 a0 b1 f5 c3 37 6c 90 8a aa 36 3f 8d 03 ba 18 36 be c0 b0 94 a8 16 1b 20 e3 1a 9a 27 d2 7d 74 51 1b 9f 41 e0 5b aa 0c f2 4f ad ce d9 19 0c b7 19 40 1b e9 38 6c f9 43 22 d1 00 50 46 9f 43 3e fb 08 03 fa 42 b3 d8 c2 1a fc c8 2d 64 b9 fb 5f 17 b4 ca f2 d1 c3 3e 05 b1 74 5c 00 bb df 42 ef a7 c6 2e 23 4c c4 c7 7a 94 44 77 0c 02 7c 74 fd 64 4a 9b e4 73 bd fe c6 e1 8c 85 1e dd f9 47 6a 2a 0b d3 9f 74 fe aa 97 39 Data Ascii: m7Ll?Xf38mMf{-3R5Z143P_N3b-^xoE?SCNVuNcrEA:dC54tec7l6?6 '}tQA[O@8lC"PFC>B-d_>t\B.#LzDw\|tdJsGj*t9
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: d5 97 9a 6b a9 b7 ef 11 ea 6f bd cd b6 40 da 62 f0 17 60 ff e9 d4 a1 a1 c7 80 1b ee 78 e0 89 17 de f8 e0 8b 1f fe 04 60 24 8e 11 26 9b 62 aa 69 a6 9b 6f 95 d5 d6 58 6b 9d f5 36 da 64 b3 2d b6 da 66 bb 1d 8e 3a e6 b8 13 4e 7a 14 1a 10 2d 88 0e c4 12 f5 f8 1b 60 a0 13 9e e9 5b 51 07 1d 7b 45 f5 fc 12 84 92 d7 7d 10 22 38 79 76 0a 21 84 81 c4 d3 18 c4 a6 0b 41 92 5b 5d 56 b1 1b 0a 19 d1 62 e9 22 ab 28 53 56 5b 8f b1 a1 2c d9 68 07 ce 91 9b 2a 47 9d c4 78 9b 8a c1 80 6a 28 a0 11 1d 02 5b 2c 20 4d 5f 01 69 6c f9 00 5a 10 50 32 a7 62 31 2d 3e 8b 92 8a e7 b4 28 9d 8a d7 80 ea 6d 87 d8 06 00 2c 15 0c 20 7b 67 0a a0 40 d0 2c 7b 00 6e 79 95 10 bf 7c 40 d8 0c 68 0b 48 7b 81 f9 7d 09 66 d1 02 b4 56 05 cc 4d 60 6e 1d 43 c7 b9 13 04 86 35 97 92 7e 4a e7 65 e5 86 7c 44 Data Ascii: ko@b`x`$&bioXk6d-f:Nz-`[Q{E}"8yv!A[]Vb"(SV[,h*Gxj([, M_ilZP2b1->(m, {g@,{ny\|@hH{}fVM`nC5~Je\|D
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 0f 1f 3d 51 53 d7 00 5b 1d 5b 59 e9 aa e7 2d 38 2a 46 8a df 03 8c b4 1f 87 b5 06 fe 48 06 dc 16 43 fd e1 56 00 92 38 1b 67 a8 38 3a d1 05 09 07 47 39 ae ac 82 ca ae 84 bf f2 ff 00 95 0e 73 ea 51 0a 06 df e5 74 32 1d 83 79 20 09 26 29 b6 2a 17 d1 c0 13 e2 3b 1c 80 b1 07 09 07 47 99 9a 53 8f ef 57 01 e5 dd 02 85 1f b8 17 c1 77 a1 c6 db 3e 01 e8 a5 3a a1 68 92 f9 25 17 f8 e6 35 01 cf 5d 71 50 75 de 62 ae ee b1 84 58 53 62 7e 23 02 8c 9e 70 b9 d3 9a c7 1f 33 92 4e a6 f9 7d 07 0c d7 85 18 07 22 0d c2 56 9e b4 8c 60 9c 5d 8c fc 25 fe d2 e0 c3 d8 70 26 7a 83 03 4f a3 f9 1f 07 b8 e2 0d 6f 5e 57 58 7c 1a d8 2e 20 6e fc e5 7d a8 bb d0 41 c2 39 2c 04 09 02 3d a7 2c 73 39 5d b2 cb 69 3e 71 51 7b 4d 6a 39 9d e5 5c c6 94 f3 17 53 4e de 57 38 24 3c 36 1f 3c 4d 9d 09 86 Data Ascii: =QS[[Y-8FHCV8g8:G9sQt2y &);GSWw>:h%5]qPubXSb~#p3N}"V`]%p&zOo^WX\|. n}A9,=,s9]i>qQ{Mj9\SNW8$<6<M
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: d0 a0 42 fd 5e 93 39 23 54 46 b1 bb 5c 1d a2 04 0d 7a 4c 62 d5 85 e6 c6 47 10 34 a9 30 99 33 07 e6 63 af 2d 15 55 53 23 b5 e3 30 6e e3 24 ce db d5 0c 87 27 42 0d d4 a3 45 bc 76 4e b7 a3 3c ef a3 e9 6e 7f 7b 7b 86 3e c3 4f b7 fd af 74 ec a9 4e 48 9c 81 3c a3 dd 91 ae 87 d7 69 99 19 64 47 be 94 93 0c 4d a8 5a 81 2e 97 ab d0 31 42 28 ca 56 95 3a 68 74 6f 83 f1 48 f3 2d ba 7f 8a d4 59 6d af 9b a5 36 4f 53 52 b1 07 8b dd d0 07 1d 30 c8 5e f7 a3 10 da 85 c8 fe 5e 9e 6d 3c 94 4a d9 69 61 27 59 45 b5 d0 7c 40 5f 04 2c 02 40 b2 77 16 fb b3 1d 85 a6 61 7d e5 d5 f6 18 b8 54 3b bb f4 32 eb f7 43 09 df ab 67 8a 81 90 92 41 a6 df 88 9b 12 57 4c 1d 24 15 95 41 9f 21 9a 22 ab 01 39 39 b8 91 43 e0 f2 15 86 9a 49 a4 24 f5 28 8c cb d4 0c 30 a5 37 4c c8 8a 32 c0 ae ff 89 1d Data Ascii: B^9#TF\zLbG403c-US#0n$'BEvN<n{{>OtNH<idGMZ.1B(V:htoH-Ym6OSR0^^m<Jia'YE\|@_,@wa}T;2CgAWL$A!"99CI$(07L2
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: b8 43 53 30 24 1a a3 71 a7 6b 9a 36 77 5b 8e 40 a7 70 ec b9 86 2c 8b af 06 33 1f fc 83 f5 a0 4a c9 f9 e2 17 41 f4 ff 89 6b 01 7a 8f 76 dc 14 b4 fa cf c7 61 5d 73 77 75 66 3b 0d 2a 6f d7 ac 37 05 da c5 05 dd 70 42 13 7a 38 73 8f 38 cf 7e ea f5 e0 b4 df ad e1 1c 6f 09 3d f8 a1 6e 5c 52 c7 50 9a 7c 02 d5 19 72 97 f8 ba 78 e1 3e 01 b3 c7 e7 d4 f9 31 76 82 11 01 6a eb 54 69 33 f0 c4 c4 97 29 e4 6e bd ae eb 11 9e 71 c2 b6 01 82 9f 4e 29 24 46 a8 37 06 57 c6 39 20 1c 7f 3e 10 47 06 dd bc a5 80 21 76 c8 a4 1c 19 de 13 c2 1b d2 fa 7c a0 8d 7d 28 60 d5 e9 ea 78 d8 ef 9c f4 31 a4 fe 8d 5c c4 98 b4 d6 c5 32 1b 03 34 78 af a2 c4 43 cb ad 5a 01 96 e4 16 a8 81 88 90 82 9f 5d 87 9b 63 f9 5b b5 96 0c 6c c4 52 eb 06 b2 20 3d 0d 95 9b 07 55 18 b1 ab 30 59 83 6c 17 3e b3 01 Data Ascii: CS0$qk6w[@p,3JAkzva]swuf;*o7pBz8s8~o=n\RP\|rx>1vjTi3)nqN)$F7W9 >G!v\|}(`x1\24xCZ]c[lR =U0Yl>
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 6e 33 11 68 23 f1 52 17 ec c2 53 bf df 20 70 d4 7b 0a 53 4e ec 58 31 87 71 91 28 06 e4 21 c5 97 db db a6 e0 1d 01 b3 8a 39 c6 f0 9a 99 08 65 ef 7b 68 d5 c9 2c 33 f8 ac da 2e 11 83 aa 97 b5 a1 74 0f 3e d8 8d 8d d0 ba 06 93 c3 55 1e bd 98 38 39 71 28 c1 9b 5d 2f f0 e0 52 3a 4a b0 c2 03 06 7e 35 dc f0 47 45 41 22 30 e0 83 31 6b 4b 0f 72 e0 92 47 0e 5a 72 cb c1 4b 2e 39 64 c9 c9 d0 08 1d 7a 7c f7 03 14 6f 4a 0e 18 97 0e 50 8e c0 4a e9 5b ab f5 2a 6d 68 a3 7a ec 84 c8 52 67 ae 5c 83 90 31 1f 7d d6 35 35 e8 34 68 d2 8a 83 19 63 15 dc 67 2e ec 2e 0d 16 2a 34 ea 31 2e 41 96 32 58 5d 86 4c 59 75 08 eb c9 e2 be 74 22 e4 20 a0 39 55 6a 12 16 91 28 5b b9 af ba 0d 9b b6 06 47 3f 83 d3 2f fc 9a 3f 42 5d 9f 80 d9 0f d9 86 df 86 d5 8f df 85 5f 87 e6 c7 f9 c5 4f 00 87 52 Data Ascii: n3h#RS p{SNX1q(!9e{h,3.t>U89q(]/R:J~5GEA"01kKrGZrK.9dz\|oJPJ[mhzRg\1}554hcg..41.A2X]LYut" 9Uj([G?/?B]_OR
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 53 78 2a 4f fd 19 3c 63 17 e7 24 38 a9 4e ba 97 f3 e5 7e 3d bf 92 9f 8a 34 79 e6 86 5b d8 41 43 a5 cb 9c c3 9c 65 01 87 73 1a 6b d8 c8 36 76 0a 93 b4 0a 45 c5 95 54 56 64 80 2c 55 30 74 06 5d 0f dd a4 cd da a1 46 23 5d 54 bb a6 39 28 7c a2 33 e2 5c 38 6b 9d a1 5b 42 24 02 6b 31 53 8b 78 d6 84 31 c5 02 bf d8 e4 5f d9 87 45 c2 7d 67 0e 40 67 87 0b 56 04 23 3e b5 84 93 7c 8a 4f d5 69 38 43 17 c0 76 4f 42 93 da a4 77 b9 5d 4f ae a4 a7 42 3e 8f 5e 40 26 b6 b1 8b 14 43 0f 2c e6 58 56 0f b4 dc 7f 59 fa 4a 29 6e 1c 68 7f 5c 87 03 80 4a 0a 7d 81 97 9b 6e 73 ff c7 58 fc c4 f8 f7 69 3c bb da a1 31 85 49 4f 6a 62 13 51 42 e1 7b df 61 f6 c6 71 46 be 47 16 1e 1f b2 3f fe 1d fb 83 4e ef bb 5c 7b 2b 38 d7 1b 97 9e 7f 7e 59 7f 4d cb a2 5d ba 65 c1 2e 11 f0 c7 3d bf 8c 3f Data Ascii: Sx*O<c$8N~=4y[ACesk6vETVd,U0t]F#]T9(\|3\8k[B$k1Sx1_E}g@gV#>\|Oi8CvOBw]OB>^@&C,XVYJ)nh\J}nsXi<1IOjbQB{aqFG?N\{+8~YM]e.=?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.7	49827	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:44 UTC	909	OUT	GET /assets/452d7be36bf4b23241bd.woff2 HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://discord.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:44 UTC	958	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:44 GMT Content-Type: font/woff2 Content-Length: 139388 Connection: close CF-Ray: 8d782d68ab166b3a-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "db985aaa3c64f10506d96d876e350d47" Last-Modified: Fri, 06 Jan 2023 01:15:23 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xYUaublMLMdwYAFWRTqzpHshXZFFxK9dzQAU%2B8c0C5fnf255rjoBHfl35VMVc0ejePE4RrROzKUhfYxxy5MFhiTzS%2Bzcv2Nli3nB621gNj9N4udBro%2BfRQl3I5lV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:44 UTC	411	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 02 20 7c 00 0f 00 00 00 06 39 84 00 02 20 1b 00 02 01 cb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 8b 66 1b 84 bc 76 1c d3 04 06 60 00 95 1a 11 08 0a 8f 8e 18 8c 96 65 01 36 02 24 03 f3 54 0b f3 58 00 04 20 05 8a 7c 07 82 bd 5b 0c 07 5b f2 42 b5 cf 7f 63 dc 7b bd ab ca ee 3a ec 77 e9 06 54 0a 6c 1b db 86 04 43 d3 54 2b cf d8 ef 47 93 a0 c6 18 de 1b 02 46 e5 5c 73 1a c7 a8 bb 6d 8c f0 4a 0f 6e 60 eb b6 d2 f1 d0 79 03 f3 aa 36 f2 3c a5 e9 ff ff ff ff ff ff ff ff ff ff ff bf 97 e4 c7 63 9b bd 99 9f cc fc 23 17 e1 08 97 01 82 c8 a1 15 b0 1e d4 0b 6d d5 b6 bb 6e b7 10 85 75 b0 ce 23 24 48 e1 02 2b 19 94 cb 19 31 29 94 6f 71 b6 6c d3 8e 40 b5 0b e9 55 85 87 eb 23 54 70 50 0c fc 10 43 ef c9 88 58 6b 89 60 9c 6b c0 Data Ascii: wOF2 \|9 fv`e6$TX \|[[Bc{:wTlCT+GF\smJn`y6<c#mnu#$H+1)oql@U#TpPCXk`k
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: ad 35 e9 32 c2 0c 88 a0 e4 fc e5 1a 29 d9 60 a7 4e a8 96 c2 8a 44 2e 66 77 54 7a ab fe 61 df 41 88 20 8d fc db a8 29 c8 3d 2e 5c 59 9d b7 5a 0f 27 29 2b 12 99 08 2f fc 92 95 ed 30 7b c4 94 84 38 db 91 e1 32 36 75 8f 3b 3c 61 c0 ac a0 f1 c9 0d 1a 3c d3 d6 ed b1 3d 9e 13 9f c5 ee 65 71 3b 6b 44 a6 a2 b0 82 59 d7 e1 49 5e bf ef 60 f1 52 88 b3 6e af f9 8f 54 3d 1c 52 a1 2a b0 54 14 4a 6c df b9 57 ff e0 70 d5 86 bb 5d df 05 2a b8 ca 18 35 19 28 79 23 07 e8 13 a3 50 d3 47 f6 4e f2 de e9 f5 b4 87 10 df 24 49 76 08 e4 9d ff 88 cd a1 7e ef 0f 8b 02 6e 73 93 f6 9e 4a e4 f0 1d e5 54 75 59 21 6f c2 07 6a 7a b0 96 09 50 35 7c 40 9f 11 48 e0 54 75 a6 50 b1 62 21 54 85 eb ab 72 37 aa ac 2c 3c e9 75 c9 4f f4 98 e3 af 13 3f 9a 8d 9f 91 19 bf 4a f4 39 bb fe 9d e7 19 dc 09 Data Ascii: 52)`ND.fwTzaA )=.\YZ')+/0{826u;<a<=eq;kDYI^`RnT=RTJlWp]5(y#PGN$Iv~nsJTuY!ojzP5\|@HTuPb!Tr7,<uO?J9
2024-10-24 07:15:44 UTC	1267	IN	Data Raw: e7 05 b9 67 4b 77 27 9d 2c cb b6 3c e3 38 d3 c9 7e ef 8f 39 4b c7 04 b4 45 78 02 58 44 ca 58 cd 4d a9 3d 07 21 19 8c ae 12 c9 23 bc 3a 89 82 8b 63 99 80 6c f6 71 e6 f5 63 7c 59 c2 03 7f 96 5c 8c d9 6a 40 f9 9a 0e f4 09 03 80 a1 80 94 3a a5 9c 53 28 1f 98 37 b8 ac 95 da 4e 32 74 88 8f 77 aa 49 6a e9 c9 41 f8 fa 80 66 0f c6 b5 3b 67 42 75 2a 76 96 39 28 83 7b 4b 24 22 ee 47 e7 9b 6f 9d 6e 99 ee 52 aa 24 10 46 85 9f f2 b1 0a 2a 7c 84 7c 48 08 a7 db cb 90 75 c8 36 84 48 76 5b d8 a7 16 70 94 c9 09 24 1e 82 9b 58 ea 02 8d e3 3d 3d d5 65 f7 14 00 37 40 1c 9d a7 22 0f 7b 97 e1 53 25 05 7e b0 94 2b b0 25 5b 8a 0b 98 48 76 99 ea fb e1 c3 af ef 9e 1f 32 0a 4d e1 90 38 2c c2 a1 0c 46 7c ab f0 c9 a2 6c 48 f6 4d 08 ac ae 11 61 b3 b4 55 db 0e 51 6d d9 3d 00 2b 20 e5 d9 Data Ascii: gKw',<8~9KExXDXM=!#:clqc\|Y\j@:S(7N2twIjAf;gBuv9({K$"GonR$F\|\|Hu6Hv[p$X==e7@"{S%~+%[Hv2M8,F\|lHMaUQm=+
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 5c d4 ef a9 5e d3 43 c8 38 1b 9d 73 ac 2e cc 88 98 21 f7 04 9e 31 26 c9 2e 88 2f 08 93 55 7c 3c f8 9d 94 ee dc 07 8a 45 8f 2b 72 8a d3 a1 f6 05 23 21 5f 45 39 1e fc 4e 04 6d 7e e9 8e 22 5c 00 1c 06 83 13 cc 9b 43 b9 38 b1 89 f8 e6 bf d7 e9 b7 bd 4f c0 ff 4f b8 89 54 ec 3f 05 67 1a 38 f9 a5 ed 4b 2f bb 3f bb d9 3d 1e 28 7a 92 a8 92 6c 3f 0b 17 21 37 51 e2 08 51 f2 90 dc 54 20 2a d8 96 90 28 2d 1f d7 43 3a cd 39 36 c6 e7 3c 24 d1 1d 1b 24 1b bb ff 00 2e 04 ff e2 96 d2 6d 64 ff e3 1a 37 9c 5e 49 77 a6 f4 e5 2c 67 b9 9c 63 a6 d7 dd 6e 96 7f b7 fc 8b e5 f4 b2 9d dd 62 78 1e 7e 99 3f 9d cc 3d bf 5f fa ca 38 1d 69 e1 0f b3 94 cd fb fd d1 ab ec 32 6b 51 91 14 e1 90 08 59 e1 79 ba a9 4d ca 7a d9 fe 58 47 47 18 66 89 2e cd b2 6b 80 25 d8 07 ce 82 ff 68 a9 1a b6 79 Data Ascii: \^C8s.!1&./U\|<E+r#!_E9Nm~"\C8OOT?g8K/?=(zl?!7QQT *(-C:96<$$.md7^Iw,gcnbx~?=_8i2kQYyMzXGGf.k%hy
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: cd 56 3b 6c e5 3b 5f 9a 6b ef ab 4f 5f 39 1c ae b1 af 7d 2d 0f 6f ff 28 1f dd ca 67 6e 7a 73 94 c3 b4 68 d9 6c d5 a9 08 d1 40 d8 4f 70 88 ec 28 d5 71 ba 33 5c 97 64 b9 43 26 fd 63 37 b1 39 3f 1b e5 74 e6 7b 90 08 46 92 a3 26 37 3a 4a 93 74 a6 15 56 80 a3 3f e5 80 c1 df 37 6f 67 c6 43 f4 24 98 e4 49 96 3e 19 72 26 5f e1 14 29 99 4a 9f e7 b3 ba a9 d3 3a ad ba e6 a4 de 31 1a 18 b3 91 21 33 c5 33 9b e4 14 e4 6a 1e 2b c7 ab 42 a5 a2 46 b5 06 35 9a d4 64 a3 b6 f6 6a 6f 56 17 37 ac c8 78 d2 54 b9 c9 04 72 4c a4 48 f3 8b 06 4b 4c 35 4a 7a f0 99 1e 7e 30 2f ff 58 9c 90 72 46 69 91 51 22 51 51 52 61 10 06 8b 98 04 c5 77 55 42 a2 92 90 96 9a 82 0c 6e 2b 85 ba ac b4 e4 67 a6 6c f7 95 c7 4a 75 3e 68 bc 70 45 88 56 34 ac 92 65 28 43 96 b2 64 2b 5b ae f2 14 aa 58 a9 ca Data Ascii: V;l;_kO_9}-o(gnzshl@Op(q3\dC&c79?t{F&7:JtV?7ogC$I>r&_)J:1!33j+BF5djoV7xTrLHKL5Jz~0/XrFiQ"QQRawUBn+glJu>hpEV4e(Cd+[X
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 2c 12 21 7b 02 61 84 91 bc 21 87 c7 df 6e 0c 30 b5 22 77 6e d0 bc 7e e9 b1 78 fb 49 b1 5a c3 8f 23 3f 6e ad 6d df 1f 1d ae 42 a3 fe e9 c1 db ff 7c 3f fc 4e 90 98 ab e7 30 e7 af f6 31 c3 13 ac aa e4 42 db 3f 19 4b d9 53 13 c4 bd 67 e3 6c d0 43 6c 87 ef 01 ce 47 fc 9f 0c 4d 0a cd 2d 5a a1 f1 8d ed c0 43 3d 07 e4 2c dc 5e dd 61 53 84 77 70 b7 e8 75 9e 9e 6b e8 df ae bf 7f 28 5e 65 b2 96 be 28 f1 3e ae ba 67 ea 66 25 63 3b 47 e1 20 d2 0d 7d 19 8b 0c 17 e3 91 60 27 b5 49 d5 07 95 04 d3 a3 2c bc 67 ba fd 67 a5 e3 11 8c 5e 41 74 c6 e1 e7 f8 d8 17 1f 77 04 67 f5 7a 21 9b f0 fc 25 d5 ee 77 9b 93 d2 09 05 c4 b6 8b e7 a5 8f a2 d3 75 7f 30 53 46 12 74 29 14 2f 49 f3 a4 9a 8e ae d2 bc 42 ba f7 0e 2b 60 1e 20 fc 47 5f b4 09 37 11 18 18 b0 b8 ae f1 ac fb 1d 57 cf 97 7a Data Ascii: ,!{a!n0"wn~xIZ#?nmB\|?N01B?KSglClGM-ZC=,^aSwpuk(^e(>gf%c;G }`'I,gg^Atwgz!%wu0SFt)/IB+` G_7Wz
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 1d ce 68 6a dc e3 70 35 37 d7 36 ef 5b 4f ed e0 8d a5 83 c4 ee b2 21 d2 1d b8 d0 ec 2d 1d c5 5d f0 79 48 3b 79 35 72 28 92 33 e5 74 9f 7a 28 2d 4b 57 a1 d2 b4 99 da b6 dc c6 8e dd 3c f8 10 bf 1f 91 68 db 96 be d5 7f ea 23 0d 71 66 ea a6 6a c9 51 47 25 8e 92 44 1c 25 84 48 e8 a8 24 49 e8 28 77 b4 f6 f1 dc c2 65 76 96 93 15 5d 65 4e d3 66 1e ff 62 d5 f6 87 dc 91 dd 41 4f 52 bf b9 4f 89 a9 7b 6e ff 56 f3 d4 fe fc 11 33 fe 90 09 c5 10 af 63 fb 29 0e be 41 62 d3 7d 6c 1e b8 77 cc 62 1f 36 77 fb c3 ef 53 df b9 0b 98 1b 8f 1b 4e 6d 3d b1 a3 9c cd 2d 96 76 23 d2 cb 1f d7 bd 57 92 29 28 c0 14 44 10 41 86 9c e3 d1 84 a9 9c 6e 66 72 4b 6d bb fa 81 b6 ab ff 1c 9d 04 00 c0 39 69 c9 56 fd b7 d4 13 b7 29 2e d5 d9 c1 1f 7a 7c ba 4d cf 56 e6 cc be 39 18 38 f7 9c b8 e7 23 Data Ascii: hjp576[O!-]yH;y5r(3tz(-KW<h#qfjQG%D%H$I(wev]eNfbAORO{nV3c)Ab}lwb6wSNm=-v#W)(DAnfrKm9iV).z\|MV98#
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: a4 52 25 8d 26 e9 74 fd 7b 7d c1 82 21 1d 8d 05 4b a6 74 36 f7 ad 5a fb d6 ed 7d db b6 53 8a 8a 39 ca ca 49 15 95 f2 aa aa 49 e5 a9 05 42 2c 12 3b 44 22 c5 0a a5 44 a7 57 64 30 8a 6d 76 ec 70 3a c4 e5 76 93 c7 2b f1 f9 1d 11 08 2a 0a 85 9d 12 89 e2 54 5a 92 c9 2a 2a 14 9d 50 2a 3b a2 52 75 5d ad 2e 6e 34 15 b5 da 6e d1 e9 ba 61 30 14 8f c6 68 32 95 ce e6 ec b3 73 d6 c5 25 ba ba 76 0d 00 3a 60 b1 84 ab b5 f4 e6 d3 b2 bd 14 10 fb 0a 70 05 5e 09 49 e3 55 d0 54 5e 0d 2b c7 6b e0 b9 bd 16 91 e0 75 c8 dc de 80 2e df 1b 31 e5 79 13 36 f9 9b 71 b9 bd 05 df 48 6f 25 24 7f 1b 31 b7 0e 83 44 d7 4d 25 49 34 8e 95 6c 2a 59 aa f1 54 99 5a bc 6c 0d 01 91 5b 55 a9 dd 50 4d 6e aa a5 b7 91 0d 54 54 96 a6 59 43 47 c7 4c ad 24 4b 3b cb d5 4b 0a 71 91 d8 b0 a7 43 f8 9c 94 50 Data Ascii: R%&t{}!Kt6Z}S9IIB,;D"DWd0mvp:v+TZP;Ru].n4na0h2s%v:`p^IUT^+ku.1y6qHo%$1DM%I4l*YTZl[UPMnTTYCGL$K;KqCP
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 45 a2 c6 bd 64 bd fb 29 4e 3a 2d ce 64 ea 59 e7 c8 85 02 b9 b3 53 53 2c da 46 47 5d 33 33 2d ab 56 39 d7 45 50 8b 8c 34 dd fa 11 21 31 05 21 2d 0d 21 3d 8b fe 38 8e f3 a6 5c 98 bc 62 2a 25 15 30 35 35 48 b5 0d 30 4d 4d 30 cd 6d 48 ed ed 0c 4f 92 ab a7 a8 a9 6e 7a a2 87 99 ea 65 27 fa b8 a9 7e 7e 62 40 40 be 8a 10 41 42 06 65 68 48 41 86 55 68 44 43 46 75 68 dc 84 26 6c 68 ca 85 66 7c 68 2e 84 16 62 68 29 85 96 33 64 25 c7 3e 28 90 d5 12 fb a8 42 d6 6b ec 93 06 d9 6c b1 3f 90 50 15 02 12 84 81 05 71 c0 11 44 83 16 c4 80 11 9e 0b ae 70 3c f0 84 e7 7b 32 27 a0 e4 85 d4 9c 02 2d 2f a2 e7 c4 cc 48 ca 8e b4 f1 d3 50 98 c6 e2 34 95 a6 99 ac 99 cb 1b 85 a2 09 80 06 04 9b 08 6a 60 b8 48 90 c8 08 5a 64 58 64 0c 2f 0a 22 32 41 16 4b 65 64 4a 55 ac d5 91 19 4d b1 d5 Data Ascii: Ed)N:-dYSS,FG]33-V9EP4!1!-!=8\b*%055H0MM0mHOnze'~~b@@ABehHAUhDCFuh&lhf\|h.bh)3d%>(Bkl?PqDp<{2'-/HP4j`HZdXd/"2AKedJUM
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: b6 f7 aa e6 5b 84 1a 0e 60 20 8d 8b 0e ad 49 b1 a5 6a 56 66 39 3a cc e3 16 3e a8 b0 62 5d 2b ab 5c f7 aa c2 eb 51 75 5f 7c bc 4c c7 7d 7e d1 e6 8b 79 d9 c2 37 0d 34 e5 db 66 9b 33 ac c5 56 8d 68 a3 9f c6 cc 95 db 3a 4c ee 70 d4 60 ca cc 06 56 b3 86 b5 fc c2 3a d6 b3 21 6c 6c 45 9b ec f1 c1 89 a9 cc d0 c9 19 cf c4 8d a3 0f b7 b8 cd 9d 70 b7 4d dc 9b 61 a2 89 58 66 64 5c 1f 09 1f 75 dd b0 a6 ec fe c7 e8 c8 e1 83 f8 b1 95 e7 94 3a 7a f9 fe 84 43 6f ed 08 14 3a fa f8 1a be 46 45 cd 1e a1 1f 8a 79 df be 81 a5 bc 79 6f 71 b9 87 96 a8 78 0e 54 f3 12 de b9 da ec 25 1a e9 dd 26 2c a5 5a 3c a8 68 49 cb 5a 11 31 5b fd bd ac 35 7b 11 00 05 f6 18 8d 25 90 28 40 4f 8c a7 36 fa 34 9b aa 67 1c 53 40 43 bc d0 18 61 47 c4 1f 98 cb 4a 40 e6 7d 31 04 19 df a6 33 d0 84 53 f3 Data Ascii: [` IjVf9:>b]+\Qu_\|L}~y74f3Vh:Lp`V:!llEpMaXfd\u:zCo:FEyyoqxT%&,Z<hIZ1[5{%(@O64gS@CaGJ@}13S

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.7	49831	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:44 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:44 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:44 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 20049dc1-d01e-0014-1b33-22ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071544Z-16849878b78x6gn56mgecg60qc00000000mg000000000fuw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:44 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.7	49830	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:44 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:44 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:44 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 6129b0de-c01e-00a1-59fb-247e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071544Z-15b8d89586fst84k5f3z220tec0000000e4000000000210t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:44 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.7	49824	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:44 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:44 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:44 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 14811fc9-901e-0016-298e-21efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071544Z-16849878b7862vlcc7m66axrs000000007g0000000000ftx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:44 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.7	49832	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:44 UTC	909	OUT	GET /assets/48a594e29497835802fe.woff2 HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://discord.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:44 UTC	956	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:44 GMT Content-Type: font/woff2 Content-Length: 179380 Connection: close CF-Ray: 8d782d6c58183165-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "7cf1be7696bf689b97230262eade8ad8" Last-Modified: Fri, 06 Jan 2023 01:15:24 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OpzEFDVRofHYRZjGYzuoTffVBsgRsfPiU0VpXq8vXTodyuGPP32y4u%2Bz4arstuCEXggKVAfgzYLIurTkWr9l1tP3xvh0t5cb%2B8WFlq3fYXaGeuiCVOiCLVVZi0HW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 02 bc b4 00 0f 00 00 00 08 95 4c 00 02 bc 51 00 02 01 cb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 91 08 1b 84 de 46 1c 83 85 76 06 60 00 98 3a 11 08 0a 94 9e 24 90 9b 10 01 36 02 24 03 81 92 40 0b 81 92 44 00 04 20 05 8e 5a 07 83 c6 5c 0c 07 5b 6c 49 d7 01 3c 15 fb ed ed 72 73 b7 4a 08 99 9c a8 e3 48 80 48 cd 47 ca ac ff 4c 63 36 87 58 fe 07 c0 01 a2 a2 ed 32 e9 06 f8 8f 31 dc fb 9c 42 08 d3 dd 64 35 b2 61 96 8e 31 0c d8 00 14 ab f4 5f 28 05 44 c6 d8 26 76 84 ba 1e cc 2e 11 af 5b e0 95 04 51 3d e1 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff bb 4b fe 13 ea f4 fd 7f d2 ff 77 27 9f 2c 79 6c d9 60 0c 31 78 30 8c 59 61 85 11 42 02 85 50 68 9b d2 36 6d 0d 44 89 15 a2 10 6b 45 c5 42 60 9d 7a 47 34 91 92 a5 25 Data Ascii: wOF2LQFv`:$6$@D Z\[lI<rsJHHGLc6X21Bd5a1_(D&v.[Q=Kw',yl`1x0YaBPh6mDkEB`zG4%
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 10 7a c8 f1 51 82 54 88 88 36 e8 37 11 0b 25 2c 54 7c 46 61 c5 d3 2f 28 0f 03 c1 28 5e 63 e5 2b b0 13 0c 6c f4 61 14 16 cc 85 fe 89 a6 59 d5 fb a3 96 2d 3b 3d b6 93 23 da 03 a2 e0 e6 88 10 42 56 0f a0 9e e9 71 57 04 9b b5 b4 58 eb 14 6d a8 53 f5 5e 95 3f e7 fd 79 ab f3 f6 8e 37 1b 3b e8 1e fb 97 6d d4 ac c6 bc bf c3 df c3 b4 ba 8d 76 80 b6 d9 e9 04 14 30 56 a5 ac 74 55 ae 02 37 df d9 cb 72 fb d7 05 4c 6f 73 ef 36 6d c4 42 a5 44 42 3c 4a 40 40 40 8c 06 45 05 8c c8 4d 97 e1 da e1 f7 c7 bf 2f 6f 4d 09 ee 90 d2 22 55 ea 7e 1a 94 c0 b6 b6 f6 e5 0b 1f 5f 88 5f e2 ff 79 8e 7e 7f f6 6d 9c cd 33 89 24 ce b1 e5 61 59 7f a0 07 df a3 bf d7 e6 3b 92 fc 42 f7 4c 10 a1 02 a4 a5 ca d5 d6 8c 15 33 f2 f4 fd 01 bf 73 77 a1 99 9f 17 60 66 89 26 81 78 a6 49 d6 7f fb 13 73 d6 Data Ascii: zQT67%,T\|Fa/((^c+laY-;=#BVqWXmS^?y7;mv0VtU7rLos6mBDB<J@@@EM/oM"U~__y~m3$aY;BL3sw`f&xIs
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 46 27 45 6f 53 48 15 74 f0 04 e4 f6 9c 8d 09 3e f0 6d be dd 5d dd 34 a6 b1 a1 09 d1 00 d9 30 d1 bc 3a 83 b8 a7 5f 4b 7e 97 bf b3 94 f7 f6 a8 c2 81 d1 38 84 bc 46 ad 37 08 85 8a 4d 34 ad 74 e3 98 ff 77 b3 0f 76 ff c2 ae 57 6c 64 df a9 8c 69 47 cc a0 3c b1 ce ac fb f3 df 99 df 3a 52 83 60 21 01 12 48 1c 4a d0 24 90 40 ae ac 7c cd d4 3b ad be 75 c7 dd e7 43 91 2d 27 0e c8 9c b0 cd 21 70 68 b1 5b ed 58 b3 91 15 cd ac f7 ad c6 2f 5b e7 57 95 d9 f8 e7 7f 71 10 93 d9 64 28 c0 07 21 90 ed 7a 18 2e f7 28 5c a8 48 71 da 66 51 61 b3 0b f2 46 62 ec 59 a6 f6 ef 2f ed ce ff a7 2e fb 6b 65 4c a9 63 2d 02 71 20 2c 4b 04 84 1d bc 2e 41 94 31 87 67 0d e2 db 92 91 fe 27 7c b6 cf 8f b8 a8 3d 12 af ca 15 7d c2 3e 00 1c 09 a0 ce 41 64 a8 9a 90 a7 e2 45 00 f4 3c de 94 18 08 9e Data Ascii: F'EoSHt>m]40:_K~8F7M4twvWldiG<:R`!HJ$@\|;uC-'!ph[X/[Wqd(!z.(\HqfQaFbY/.keLc-q ,K.A1g'\|=}>AdE<
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 90 52 51 10 08 20 f2 95 f5 bd 67 3d 4e b1 9e b6 95 49 eb 5b 1a b3 26 b5 a0 9c 30 18 b6 00 07 c2 b5 e5 63 e0 09 96 64 28 f5 0d 43 ab 31 ad 39 43 33 c4 47 e8 c3 95 7d 51 2b df 1c b6 44 3a 6b f6 b0 bd 00 91 fe ca 9a a3 15 e5 3d 2a 7b 80 55 68 dc 00 91 3d 10 5b 1e fa bf 4f f9 27 fb 84 7e e8 82 94 a4 40 35 5c f7 79 32 ed 8e 3d 5e 4a 44 8a 18 ac a6 84 05 c5 fe 9f aa 65 3b 9f 83 bf 04 56 c0 3b f1 78 29 48 e7 94 8b 0e 1a ef bb a0 d7 5f 79 4d 4d cc e0 6b 38 00 be f8 b8 22 36 51 b8 10 33 40 ed 8a a2 64 25 a7 d8 f9 b9 75 ae 43 ec b7 2c ec ce 6d c7 2b 3a 87 54 d4 26 da 5c 96 0f 69 a1 55 91 c1 b8 30 ba 44 f4 87 be a6 be 4d 7f 60 9e d6 4e 20 18 b0 50 14 e3 11 a8 f8 85 db f8 af 05 94 20 8c 1d d0 ab 77 38 cc 34 89 79 f8 fe 93 aa ea 51 10 70 a4 6b 1f 33 96 3a 4c 04 e5 f4 Data Ascii: RQ g=NI[&0cd(C19C3G}Q+D:k=*{Uh=[O'~@5\y2=^JDe;V;x)H_yMMk8"6Q3@d%uC,m+:T&\iU0DM`N P w84yQpk3:L
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 1f 2f 32 4c 16 19 a9 8c e4 a9 23 63 b5 91 7c 43 64 82 29 32 c9 29 32 17 18 99 0f 8e 2c 84 45 96 a1 23 cb b1 91 15 84 48 89 ff 99 c3 70 d1 3c 46 8f e6 3b 6e 62 31 33 46 8b 9b 39 5a d2 82 68 d9 2b a2 8d 39 9e 22 19 30 45 9e 48 93 62 4e 8c 49 e4 43 37 49 75 54 90 d4 a7 cf a4 81 df 9b 01 79 81 a2 3d 20 3b 28 ba 03 f2 72 45 1f 40 76 52 0c 01 e4 cd 8a e1 80 bc 4b 31 1e 90 5d f2 bf 4d 99 ad 6c 07 28 8b 95 9d 00 65 8d 72 00 a8 6c 52 ce 11 94 b3 c5 14 95 8b c5 11 14 bf 32 34 fc 8e 25 a4 9c 5b 23 50 55 fc 24 48 19 0a da 70 64 4e 26 d9 c8 a8 46 4d 33 79 0a a6 48 d9 54 a8 9a d5 a7 41 3f 26 62 5a 46 55 7d 8b 2c 10 30 08 84 25 14 c2 9a 2d c2 d6 4c 59 98 27 3b 4b e4 c0 41 4e 96 8b 66 a5 fe e3 24 0f 9b c4 e4 ac d7 9a d4 aa 43 1d ba d5 ad 5f fd 9e e9 b5 b7 7a 1b 53 0e 14 Data Ascii: /2L#c\|Cd)2)2,E#Hp<F;nb13F9Zh+9"0EHbNIC7IuTy= ;(rE@vRK1]Ml(erlR24%[#PU$HpdN&FM3yHTA?&bZFU},0%-LY';KANf$C_zS
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: a2 db 1f 04 5d 40 43 c2 73 fd e0 6d 3e c8 53 55 ba 96 4b 33 0e f2 47 e6 b9 26 3a 88 49 5f 39 d2 16 35 ac 71 b1 7c d1 1a 25 d2 a8 fd 56 6a d7 30 b8 8f 06 6a d3 ef 44 45 dd af 67 dc 9d c2 3e 1b 3e 1f c4 ab e3 63 1d 3c aa 0b 99 3f b7 76 83 8d bc c6 24 72 4e aa 23 13 bb a8 9f 6b 1f d8 79 b6 6d 7a df 93 92 99 27 c3 66 bc f5 fd 43 27 56 66 3f 35 4a 7d 17 ab b6 83 19 fb b8 c3 a9 fa a5 b9 c7 b3 40 36 9a 11 31 d8 e7 2d a6 09 4d 69 c5 a5 6f 59 27 78 80 1b 1a 9f 09 57 12 2d 51 5a 5d ed 69 a4 4a bb c3 02 86 4d 83 e9 73 16 70 55 6d 52 27 e0 44 b1 39 c8 80 35 2a fe e8 85 af 77 0d d0 c3 13 1f d5 37 f5 96 9b d0 7e 21 a5 89 23 7b c5 25 5d 0f 65 58 53 8f 95 f9 ad 4c 01 12 a5 3b 2d 35 ce a5 fd 22 95 92 02 5c 93 4d 2e a4 82 fa 58 5f dd fb e6 47 b2 3f f3 1c cd 73 51 5b 9d 27 Data Ascii: ]@Csm>SUK3G&:I_95q\|%Vj0jDEg>>c<?v$rN#kymz'fC'Vf?5J}@61-MioY'xW-QZ]iJMspUmR'D95*w7~!#{%]eXSL;-5"\M.X_G?sQ['
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 71 95 ac c1 25 75 95 d6 b2 31 71 76 77 ac 40 90 44 90 19 22 ea b3 6f b1 3f e5 5f 80 38 e7 1f 58 f8 2c 5e 35 40 bf 06 71 ca 70 d2 cc 0c e7 89 97 16 89 37 96 88 f7 be 20 3e 3b 4b 7c 71 8e f8 e6 02 f1 dd 45 e2 b7 ab c4 1f d7 88 7f ed 27 99 7c 09 fa db 13 d0 c5 af 22 01 f2 ee 1a 3d e4 48 f5 72 ac 8f fb 0c f0 80 41 1e 8c 94 25 51 da 1f 21 c5 fe 35 b3 d9 37 15 03 0a 2a 4d cc 47 e2 47 d2 47 72 d1 8a 4f e6 86 72 37 5c fb 8d f6 e3 c6 36 36 dd b7 7b 41 0d 84 b5 a3 0e cd ba d1 14 62 6c 30 51 7e d3 7f c4 66 55 30 be e5 08 27 b8 d4 dd af 97 3a 06 3a b9 f1 b2 30 8a 42 92 a4 7b ae 7f 12 ec b6 38 36 09 ad b5 89 8d fd b8 ad d3 ee 86 e5 c3 3d 38 3d 04 1e ea 61 1e ee 11 3e ec a3 e1 e3 6b d8 5e a7 a8 f0 98 92 a4 93 45 4f 5c d8 f0 d7 7f 5b 41 58 05 83 20 c2 36 8f 60 15 50 d7 Data Ascii: q%u1qvw@D"o?_8X,^5@qp7 >;K\|qE'\|"=HrA%Q!57*MGGGrOr7\66{Abl0Q~fU0'::0B{86=8=a>k^EO\[AX 6`P
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 56 64 05 15 6b b2 86 86 96 b4 60 3a d2 41 c3 06 22 a6 87 4c c3 00 15 b3 85 ce 8a 1d 4c cc 01 ae 58 04 84 62 91 90 8a c5 c6 2e 02 07 a7 50 5c dc 22 f0 f0 0a c5 c7 2f 82 80 a0 50 42 c2 0c c4 c4 19 48 49 33 90 93 67 a0 a4 cc 40 4d 9d 81 96 36 13 1d 5d 36 f4 f4 b9 31 30 64 c3 c8 98 1b 13 53 6d e4 c9 ab 0d 33 73 6d d8 80 59 6a 07 4a 25 05 9c 95 f6 90 58 07 68 1a bd 48 a9 f5 26 d7 8b 42 49 ad 1f 2d 47 65 cc 92 58 ac 5a a8 e2 a6 36 84 57 2f 3e bf 71 02 41 6a c3 84 39 aa 17 d5 47 22 29 49 26 6b 80 5c 9e da 68 55 8e 3a d4 25 69 b5 f5 d7 e9 ea a3 d7 37 c6 60 a8 85 3e 63 49 66 73 63 ad d6 5a 18 b6 4d 61 9a 5d 4e 26 d9 67 a1 c0 31 a5 99 4e 29 cc 72 2e cf c5 a5 1e ae 80 84 b9 c0 9c cc 00 35 c4 2b c0 59 58 00 69 a8 d7 c0 1b ee b5 88 14 7e 40 d6 c3 eb 51 65 7a 03 3a e1 Data Ascii: Vdk`:A"LLXb.P\"/PBHI3g@M6]610dSm3smYjJ%XhH&BI-GeXZ6W/>qAj9G")I&k\hU:%i7`>cIfscZMa]N&g1N)r.5+YXi~@Qez:
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: d4 58 54 d4 0a c7 b9 db 8a 18 e3 ca 5b 54 19 cc ab 52 26 98 9d f2 20 ed 54 00 6d bf 62 b6 36 2a 51 82 af 54 29 0a 14 94 22 8e 30 b2 ad 45 90 6d 2b 86 6c db b1 64 db 89 8b 81 87 a7 14 9f 00 92 88 48 03 31 31 21 59 58 30 45 a4 b1 a3 6c 2b 2a 1b af 3b d1 49 cf 83 fe 7d 2b a6 f8 88 3c 18 49 4a 27 19 34 46 4e 4d 85 74 23 67 80 c1 0d e6 e9 46 ce a3 93 05 c1 5f 44 b0 5e 91 1b 6e d0 64 21 61 c3 77 22 06 02 c2 cc cb 25 8e f3 7f 99 13 4a d1 b2 73 e2 f8 5c a6 45 f1 30 9b 9f 97 03 73 60 0e 0c d9 49 1d 41 3d d2 00 1a 91 26 d0 8c b4 80 36 d0 71 0e 21 93 3e 66 7b 12 c7 cc c6 30 2c c8 08 71 07 19 23 3e 41 9e 12 ff 46 26 88 2f f8 fd 06 eb ae 2c bf 60 fd 1f d6 df 61 95 55 eb f5 c1 5c 21 50 45 f5 01 a5 6b 11 22 cc 36 fb a6 cb ef fc 98 4b a4 b4 54 a4 c1 40 c4 40 c4 40 ec d2 Data Ascii: XT[TR& Tmb6QT)"0Em+ldH11!YX0El+;I}+<IJ'4FNMt#gF_D^nd!aw"%Js\E0s`IA=&6q!>f{0,q#>AF&/,`aU\!PEk"6KT@@@
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 69 1c 69 ff 91 a0 c9 32 42 f0 0e f1 f0 ee 4f fc d4 de 90 44 f7 a6 e3 8c de f2 88 a0 b7 15 c5 bd af 24 ef 43 65 75 1f ab e8 fb d4 bf 4c 7d 6e a2 e9 eb 6f 4e 7d e3 bf ac 7d e3 77 de 7e f5 b7 6c bf fb d7 b4 7f 77 c8 a4 1f 72 f0 50 61 ef 5a a1 9a 5c 3f e0 26 f7 bd 16 75 bd 1f 75 af c7 6d 26 29 4e e0 b4 02 24 b0 63 64 50 62 fb be ec 8e 75 5c 22 54 71 4f 66 8e 87 81 c1 91 98 0c 4e 2c 23 12 71 14 86 38 89 b3 44 27 31 df 34 c4 ed eb cf af dc 24 99 71 6c 43 af 30 49 3c 18 f7 2c 25 b4 d1 56 22 00 a1 5c 9c d2 71 fc 28 9d 92 0e e5 3a e5 7a 78 6c 66 6c 1c c8 19 9b b2 d3 fb 8c ed 35 ac ca 59 38 50 06 a4 0c 3c 06 ca ce d6 7f 5a da 12 af 7f 25 98 f2 be 19 2f df ca 72 9f e7 44 8f ff 4b a4 a7 57 e3 97 de de 29 0a e2 ed 93 ee 40 21 b5 42 65 73 c7 af 98 e0 5d f3 be f8 38 01 Data Ascii: ii2BOD$CeuL}noN}}w~lwrPaZ\?&uum&)N$cdPbu\"TqOfN,#q8D'14$qlC0I<,%V"\q(:zxlfl5Y8P<Z%/rDKW)@!Bes]8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.7	49834	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:44 UTC	909	OUT	GET /assets/f5b8aa3411dfc24ff2e6.woff2 HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://discord.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:44 UTC	968	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:44 GMT Content-Type: font/woff2 Content-Length: 137140 Connection: close CF-Ray: 8d782d6d5c6b486b-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "f9bf0f65660d23c6f359d22720fc55ae" Last-Modified: Fri, 06 Jan 2023 01:15:24 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j%2Bvd4db%2FnJKCksUnQfxjBqA4P2wy21wAjR7kq6JYdLd%2FTbNxOzyMaYLuPY17E8B%2FD%2F%2BiDYDVFjxhoHe1BcFjfFi%2ByBAYR84%2FDXlHVVAubpNZo4eIyM3Ue30CgBVX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 02 17 b4 00 0f 00 00 00 06 30 cc 00 02 17 55 00 02 01 cb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 8b 66 1b 84 bd 1a 1c d3 04 06 60 00 95 1a 11 08 0a 8e fc 24 8c 87 55 01 36 02 24 03 f3 54 0b f3 58 00 04 20 05 8b 14 07 82 bd 5b 0c 07 5b 9e 3b b5 0f fe 9b 8c fd 77 db 4e ad 83 0c c8 a5 5a 6a 55 00 00 95 5d 22 de 75 91 12 24 0f 6b b7 d9 3c f8 97 31 d6 db e0 33 40 69 96 9d 1d 36 0e 49 d7 a5 58 99 f1 af 1e c1 c9 d8 40 79 64 66 e7 68 23 cf 0a 15 d7 e7 1b fe ff ff ff ff ff ff ff ff ff ff ff 7b 49 7e 3c 3a f5 dd 49 ba fb 43 5f 0b 90 c4 b2 01 01 06 03 c6 23 f1 ae 5d 37 69 e3 c4 71 5b 08 2b 50 46 8c 55 e2 c4 c0 78 ef 1d 1c 9c a6 10 18 31 2e 18 62 05 ea 33 31 56 61 a8 98 bc c8 61 42 89 ca e4 ae d7 1f a0 6e d8 56 d8 a1 Data Ascii: wOF20Uf`$U6$TX [[;wNZjU]"u$k<13@i6IX@ydfh#{I~<:IC_#]7iq[+PFUx1.b31VaaBnV
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 0a ae a9 ff ff 7a e6 f0 10 2c cb 82 90 84 24 94 e2 c9 37 fc 77 7f 48 b1 77 48 45 6b 57 75 2c 1b 4f ad c5 2a f3 69 cd 4e 5c 42 cc a4 48 c6 4b 06 28 69 a6 23 c5 5d d9 d1 f5 03 f4 93 00 4b 30 28 2f 02 25 b4 1c da ce 0d ac 7b f0 07 33 c9 71 55 4a 02 4e e2 23 07 b0 b9 6f 5f 18 5c 4b 1f 54 db 01 c9 0a f9 4a 4e 4f 28 0b 9c f0 11 c0 88 ff 77 ec 7f 7b 5f 30 6b 74 93 24 9e c5 73 e1 10 0a a4 44 2c 34 26 57 7c bd 00 40 c0 10 ad b3 e3 19 2e c1 40 81 db ee 21 75 72 21 30 36 6d 86 24 f4 f4 cb ff d6 dd 67 ea ef 50 f3 56 19 92 42 62 11 26 65 17 b5 46 a3 24 4e 72 63 60 08 d6 e6 01 4f 3d 1f 1d fc 3f 4f e4 57 f2 3c 91 0f 3c 11 25 20 0a 26 16 0a 58 11 9b 51 18 b3 6a ce 98 b1 28 dd a6 0b dd 78 f8 76 b6 b0 0b 3f 44 71 1c c7 f1 68 3c d8 06 ec 13 7a ab 6b e9 6b 52 01 6a eb 13 b3 Data Ascii: z,$7wHwHEkWu,O*iN\BHK(i#]K0(/%{3qUJN#o_\KTJNO(w{_0kt$sD,4&W\|@.@!ur!06m$gPVBb&eF$Nrc`O=?OW<<% &XQj(xv?Dqh<zkkRj
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: e8 6d ac 55 d2 51 82 82 90 ff fc 19 8d 6c c9 de 6c 2a bb 46 8f 10 e2 99 6b e9 67 78 85 28 58 66 e2 d3 76 bd 63 3b 1f 14 c3 82 d4 f6 fe 1e 39 cd e7 75 8e 30 43 89 1a 3d 35 a1 06 30 c2 ff e3 b2 9f 9e fd 64 86 b6 b4 62 2c 42 9d 77 1f 5d 2a d8 99 49 7e 29 45 82 46 a8 9f d0 42 a9 0e ab e1 79 72 a5 52 ab 0f 06 a9 a7 68 b1 09 09 85 6b e5 f4 fc de 22 72 77 8a 8a 3a 86 0b cd 60 11 0a 2e 0c 0c 2c 0f 7e 27 82 5e 7e 69 47 11 2e 88 2d b6 e0 80 c6 f7 e6 50 3e 2c 16 3e fb a5 62 97 00 4a 5a 41 99 40 70 1a ed 5b 37 dd 77 2d fe a7 9a d9 fe 27 1d 67 c0 9d 95 43 2e 25 57 eb a2 e8 44 90 e0 f3 07 b1 e2 fd 25 a4 f5 5c 95 2a 87 90 e8 84 cb eb bb ce 9d 3b 95 aa dd 85 dc 56 e6 f9 ea 26 7c f3 80 7e ba 94 73 1c 50 33 87 e1 09 de 82 86 da ff a5 6a 35 47 80 10 15 ec 09 d6 f4 06 ef 2d Data Ascii: mUQllFkgx(Xfvc;9u0C=50db,Bw]I~)EFByrRhk"rw:`.,~'^~iG.-P>,>bJZA@p[7w-'gC.%WD%\*;V&\|~sP3j5G-
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 65 07 7f 7f aa f3 10 49 f3 db 6e 67 e7 93 cc 61 17 28 1d 12 af bd 5e 7d bd c3 a6 ea 9b 85 db 01 fa 58 e4 31 ee f3 fd 6a 79 f7 dd f4 ab 9f 05 12 c5 a1 a0 a1 64 95 dd ac f4 e6 33 15 d0 ad 7f 57 c3 14 6e 04 71 b5 b5 7c 42 a1 82 41 9c 9e 87 80 ea 71 dd 45 38 96 39 eb 12 94 d5 28 2e a4 f4 4a 56 c9 1f 23 b9 98 c8 d3 3c 58 fb 52 39 d6 f5 83 59 3e 59 cc d0 4a 3f ad f1 db 3a 66 36 f8 6b 33 2b 5b d9 d8 cb dd 01 1e a6 f3 f2 3e 7f 33 05 9b 93 48 7f 37 96 a4 f1 06 f1 2c 1d e2 e9 7a 95 a1 f7 95 fa 51 6d cc af f6 71 45 5c 85 d7 e9 1d ee 2a be 7a b5 2a ae 41 e9 b8 fa 33 c4 ac 9e 5e 0f 97 62 9b 1d 76 bb bc 0e 82 9c 40 b9 40 72 99 ea 1a dd 0d a6 bb 7c 8f 00 a9 3b 76 fb 5e cf a4 5d b3 b5 47 39 4b a0 85 80 32 bb 47 e3 99 18 2f 25 ec d2 ee 63 f0 52 4c 6e d0 65 4c 63 9f 8d 2b Data Ascii: eInga(^}X1jyd3Wnq\|BAqE89(.JV#<XR9Y>YJ?:f6k3+[>3H7,zQmqE\zA3^bv@@r\|;v^]G9K2G/%cRLneLc+
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 10 8b e0 4b d9 34 f4 37 7f 26 d3 96 f6 f4 cf ab 28 d7 8b d0 0c c7 7d bc ae 68 af c9 ec 37 e5 d4 dd 14 ca e2 5b 36 cd 2e a7 4b 1f ff b6 d1 5c bc f6 65 4f 91 03 51 81 6f e6 21 5d c4 3a 2c 23 e5 13 ca 7f d2 23 27 ab 9f b6 f5 f6 fb d8 68 20 7e 8b 4d ac 8d 7c 6f 7a fc e3 c8 92 e9 e3 97 4a fb 76 11 a5 c5 4e 8b 9b a0 b6 d0 04 0c ab a6 2e b8 54 d3 68 4b 23 a3 a3 89 70 ae 3c e2 60 b2 ca c0 1e 28 e9 ea b0 f0 5b 7d dd d0 cf 60 9a 16 18 71 d5 a5 08 4a 8e 60 9e cc 93 69 1a 73 bd c2 c3 c8 82 ad 96 85 68 b7 83 5a 9d 4a fa 9f d4 a7 37 fe a6 ea e5 d7 d6 be 8a dd 61 0b 46 16 ac 8e 3f 9f 7b 76 ef 77 20 33 cf ee c9 d8 cf 6a c5 19 db b6 8c ac 52 79 1a 20 a2 38 46 4a e0 3d 47 3a fb e2 16 b5 fd fd 14 38 be 59 0d 15 68 83 eb 24 d5 68 35 2f 5d 05 90 9a 4a d0 16 85 2f 79 7e 2b 48 Data Ascii: K47&(}h7[6.K\eOQo!]:,##'h ~M\|ozJvN.ThK#p<`([}`qJ`ishZJ7aF?{vw 3jRy 8FJ=G:8Yh$h5/]J/y~+H
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 7b 06 b4 9a 0c 78 e0 8a 86 41 23 f9 da 0e 8e c5 6a a6 a1 82 ae 90 01 a2 44 92 13 78 56 a1 e4 70 22 15 0d 48 52 44 40 e9 3b ae 29 a6 54 b5 50 4f af fa df 34 08 c3 9a 01 92 96 61 95 75 6d ec 69 73 d0 1e c6 87 55 13 6b 5b bd e6 1b cd 8a b4 ac fc 79 a4 75 02 53 25 66 12 40 5a ca c9 82 de 04 bd 54 62 9a 60 5d 54 10 34 a0 4c 5e 65 c8 5a d0 b4 aa f3 11 ab f5 09 61 08 6b 31 cf a2 d6 c7 bc 61 16 dd 67 90 9b 64 0f d7 d4 04 29 1e f1 0d 9d 22 4c e8 70 95 6b bb c4 39 d0 d5 28 d5 73 1f 11 44 9a f5 a8 0e c8 d7 2c ca ba 26 7d f1 03 cf 99 97 d5 38 a6 ba 8e a0 84 de 75 18 30 b6 10 4b 0e b9 8c 32 16 2d d5 0a ac b2 a6 9d 57 db 3d 8e d2 31 ec 0f da 35 c3 24 6a 51 87 20 cc 28 17 c1 60 10 18 12 04 c9 20 49 92 80 0c 82 20 20 03 33 e2 c0 fb 32 4e 89 85 24 e5 4c e4 6a 94 3c 36 8e Data Ascii: {xA#jDxVp"HRD@;)TPO4aumisUk[yuS%f@ZTb`]T4L^eZak1agd)"Lpk9(sD,&}8u0K2-W=15$jQ (` I 32N$Lj<6
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: 76 52 69 6e 27 75 36 f6 57 ef 83 93 06 c0 7d 8d a0 6b 4d 90 2b cd b0 6b 2d 88 2b ad a8 6b 6d 98 2b ed b8 8b 97 88 2e 5e 26 bb 78 85 ea e2 35 ba 1b 03 0c cf bc c1 74 63 84 e3 64 8c e7 64 42 e0 64 4a e4 84 28 71 b2 61 72 eb 5b 8b 5b bf 61 9f fd 4e bd f3 27 73 df ff 84 fb fe 56 ee fb 07 57 40 80 63 a2 dc a4 fb a8 90 78 a8 45 24 02 58 82 24 40 2d 2f 58 98 7c e0 69 e5 87 08 53 10 2a 4c 21 95 f5 c3 c2 d6 0f 0f 5f 3f 2a 6a 59 34 b4 d2 e8 e8 65 31 30 4a 63 62 96 c5 c2 2a 8d 8d 1d 83 8b 1b 83 8f 1f 43 48 18 43 4c 1c 43 4a 1a 43 4e 5e 90 82 22 5a 3d ca 1c 54 54 d1 52 a9 73 d0 d0 54 a5 a3 ab ca c0 50 95 85 25 a8 16 ac 85 6b c5 5e a0 d6 1c 45 68 c3 59 a0 4e a2 85 ea 2c 56 96 5a b5 85 ea 26 11 51 83 86 8c 92 92 11 64 64 0a d5 47 63 59 b2 b2 b5 c8 c9 45 d4 a4 a9 1c 2d Data Ascii: vRin'u6W}kM+k-+km+.^&x5tcddBdJ(qar[[aN'sVW@cxE$X$@-/X\|iSL!_?jY4e10Jcb*CHCLCJCN^"Z=TTRsTP%k^EhYN,VZ&QddGcYE-
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: cb 1b d6 e6 79 bb f4 4d b9 a3 de 12 3f 89 0a 9f 13 4f 94 f9 39 f5 24 99 9f bb 9f 2c f3 fb d4 bb 89 f6 fe f1 56 68 24 de 03 34 c1 f8 38 40 13 1f 1f 01 34 f9 a6 32 34 85 87 18 9a 12 43 0b 4d 85 e1 84 a6 da 88 42 93 32 b2 d0 d4 1b 5d 68 9a 8c a5 80 69 f5 4a bb de 59 c3 b8 c6 55 dd f8 c7 ff ed ba 5b a6 ad 76 de 9d 89 2f 2b f7 29 23 bf 86 9f ae e9 7f da 49 6f d5 9f e3 73 e6 f9 a8 9d 65 9f db 8d 60 6f b5 20 67 7f 81 ab 28 11 8f f2 e8 86 cc 6b b9 2d 2b 46 17 d5 a7 75 54 79 44 55 07 95 24 7d 3c 38 d8 d2 7f 69 26 49 5b 58 32 d9 0a 72 a3 c8 cb 9a c3 6d 25 b5 f3 06 4d 43 50 9a a0 69 09 ea 03 68 1f d1 5b 4d dc 1a ac 81 12 09 c6 90 13 a6 75 aa ea 36 24 69 98 31 98 4e f0 fc a9 de 66 27 54 42 85 42 9f a8 dd c8 53 41 a5 b4 35 58 19 ed 8a c7 22 02 cd 43 d0 36 a8 aa be 08 Data Ascii: yM?O9$,Vh$48@424CMB2]hiJYU[v/+)#Iose`o g(k-+FuTyDU$}<8i&I[X2rm%MCPih[Mu6$i1Nf'TBBSA5X"C6
2024-10-24 07:15:44 UTC	1369	IN	Data Raw: b7 d7 70 6e b4 99 bf 23 60 fe 8b 7f b2 92 5d 4c 97 8b 2f 19 e5 d2 8c 3b cd d5 99 95 c4 ad 59 77 91 9c d9 76 95 dc 6a b9 dc b7 41 4f f6 78 30 ec 00 c0 31 83 29 40 34 60 2a 30 0c 44 0f 66 48 42 c9 a8 b4 51 3a 83 0c 95 c9 38 93 c4 38 b4 91 9a 75 6e 69 39 96 21 bb b2 a5 20 14 de ab 51 54 44 1d c6 94 d0 24 53 ba d3 4c 4d 23 c2 2d 1d 9b 53 96 4e cd af 44 97 56 55 25 76 5f 3f 30 a0 cd 35 1a d8 8e 9e 19 d2 9e da 0d 6b 7f 3d de 3c b6 61 64 bf 34 6a 9f 3e d0 ae cb 8d 68 df c3 26 f4 69 b1 39 fd da 6c cb 90 bd b3 58 1c 7b 20 10 7a a7 03 15 b2 8b dd ec 61 2f fb d8 1f 0e b4 ae ff 85 e7 c6 b9 bd 99 bd 77 a7 ba 34 5f 95 42 dc e6 0a 77 c3 b5 76 f2 87 1d 27 44 44 58 67 25 fb f6 e4 ad 37 d5 e0 ca 3e be dd 58 d2 7b 7b fe b6 9c e9 16 1b 45 7f df 09 81 ed c3 0a d8 7b 29 e0 b6 Data Ascii: pn#`]L/;YwvjAOx01)@4`*0DfHBQ:88uni9! QTD$SLM#-SNDVU%v_?05k=<ad4j>h&i9lX{ za/w4_Bwv'DDXg%7>X{{E{)
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 0a ec 30 dc fd 49 b7 ce 1e 9d fe e2 bb d4 b7 e4 5a e9 45 ef 0a fb 18 e4 fc 2f ed e6 ed cd 45 c8 85 92 42 6f 6e a4 ae 93 f0 77 69 99 10 39 e0 12 30 45 08 41 4a 09 19 cf 51 18 71 88 d0 c8 10 ad 35 86 a7 15 21 2a 9a 83 b6 d8 e1 5c b4 54 72 2c 58 b7 36 92 22 2d 91 85 7a e4 05 4c 2e 22 bd 43 42 e7 8d 17 92 90 8d 24 85 d2 21 25 c2 89 4a 0a 8b f6 5a aa ad f4 2a 99 23 6e 99 48 05 78 12 da 5a 35 3c 06 2b 52 9e 63 c0 7d 62 f9 38 ec 75 0a 7a 4a 75 09 69 5d ae 44 5a 13 b2 b6 83 5c 2b 02 08 73 95 ea 0c 2c 5b e0 2f a2 44 da 9f 5c f5 04 fa e8 84 20 94 d2 00 e7 b4 b8 09 28 07 b9 6e fa 29 63 13 24 0c 34 6a d9 6f 8a 72 5d a2 0a 5a 63 f0 98 d6 09 f3 4e 6d 1f 94 da 51 ed 89 f6 06 38 13 2f 33 a0 5e 01 da 52 2b 3a 83 63 08 69 78 6c 80 6c 80 53 e7 6c 07 0f 22 43 46 f4 ef 78 a0 Data Ascii: 0IZE/EBonwi90EAJQq5!\Tr,X6"-zL."CB$!%JZ#nHxZ5<+Rc}b8uzJui]DZ\+s,[/D\ (n)c$4jor]ZcNmQ8/3^R+:cixllSl"CFx

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.7	49833	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:44 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:44 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:44 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 082c7638-801e-0067-65f2-24fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071544Z-15b8d89586fqj7k5uht6e8nnew0000000de000000000fenr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:44 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.7	49836	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:44 UTC	1638	OUT	GET /api/v9/experiments?with_guild_experiments=true HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Super-Properties: eyJvcyI6IldpbmRvd3MiLCJicm93c2VyIjoiQ2hyb21lIiwiZGV2aWNlIjoiIiwic3lzdGVtX2xvY2FsZSI6ImVuLVVTIiwiYnJvd3Nlcl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2IiwiYnJvd3Nlcl92ZXJzaW9uIjoiMTE3LjAuMC4wIiwib3NfdmVyc2lvbiI6IjEwIiwicmVmZXJyZXIiOiIiLCJyZWZlcnJpbmdfZG9tYWluIjoiIiwicmVmZXJyZXJfY3VycmVudCI6IiIsInJlZmVycmluZ19kb21haW5fY3VycmVudCI6IiIsInJlbGVhc2VfY2hhbm5lbCI6InN0YWJsZSIsImNsaWVudF9idWlsZF9udW1iZXIiOjMzODU0MCwiY2xpZW50X2V2ZW50X3NvdXJjZSI6bnVsbH0= X-Context-Properties: eyJsb2NhdGlvbiI6IkFjY2VwdCBJbnZpdGUgUGFnZSJ9 X-Debug-Options: bugReporterEnabled sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Discord-Timezone: America/New_York X-Discord-Locale: en-US sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:45 UTC	782	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:45 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=31536000; includeSubDomains; preload vary: Accept-Encoding via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: BYPASS Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T4VsCG%2BOkw4c6MiQcGO69mBVX%2FLXxkGdTXfIX3Gg%2F%2FNpOV7ooGz%2B2u6i%2Bptwv6ALvldotRN2mS5x2VKtqzIMQYGoKw9QaTz2gb3WK%2BH%2FOU%2FNWpGb6Gn9fLyJsZ5H"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Server: cloudflare CF-RAY: 8d782d6e1d52476d-DFW
2024-10-24 07:15:45 UTC	587	IN	Data Raw: 37 63 39 35 0d 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 31 32 39 38 39 30 37 37 37 30 35 34 33 36 36 39 32 36 39 2e 33 6d 4b 49 74 5f 62 33 65 36 63 6a 4e 4c 61 39 38 67 41 6d 62 74 52 32 6c 76 55 22 2c 22 61 73 73 69 67 6e 6d 65 6e 74 73 22 3a 5b 5b 32 38 31 30 32 30 35 34 38 37 2c 31 2c 31 2c 2d 31 2c 33 2c 33 38 31 37 2c 30 2c 30 5d 2c 5b 32 36 31 37 32 31 38 34 34 34 2c 34 2c 31 2c 2d 31 2c 32 2c 38 34 34 37 2c 30 2c 30 5d 2c 5b 33 30 33 35 36 37 34 37 36 37 2c 30 2c 31 2c 2d 31 2c 30 2c 31 39 35 39 2c 30 2c 30 5d 2c 5b 31 36 30 39 37 38 32 31 35 31 2c 30 2c 31 2c 2d 31 2c 32 2c 36 36 38 31 2c 30 2c 30 5d 2c 5b 33 36 34 33 33 36 32 37 35 31 2c 30 2c 31 2c 2d 31 2c 30 2c 34 36 35 37 2c 30 2c 30 5d 2c 5b 33 37 35 33 30 33 34 34 36 36 2c 31 2c Data Ascii: 7c95{"fingerprint":"1298907770543669269.3mKIt_b3e6cjNLa98gAmbtR2lvU","assignments":[[2810205487,1,1,-1,3,3817,0,0],[2617218444,4,1,-1,2,8447,0,0],[3035674767,0,1,-1,0,1959,0,0],[1609782151,0,1,-1,2,6681,0,0],[3643362751,0,1,-1,0,4657,0,0],[3753034466,1,
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 30 30 35 33 33 2c 30 2c 31 2c 2d 31 2c 30 2c 33 33 39 31 2c 30 2c 30 5d 2c 5b 33 35 35 37 34 38 30 37 31 32 2c 30 2c 31 2c 2d 31 2c 30 2c 37 33 32 37 2c 30 2c 30 5d 2c 5b 38 35 33 34 30 33 31 33 33 2c 34 2c 31 2c 2d 31 2c 30 2c 35 33 31 39 2c 30 2c 30 5d 2c 5b 32 34 39 31 30 30 35 30 31 39 2c 34 2c 31 2c 2d 31 2c 30 2c 32 39 37 2c 30 2c 30 5d 2c 5b 33 38 38 39 30 37 37 38 30 34 2c 32 2c 31 2c 2d 31 2c 30 2c 38 33 31 39 2c 30 2c 30 5d 2c 5b 34 30 37 39 32 31 34 33 31 39 2c 32 2c 31 2c 2d 31 2c 30 2c 39 38 30 39 2c 30 2c 30 5d 2c 5b 31 35 33 32 32 38 30 35 34 38 2c 31 36 2c 31 2c 2d 31 2c 35 2c 33 38 37 36 2c 30 2c 30 5d 2c 5b 31 30 39 35 37 37 39 31 35 34 2c 30 2c 31 2c 2d 31 2c 34 2c 31 39 39 31 2c 30 2c 30 5d 2c 5b 31 33 39 38 30 30 37 38 33 39 2c 30 2c Data Ascii: 00533,0,1,-1,0,3391,0,0],[3557480712,0,1,-1,0,7327,0,0],[853403133,4,1,-1,0,5319,0,0],[2491005019,4,1,-1,0,297,0,0],[3889077804,2,1,-1,0,8319,0,0],[4079214319,2,1,-1,0,9809,0,0],[1532280548,16,1,-1,5,3876,0,0],[1095779154,0,1,-1,4,1991,0,0],[1398007839,0,
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 5d 2c 5b 36 37 31 36 36 35 36 35 31 2c 30 2c 31 2c 2d 31 2c 31 2c 32 33 32 2c 30 2c 30 5d 2c 5b 33 37 33 35 33 31 31 35 36 2c 30 2c 33 2c 2d 31 2c 30 2c 36 38 37 39 2c 30 2c 30 5d 2c 5b 32 34 32 39 32 31 36 30 35 39 2c 30 2c 31 2c 2d 31 2c 30 2c 36 34 34 32 2c 30 2c 30 5d 2c 5b 31 36 31 37 37 34 39 37 34 33 2c 30 2c 31 2c 2d 31 2c 30 2c 32 32 32 34 2c 30 2c 30 5d 2c 5b 32 39 33 37 33 32 39 39 31 30 2c 31 2c 31 2c 2d 31 2c 32 2c 39 32 34 35 2c 30 2c 30 5d 2c 5b 32 38 38 39 36 38 37 30 36 2c 30 2c 31 2c 2d 31 2c 33 2c 38 39 33 33 2c 30 2c 30 5d 2c 5b 31 30 34 35 37 33 30 32 30 33 2c 33 2c 31 2c 2d 31 2c 31 2c 36 37 39 36 2c 30 2c 30 5d 2c 5b 33 35 32 32 33 37 38 37 31 36 2c 30 2c 31 2c 2d 31 2c 31 2c 36 38 31 31 2c 30 2c 30 5d 2c 5b 32 30 39 31 32 30 32 35 Data Ascii: ],[671665651,0,1,-1,1,232,0,0],[373531156,0,3,-1,0,6879,0,0],[2429216059,0,1,-1,0,6442,0,0],[1617749743,0,1,-1,0,2224,0,0],[2937329910,1,1,-1,2,9245,0,0],[288968706,0,1,-1,3,8933,0,0],[1045730203,3,1,-1,1,6796,0,0],[3522378716,0,1,-1,1,6811,0,0],[20912025
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 2c 32 2c 35 30 33 34 2c 30 2c 30 5d 2c 5b 33 39 35 30 38 34 37 35 33 37 2c 33 2c 31 2c 2d 31 2c 30 2c 36 38 32 31 2c 30 2c 30 5d 2c 5b 33 39 32 37 31 34 35 37 39 37 2c 30 2c 31 2c 2d 31 2c 33 2c 34 32 2c 30 2c 30 5d 2c 5b 32 32 34 30 30 39 38 30 32 35 2c 30 2c 31 2c 2d 31 2c 30 2c 39 36 37 35 2c 30 2c 31 5d 2c 5b 38 32 32 36 37 36 31 33 34 2c 32 2c 31 2c 2d 31 2c 30 2c 37 30 39 37 2c 30 2c 30 5d 2c 5b 31 38 39 34 32 38 38 31 31 33 2c 30 2c 32 2c 2d 31 2c 34 2c 34 37 36 33 2c 30 2c 30 5d 2c 5b 32 35 33 38 35 39 31 30 37 37 2c 30 2c 31 2c 2d 31 2c 36 2c 33 30 31 33 2c 30 2c 30 5d 2c 5b 32 30 35 33 31 36 32 38 32 31 2c 30 2c 31 2c 2d 31 2c 31 2c 32 34 38 39 2c 30 2c 30 5d 2c 5b 32 38 31 36 35 37 37 36 32 36 2c 30 2c 31 2c 2d 31 2c 32 2c 33 32 38 38 2c 30 2c Data Ascii: ,2,5034,0,0],[3950847537,3,1,-1,0,6821,0,0],[3927145797,0,1,-1,3,42,0,0],[2240098025,0,1,-1,0,9675,0,1],[822676134,2,1,-1,0,7097,0,0],[1894288113,0,2,-1,4,4763,0,0],[2538591077,0,1,-1,6,3013,0,0],[2053162821,0,1,-1,1,2489,0,0],[2816577626,0,1,-1,2,3288,0,
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 39 39 2c 34 2c 37 2c 2d 31 2c 30 2c 34 32 38 30 2c 30 2c 31 5d 2c 5b 33 37 37 35 35 39 34 37 33 31 2c 33 2c 31 2c 2d 31 2c 30 2c 39 30 36 35 2c 30 2c 30 5d 2c 5b 32 32 31 30 37 30 38 30 30 37 2c 32 2c 31 2c 2d 31 2c 30 2c 31 34 39 35 2c 30 2c 31 5d 2c 5b 32 34 39 31 39 34 33 34 34 37 2c 30 2c 31 2c 2d 31 2c 30 2c 31 36 39 39 2c 30 2c 31 5d 2c 5b 36 37 33 36 35 37 38 37 32 2c 30 2c 31 2c 2d 31 2c 32 2c 36 34 38 33 2c 30 2c 30 5d 2c 5b 33 38 37 32 37 35 37 39 38 2c 32 2c 32 2c 2d 31 2c 30 2c 31 31 38 30 2c 30 2c 31 5d 2c 5b 32 39 37 39 39 32 36 32 34 30 2c 30 2c 31 2c 2d 31 2c 30 2c 33 30 38 2c 30 2c 30 5d 2c 5b 34 34 30 39 38 30 34 37 38 2c 34 2c 33 2c 2d 31 2c 30 2c 31 37 32 35 2c 30 2c 31 5d 2c 5b 33 32 39 39 32 35 34 38 34 36 2c 33 2c 32 2c 2d 31 2c 30 Data Ascii: 99,4,7,-1,0,4280,0,1],[3775594731,3,1,-1,0,9065,0,0],[2210708007,2,1,-1,0,1495,0,1],[2491943447,0,1,-1,0,1699,0,1],[673657872,0,1,-1,2,6483,0,0],[387275798,2,2,-1,0,1180,0,1],[2979926240,0,1,-1,0,308,0,0],[440980478,4,3,-1,0,1725,0,1],[3299254846,3,2,-1,0
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 30 31 34 37 34 39 2c 34 2c 31 2c 2d 31 2c 30 2c 33 35 34 38 2c 30 2c 31 5d 2c 5b 37 35 38 34 31 33 37 37 32 2c 30 2c 31 2c 2d 31 2c 30 2c 33 34 32 32 2c 30 2c 30 5d 2c 5b 32 39 31 36 39 37 32 32 33 33 2c 34 2c 31 2c 2d 31 2c 30 2c 31 36 34 2c 30 2c 31 5d 2c 5b 34 32 38 37 32 38 38 37 37 30 2c 31 2c 31 2c 2d 31 2c 30 2c 37 31 35 35 2c 31 2c 31 5d 2c 5b 32 31 38 36 30 35 34 31 33 33 2c 31 2c 30 2c 2d 31 2c 30 2c 32 37 36 35 2c 31 2c 31 5d 2c 5b 32 38 38 32 36 35 36 39 30 36 2c 32 2c 30 2c 2d 31 2c 30 2c 34 31 32 32 2c 31 2c 31 5d 2c 5b 35 32 39 33 30 36 32 34 30 2c 31 2c 30 2c 2d 31 2c 30 2c 35 38 32 2c 31 2c 31 5d 2c 5b 33 30 39 36 33 39 38 31 34 37 2c 31 2c 34 2c 2d 31 2c 30 2c 31 39 35 38 2c 31 2c 31 5d 2c 5b 33 37 39 39 34 31 38 34 36 2c 32 2c 31 2c 2d Data Ascii: 014749,4,1,-1,0,3548,0,1],[758413772,0,1,-1,0,3422,0,0],[2916972233,4,1,-1,0,164,0,1],[4287288770,1,1,-1,0,7155,1,1],[2186054133,1,0,-1,0,2765,1,1],[2882656906,2,0,-1,0,4122,1,1],[529306240,1,0,-1,0,582,1,1],[3096398147,1,4,-1,0,1958,1,1],[379941846,2,1,-
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 2c 31 5d 2c 5b 36 39 32 35 36 34 37 39 39 2c 30 2c 31 2c 2d 31 2c 31 2c 36 37 35 36 2c 30 2c 30 5d 2c 5b 33 39 30 37 39 34 31 32 34 37 2c 31 2c 31 2c 2d 31 2c 30 2c 33 31 31 32 2c 30 2c 31 5d 2c 5b 32 30 31 32 30 36 38 37 35 32 2c 30 2c 31 2c 2d 31 2c 30 2c 35 31 32 31 2c 30 2c 30 5d 2c 5b 34 30 32 34 30 37 39 33 39 37 2c 30 2c 31 2c 2d 31 2c 30 2c 34 31 31 37 2c 30 2c 31 5d 2c 5b 32 37 31 37 36 34 37 39 30 37 2c 33 2c 30 2c 2d 31 2c 30 2c 32 32 34 2c 30 2c 31 5d 2c 5b 32 32 38 33 30 36 31 33 37 32 2c 32 2c 30 2c 2d 31 2c 30 2c 35 38 36 37 2c 30 2c 30 5d 2c 5b 31 33 36 32 36 32 36 33 35 33 2c 33 2c 30 2c 2d 31 2c 30 2c 33 32 31 36 2c 30 2c 31 5d 2c 5b 33 38 38 36 38 30 31 34 36 33 2c 31 2c 30 2c 2d 31 2c 30 2c 34 30 36 2c 30 2c 31 5d 2c 5b 32 37 35 30 34 Data Ascii: ,1],[692564799,0,1,-1,1,6756,0,0],[3907941247,1,1,-1,0,3112,0,1],[2012068752,0,1,-1,0,5121,0,0],[4024079397,0,1,-1,0,4117,0,1],[2717647907,3,0,-1,0,224,0,1],[2283061372,2,0,-1,0,5867,0,0],[1362626353,3,0,-1,0,3216,0,1],[3886801463,1,0,-1,0,406,0,1],[27504
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 22 2c 22 38 34 30 32 39 36 36 30 37 37 38 35 32 38 37 37 36 33 22 2c 22 36 35 31 35 39 37 35 31 34 34 30 37 30 31 38 35 31 36 22 5d 5d 5d 5d 5d 5d 5d 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 30 5d 2c 5b 34 32 30 30 35 39 35 30 36 37 2c 22 32 30 32 32 2d 30 31 5f 67 75 69 6c 64 5f 72 6f 6c 65 5f 73 75 62 73 63 72 69 70 74 69 6f 6e 5f 74 72 69 61 6c 73 22 2c 30 2c 5b 5b 5b 5b 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5b 32 32 39 34 38 38 38 39 34 33 2c 5b 5b 32 36 39 30 37 35 32 31 35 36 2c 37 37 30 31 33 39 33 30 31 5d 2c 5b 31 39 38 32 38 30 34 31 32 31 2c 31 30 30 30 30 5d 5d 5d 5d 5d 2c 5b 5b 5b 2d 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5d 5d 5d 2c 5b 5d 2c 5b 5b 5b 5b 5b 31 2c 5b 7b Data Ascii: ","840296607785287763","651597514407018516"]]]]]]]],null,null,0,0],[4200595067,"2022-01_guild_role_subscription_trials",0,[[[[1,[{"s":0,"e":10000}]]],[[2294888943,[[2690752156,770139301],[1982804121,10000]]]]],[[[-1,[{"s":0,"e":10000}]]],[]]],[],[[[[[1,[{
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 30 30 7d 5d 5d 5d 2c 5b 5d 5d 5d 2c 5b 5d 2c 5b 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 30 5d 2c 5b 31 39 39 30 36 37 32 30 30 39 2c 6e 75 6c 6c 2c 30 2c 5b 5b 5b 5b 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5d 5d 5d 2c 5b 7b 22 62 22 3a 31 2c 22 6b 22 3a 5b 22 39 30 38 31 31 34 33 39 32 32 36 33 30 34 39 32 37 37 22 5d 7d 5d 2c 5b 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 30 5d 2c 5b 31 37 39 37 31 31 36 33 38 2c 6e 75 6c 6c 2c 30 2c 5b 5b 5b 5b 2d 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5d 5d 5d 2c 5b 7b 22 62 22 3a 36 2c 22 6b 22 3a 5b 22 39 30 38 31 31 34 33 39 32 32 36 33 30 34 39 32 37 37 22 2c 22 34 34 33 35 38 34 38 37 37 38 32 39 35 35 34 31 37 37 22 2c 22 32 32 33 30 37 30 34 Data Ascii: 00}]]],[]]],[],[],null,null,0,0],[1990672009,null,0,[[[[1,[{"s":0,"e":10000}]]],[]]],[{"b":1,"k":["908114392263049277"]}],[],null,null,0,0],[179711638,null,0,[[[[-1,[{"s":0,"e":10000}]]],[]]],[{"b":6,"k":["908114392263049277","443584877829554177","2230704
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 75 6c 6c 2c 30 2c 30 5d 2c 5b 31 38 30 34 31 32 32 38 32 37 2c 22 32 30 32 32 2d 30 39 5f 67 75 69 6c 64 5f 6f 6e 62 6f 61 72 64 69 6e 67 5f 61 64 6d 69 6e 5f 6f 6e 6c 79 5f 6f 6c 64 22 2c 30 2c 5b 5b 5b 5b 2d 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5d 5d 5d 2c 5b 5d 2c 5b 5b 5b 5b 5b 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5b 31 36 30 34 36 31 32 30 34 35 2c 5b 5b 31 31 38 33 32 35 31 32 34 38 2c 5b 22 47 55 49 4c 44 5f 4f 4e 42 4f 41 52 44 49 4e 47 5f 41 44 4d 49 4e 5f 4f 4e 4c 59 22 5d 5d 5d 5d 5d 5d 5d 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 30 5d 2c 5b 32 34 35 37 39 30 33 31 30 37 2c 6e 75 6c 6c 2c 32 2c 5b 5b 5b 5b 2d 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 32 30 30 30 7d 2c Data Ascii: ull,0,0],[1804122827,"2022-09_guild_onboarding_admin_only_old",0,[[[[-1,[{"s":0,"e":10000}]]],[]]],[],[[[[[1,[{"s":0,"e":10000}]]],[[1604612045,[[1183251248,["GUILD_ONBOARDING_ADMIN_ONLY"]]]]]]]],null,null,0,0],[2457903107,null,2,[[[[-1,[{"s":0,"e":2000},

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.7	49835	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:44 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:45 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:44 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 4faef820-a01e-0053-6a4e-228603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071544Z-16849878b786vsxz21496wc2qn00000007g0000000005hpa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:45 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.7	49840	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:45 UTC	872	OUT	GET /assets/ac625b77a0bab0ee72df.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:45 UTC	976	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:45 GMT Content-Type: application/javascript Content-Length: 3530 Connection: close CF-Ray: 8d782d6edbe72cbb-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "be6064ff8c1d480afb80fe48762a06c1" Last-Modified: Fri, 28 Jun 2024 00:43:11 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lzpq1ob%2FUZ4f9o%2FwZNIW6YUp%2FhtjihKxKP3BdpgQ1kaHx5J1hnuaa04zBWE%2F1J%2B5tIq%2BK5BMkJ2NAtlCtJOlv6AlDRFy7GhbryMG44DyxN166ftNxZXaW4E%2FE9es"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:45 UTC	393	IN	Data Raw: 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 7b 35 30 34 30 35 33 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 65 29 7b 65 2e 64 28 74 2c 7b 46 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 65 28 35 31 38 32 36 33 29 2c 65 28 39 37 30 31 37 33 29 2c 65 28 35 32 30 37 31 32 29 2c 65 28 32 36 38 31 31 31 29 2c 65 28 39 34 31 34 39 37 29 2c 65 28 33 32 30 32 36 29 2c 65 28 34 38 30 38 33 39 29 2c 65 28 37 34 34 32 38 35 29 2c 65 28 34 39 32 32 35 37 29 2c 65 28 38 37 33 38 31 37 29 2c 65 28 38 36 33 39 34 32 29 2c 65 28 36 34 32 35 34 39 29 2c 65 28 36 35 33 30 34 31 29 3b 76 61 72 20 6e 3d 65 28 37 38 38 39 30 30 29 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 72 29 7b 6c 65 74 20 74 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: (()=>{"use strict";var r={504053:function(r,t,e){e.d(t,{F:function(){return o}}),e(518263),e(970173),e(520712),e(268111),e(941497),e(32026),e(480839),e(744285),e(492257),e(873817),e(863942),e(642549),e(653041);var n=e(788900);function o(r){let t=function(
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 72 5b 32 5d 3c 3c 31 36 2c 6c 3d 72 5b 33 5d 7c 72 5b 34 5d 3c 3c 38 2c 73 3d 28 36 33 26 63 29 2f 36 33 2c 70 3d 28 63 3e 3e 36 26 36 33 29 2f 33 31 2e 35 2d 31 2c 64 3d 28 63 3e 3e 31 32 26 36 33 29 2f 33 31 2e 35 2d 31 2c 76 3d 63 3e 3e 32 33 2c 68 3d 6c 3e 3e 31 35 2c 62 3d 69 28 33 2c 68 3f 76 3f 35 3a 37 3a 37 26 6c 29 2c 67 3d 69 28 33 2c 68 3f 37 26 6c 3a 76 3f 35 3a 37 29 2c 79 3d 76 3f 28 31 35 26 72 5b 35 5d 29 2f 31 35 3a 31 2c 4f 3d 28 72 5b 35 5d 3e 3e 34 29 2f 31 35 2c 6d 3d 76 3f 36 3a 35 2c 77 3d 30 2c 78 3d 28 74 2c 65 2c 6e 29 3d 3e 7b 6c 65 74 20 6f 3d 5b 5d 3b 66 6f 72 28 6c 65 74 20 66 3d 30 3b 66 3c 65 3b 66 2b 2b 29 66 6f 72 28 6c 65 74 20 69 3d 66 3f 30 3a 31 3b 69 2a 65 3c 74 2a 28 65 2d 66 29 3b 69 2b 2b 29 6f 2e 70 75 73 68 28 Data Ascii: r[2]<<16,l=r[3]\|r[4]<<8,s=(63&c)/63,p=(c>>6&63)/31.5-1,d=(c>>12&63)/31.5-1,v=c>>23,h=l>>15,b=i(3,h?v?5:7:7&l),g=i(3,h?7&l:v?5:7),y=v?(15&r[5])/15:1,O=(r[5]>>4)/15,m=v?6:5,w=0,x=(t,e,n)=>{let o=[];for(let f=0;f<e;f++)for(let i=f?0:1;ie<t(e-f);i++)o.push(
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 28 6e 29 7b 76 61 72 20 6f 3d 74 5b 6e 5d 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 6f 29 72 65 74 75 72 6e 20 6f 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 66 3d 74 5b 6e 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 72 5b 6e 5d 2e 63 61 6c 6c 28 66 2e 65 78 70 6f 72 74 73 2c 66 2c 66 2e 65 78 70 6f 72 74 73 2c 65 29 2c 66 2e 65 78 70 6f 72 74 73 7d 65 2e 6d 3d 72 2c 65 2e 78 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 65 2e 4f 28 76 6f 69 64 20 30 2c 5b 22 37 38 31 38 37 22 2c 22 37 31 39 38 34 22 2c 22 34 33 32 32 32 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 28 22 31 37 31 37 31 36 22 29 7d 29 3b 72 65 74 75 72 6e 20 72 3d 65 2e 4f 28 72 29 7d 2c 65 2e 6e 3d 66 75 6e 63 74 69 6f 6e 28 72 29 7b 76 61 72 20 Data Ascii: (n){var o=t[n];if(void 0!==o)return o.exports;var f=t[n]={exports:{}};return r[n].call(f.exports,f,f.exports,e),f.exports}e.m=r,e.x=function(){var r=e.O(void 0,["78187","71984","43222"],function(){return e("171716")});return r=e.O(r)},e.n=function(r){var
2024-10-24 07:15:45 UTC	399	IN	Data Raw: 5b 22 37 38 31 38 37 22 2c 22 37 31 39 38 34 22 2c 22 34 33 32 32 32 22 5d 2e 6d 61 70 28 65 2e 65 2c 65 29 29 2e 74 68 65 6e 28 72 29 7d 7d 29 28 29 2c 28 28 29 3d 3e 7b 76 61 72 20 72 3d 7b 37 37 34 35 39 3a 31 7d 3b 65 2e 66 2e 69 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 21 72 5b 74 5d 26 26 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 65 2e 70 2b 65 2e 75 28 74 29 29 7d 3b 76 61 72 20 74 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 2c 6e 3d 74 2e 70 75 73 68 2e 62 69 6e 64 28 74 29 3b 74 2e 70 75 73 68 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6f 3d 74 5b 30 5d 2c 66 3d 74 5b 31 5d 2c 69 3d 74 5b 32 5d Data Ascii: ["78187","71984","43222"].map(e.e,e)).then(r)}})(),(()=>{var r={77459:1};e.f.i=function(t,n){!r[t]&&importScripts(e.p+e.u(t))};var t=this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[],n=t.push.bind(t);t.push=function(t){var o=t[0],f=t[1],i=t[2]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.7	49841	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:45 UTC	872	OUT	GET /assets/29a63f12209c956d9204.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:45 UTC	966	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:45 GMT Content-Type: application/javascript Content-Length: 2750 Connection: close CF-Ray: 8d782d6eea286c7f-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "390a7ab1f964aa8cb1b87dd13732c3bc" Last-Modified: Tue, 30 Jul 2024 22:07:30 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WyySz0R4eSqQlUQFKM0OzGs1ytFXwzD0wYbspkKkMOIu2NQha8CJYY3ybSubnExzTO%2B8JMGEppjq%2FGhF5qpKO9UMTsDzw8Agt8Ubpnuh4MtuP7twhRtfh7sJqm3M"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:45 UTC	403	IN	Data Raw: 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 7b 31 33 37 39 32 30 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 2c 69 3b 6e 2e 64 28 72 2c 7b 4a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 7d 2c 7a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 7d 7d 29 2c 28 69 3d 65 7c 7c 28 65 3d 7b 7d 29 29 5b 69 2e 4e 4f 4e 45 3d 30 5d 3d 22 4e 4f 4e 45 22 2c 69 5b 69 2e 53 4f 43 49 41 4c 3d 31 5d 3d 22 53 4f 43 49 41 4c 22 2c 69 5b 69 2e 43 41 53 55 41 4c 3d 32 5d 3d 22 43 41 53 55 41 4c 22 2c 69 5b 69 2e 43 4f 4d 50 45 54 49 54 49 56 45 3d 33 5d 3d 22 43 4f 4d 50 45 54 49 54 49 56 45 22 2c 69 5b 69 2e 43 52 45 41 54 49 56 45 3d 34 5d 3d 22 43 52 45 41 54 49 56 45 22 2c 69 5b 69 2e 56 45 Data Ascii: (()=>{"use strict";var t={137920:function(t,r,n){var e,i;n.d(r,{J:function(){return u},z:function(){return e}}),(i=e\|\|(e={}))[i.NONE=0]="NONE",i[i.SOCIAL=1]="SOCIAL",i[i.CASUAL=2]="CASUAL",i[i.COMPETITIVE=3]="COMPETITIVE",i[i.CREATIVE=4]="CREATIVE",i[i.VE
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 3b 76 61 72 20 65 3d 6e 28 31 33 37 39 32 30 29 3b 66 75 6e 63 74 69 6f 6e 20 69 28 74 2c 72 29 7b 6c 65 74 20 6e 3d 30 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 72 2e 67 61 6d 65 73 26 26 28 6e 2b 3d 32 2a 72 2e 67 61 6d 65 73 2e 66 69 6c 74 65 72 28 72 3d 3e 74 2e 67 61 6d 65 73 2e 69 6e 63 6c 75 64 65 73 28 72 29 29 2e 6c 65 6e 67 74 68 29 2c 6e 75 6c 6c 21 3d 72 2e 70 6c 61 79 73 74 79 6c 65 26 26 28 72 2e 70 6c 61 79 73 74 79 6c 65 3d 3d 3d 74 2e 70 6c 61 79 73 74 79 6c 65 3f 6e 2b 3d 32 3a 65 2e 4a 5b 74 2e 70 6c 61 79 73 74 79 6c 65 5d 3d 3d 3d 65 2e 4a 5b 72 2e 70 6c 61 79 73 74 79 6c 65 5d 26 26 28 6e 2b 3d 31 29 29 2c 6e 75 6c 6c 21 3d 72 2e 74 72 61 69 74 73 26 26 28 6e 2b 3d 32 2a 41 72 72 Data Ascii: tion(){return i}});var e=n(137920);function i(t,r){let n=0;return null!=r.games&&(n+=2r.games.filter(r=>t.games.includes(r)).length),null!=r.playstyle&&(r.playstyle===t.playstyle?n+=2:e.J[t.playstyle]===e.J[r.playstyle]&&(n+=1)),null!=r.traits&&(n+=2Arr
2024-10-24 07:15:45 UTC	978	IN	Data Raw: 79 7b 72 65 74 75 72 6e 20 74 68 69 73 7c 7c 46 75 6e 63 74 69 6f 6e 28 22 72 65 74 75 72 6e 20 74 68 69 73 22 29 28 29 7d 63 61 74 63 68 28 74 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 29 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 7d 7d 28 29 2c 6e 2e 6f 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 72 29 7d 2c 28 28 29 3d 3e 7b 76 61 72 20 74 3d 5b 5d 3b 6e 2e 4f 3d 66 75 6e 63 74 69 6f 6e 28 72 2c 65 2c 69 2c 75 29 7b 69 66 28 65 29 7b 75 3d 75 7c 7c 30 3b 66 6f 72 28 76 61 72 20 6f 3d 74 2e 6c 65 6e 67 74 68 3b 6f 3e 30 26 26 74 5b 6f 2d 31 5d 5b 32 5d 3e 75 3b 6f 2d 2d 29 74 5b Data Ascii: y{return this\|\|Function("return this")()}catch(t){if("object"==typeof window)return window}}(),n.o=function(t,r){return Object.prototype.hasOwnProperty.call(t,r)},(()=>{var t=[];n.O=function(r,e,i,u){if(e){u=u\|\|0;for(var o=t.length;o>0&&t[o-1][2]>u;o--)t[

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.7	49839	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:45 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:45 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:45 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 62859660-b01e-003d-3dfb-24d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071545Z-15b8d89586fzhrwgk23ex2bvhw00000001e0000000005xez x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:45 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.7	49837	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:45 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:45 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:45 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 333c19fd-801e-00ac-16e3-21fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071545Z-16849878b787c9z7hb8u9yysp000000007ag00000000m01s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:45 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.7	49838	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:45 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:45 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:45 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 9791ae07-d01e-0066-7bf2-24ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071545Z-r197bdfb6b4ld6jc5asqwvvz0w000000017000000000fcdb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:15:45 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.7	49842	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:45 UTC	868	OUT	GET /assets/55ad931ed92a15c15709.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:45 UTC	963	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:45 GMT Content-Type: text/javascript Content-Length: 109613 Connection: close CF-Ray: 8d782d6fdb517d5a-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "80f500d4d0495e5c74e9b92cbc26f088" Last-Modified: Tue, 15 Oct 2024 21:49:59 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hsPyYdDBkNs2mj4YBd8IYE7J8cSWQ1bJkpYjYeA1SsWxxr8r4r30358T%2BOGZSl%2FODmmAIPXlTaGBapw50ZGlZ2wGmIZg%2BwG595fOSa1YSIQ3YHeHZrxENMhBt3nm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:45 UTC	406	IN	Data Raw: 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 36 33 32 38 38 22 5d 2c 7b 34 37 33 34 35 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 3d 65 2e 6c 65 6e 67 74 68 2c 6f 3d 6e 5e 6e 2c 72 3d 30 3b 6e 3e 3d 34 3b 29 74 3d 28 36 35 35 33 35 26 28 74 3d 32 35 35 26 65 2e 63 68 61 72 43 6f 64 65 41 74 28 72 29 7c 28 32 35 35 26 65 2e 63 68 61 72 43 6f 64 65 41 74 28 2b 2b 72 29 29 3c 3c 38 7c 28 32 35 35 26 65 2e 63 68 61 72 43 6f 64 65 41 74 28 2b 2b 72 29 29 3c 3c 31 36 7c Data Ascii: (this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["63288"],{473452:function(e,t){"use strict";t.Z=function(e){for(var t,n=e.length,o=n^n,r=0;n>=4;)t=(65535&(t=255&e.charCodeAt(r)\|(255&e.charCodeAt(++r))<<8\|(255&e.charCodeAt(++r))<<16\|
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 26 74 29 2a 31 35 34 30 34 38 33 34 37 37 2b 28 28 28 74 3e 3e 3e 31 36 29 2a 31 35 34 30 34 38 33 34 37 37 26 36 35 35 33 35 29 3c 3c 31 36 29 29 2c 6e 2d 3d 34 2c 2b 2b 72 3b 73 77 69 74 63 68 28 6e 29 7b 63 61 73 65 20 33 3a 6f 5e 3d 28 32 35 35 26 65 2e 63 68 61 72 43 6f 64 65 41 74 28 72 2b 32 29 29 3c 3c 31 36 3b 63 61 73 65 20 32 3a 6f 5e 3d 28 32 35 35 26 65 2e 63 68 61 72 43 6f 64 65 41 74 28 72 2b 31 29 29 3c 3c 38 3b 63 61 73 65 20 31 3a 6f 5e 3d 32 35 35 26 65 2e 63 68 61 72 43 6f 64 65 41 74 28 72 29 2c 6f 3d 28 36 35 35 33 35 26 6f 29 2a 31 35 34 30 34 38 33 34 37 37 2b 28 28 28 6f 3e 3e 3e 31 36 29 2a 31 35 34 30 34 38 33 34 37 37 26 36 35 35 33 35 29 3c 3c 31 36 29 7d 72 65 74 75 72 6e 20 6f 5e 3d 6f 3e 3e 3e 31 33 2c 6f 3d 28 36 35 35 33 Data Ascii: &t)1540483477+(((t>>>16)1540483477&65535)<<16)),n-=4,++r;switch(n){case 3:o^=(255&e.charCodeAt(r+2))<<16;case 2:o^=(255&e.charCodeAt(r+1))<<8;case 1:o^=255&e.charCodeAt(r),o=(65535&o)1540483477+(((o>>>16)1540483477&65535)<<16)}return o^=o>>>13,o=(6553
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 75 72 6e 20 31 31 36 3d 3d 3d 61 2e 63 68 61 72 43 6f 64 65 41 74 28 33 29 3f 22 2d 77 65 62 6b 69 74 2d 22 2b 61 2b 61 3a 61 3b 63 61 73 65 20 39 36 33 3a 72 65 74 75 72 6e 20 31 31 30 3d 3d 3d 61 2e 63 68 61 72 43 6f 64 65 41 74 28 35 29 3f 22 2d 77 65 62 6b 69 74 2d 22 2b 61 2b 61 3a 61 3b 63 61 73 65 20 31 30 30 39 3a 69 66 28 31 30 30 21 3d 3d 61 2e 63 68 61 72 43 6f 64 65 41 74 28 34 29 29 62 72 65 61 6b 3b 63 61 73 65 20 39 36 39 3a 63 61 73 65 20 39 34 32 3a 72 65 74 75 72 6e 22 2d 77 65 62 6b 69 74 2d 22 2b 61 2b 61 3b 63 61 73 65 20 39 37 38 3a 72 65 74 75 72 6e 22 2d 77 65 62 6b 69 74 2d 22 2b 61 2b 22 2d 6d 6f 7a 2d 22 2b 61 2b 61 3b 63 61 73 65 20 31 30 31 39 3a 63 61 73 65 20 39 38 33 3a 72 65 74 75 72 6e 22 2d 77 65 62 6b 69 74 2d 22 2b 61 Data Ascii: urn 116===a.charCodeAt(3)?"-webkit-"+a+a:a;case 963:return 110===a.charCodeAt(5)?"-webkit-"+a+a:a;case 1009:if(100!==a.charCodeAt(4))break;case 969:case 942:return"-webkit-"+a+a;case 978:return"-webkit-"+a+"-moz-"+a+a;case 1019:case 983:return"-webkit-"+a
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 68 2d 31 30 2c 75 3d 28 73 3d 28 33 33 3d 3d 3d 61 2e 63 68 61 72 43 6f 64 65 41 74 28 74 29 3f 61 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 74 29 3a 61 29 2e 73 75 62 73 74 72 69 6e 67 28 65 2e 69 6e 64 65 78 4f 66 28 22 3a 22 2c 37 29 2b 31 29 2e 74 72 69 6d 28 29 29 2e 63 68 61 72 43 6f 64 65 41 74 28 30 29 2b 28 30 7c 73 2e 63 68 61 72 43 6f 64 65 41 74 28 37 29 29 29 7b 63 61 73 65 20 32 30 33 3a 69 66 28 31 31 31 3e 73 2e 63 68 61 72 43 6f 64 65 41 74 28 38 29 29 62 72 65 61 6b 3b 63 61 73 65 20 31 31 35 3a 61 3d 61 2e 72 65 70 6c 61 63 65 28 73 2c 22 2d 77 65 62 6b 69 74 2d 22 2b 73 29 2b 22 3b 22 2b 61 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 30 37 3a 63 61 73 65 20 31 30 32 3a 61 3d 61 2e 72 65 70 6c 61 63 65 28 73 2c 22 2d 77 65 62 6b 69 74 2d 22 2b Data Ascii: h-10,u=(s=(33===a.charCodeAt(t)?a.substring(0,t):a).substring(e.indexOf(":",7)+1).trim()).charCodeAt(0)+(0\|s.charCodeAt(7))){case 203:if(111>s.charCodeAt(8))break;case 115:a=a.replace(s,"-webkit-"+s)+";"+a;break;case 207:case 102:a=a.replace(s,"-webkit-"+
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 76 61 72 20 6e 3d 6f 28 74 2c 74 2e 63 68 61 72 43 6f 64 65 41 74 28 30 29 2c 74 2e 63 68 61 72 43 6f 64 65 41 74 28 31 29 2c 74 2e 63 68 61 72 43 6f 64 65 41 74 28 32 29 29 3b 72 65 74 75 72 6e 20 6e 21 3d 3d 74 2b 22 3b 22 3f 6e 2e 72 65 70 6c 61 63 65 28 43 2c 22 20 6f 72 20 28 24 31 29 22 29 2e 73 75 62 73 74 72 69 6e 67 28 34 29 3a 22 28 22 2b 74 2b 22 29 22 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 2c 6e 2c 6f 2c 72 2c 69 2c 61 2c 75 2c 6c 2c 63 29 7b 66 6f 72 28 76 61 72 20 70 2c 64 3d 30 2c 66 3d 74 3b 64 3c 50 3b 2b 2b 64 29 73 77 69 74 63 68 28 70 3d 49 5b 64 5d 2e 63 61 6c 6c 28 73 2c 65 2c 66 2c 6e 2c 6f 2c 72 2c 69 2c 61 2c 75 2c 6c 2c 63 29 29 7b 63 61 73 65 20 76 6f 69 64 20 30 3a 63 61 73 65 21 31 3a 63 61 73 65 21 30 3a 63 61 73 65 20 Data Ascii: var n=o(t,t.charCodeAt(0),t.charCodeAt(1),t.charCodeAt(2));return n!==t+";"?n.replace(C," or ($1)").substring(4):"("+t+")"}function a(e,t,n,o,r,i,a,u,l,c){for(var p,d=0,f=t;d<P;++d)switch(p=I[d].call(s,e,f,n,o,r,i,a,u,l,c)){case void 0:case!1:case!0:case
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 3d 3d 66 26 26 28 66 3d 28 48 3d 48 2e 72 65 70 6c 61 63 65 28 6c 2c 22 22 29 2e 74 72 69 6d 28 29 29 2e 63 68 61 72 43 6f 64 65 41 74 28 30 29 29 2c 36 34 3d 3d 3d 66 29 7b 73 77 69 74 63 68 28 30 3c 52 26 26 28 48 3d 48 2e 72 65 70 6c 61 63 65 28 63 2c 22 22 29 29 2c 68 3d 48 2e 63 68 61 72 43 6f 64 65 41 74 28 31 29 29 7b 63 61 73 65 20 31 30 30 3a 63 61 73 65 20 31 30 39 3a 63 61 73 65 20 31 31 35 3a 63 61 73 65 20 34 35 3a 52 3d 75 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 52 3d 4d 7d 69 66 28 5f 3d 28 6d 3d 65 28 75 2c 52 2c 6d 2c 68 2c 64 2b 31 29 29 2e 6c 65 6e 67 74 68 2c 30 3c 50 26 26 28 43 3d 61 28 33 2c 6d 2c 52 3d 74 28 4d 2c 48 2c 42 29 2c 75 2c 6b 2c 77 2c 5f 2c 68 2c 64 2c 70 29 2c 48 3d 52 2e 6a 6f 69 6e 28 22 22 29 2c 76 6f 69 64 20 Data Ascii: ==f&&(f=(H=H.replace(l,"").trim()).charCodeAt(0)),64===f){switch(0<R&&(H=H.replace(c,"")),h=H.charCodeAt(1)){case 100:case 109:case 115:case 45:R=u;break;default:R=M}if(_=(m=e(u,R,m,h,d+1)).length,0<P&&(C=a(3,m,R=t(M,H,B),u,k,w,_,h,d,p),H=R.join(""),void
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 26 28 62 3d 22 20 22 29 7d 62 72 65 61 6b 3b 63 61 73 65 20 30 3a 62 3d 22 5c 5c 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 32 3a 62 3d 22 5c 5c 66 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 31 3a 62 3d 22 5c 5c 76 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 33 38 3a 30 3d 3d 3d 53 2b 78 2b 4f 26 26 28 52 3d 42 3d 31 2c 62 3d 22 5c 66 22 2b 62 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 30 38 3a 69 66 28 30 3d 3d 3d 53 2b 78 2b 4f 2b 46 26 26 30 3c 54 29 73 77 69 74 63 68 28 4e 2d 54 29 7b 63 61 73 65 20 32 3a 31 31 32 3d 3d 3d 49 26 26 35 38 3d 3d 3d 73 2e 63 68 61 72 43 6f 64 65 41 74 28 4e 2d 33 29 26 26 28 46 3d 49 29 3b 63 61 73 65 20 38 3a 31 31 31 3d 3d 3d 4c 26 26 28 46 3d 4c 29 7d 62 72 65 61 6b 3b 63 61 73 65 20 35 38 3a 30 3d 3d 3d 53 2b 78 2b 4f 26 Data Ascii: &(b=" ")}break;case 0:b="\\0";break;case 12:b="\\f";break;case 11:b="\\v";break;case 38:0===S+x+O&&(R=B=1,b="\f"+b);break;case 108:if(0===S+x+O+F&&0<T)switch(N-T){case 2:112===I&&58===s.charCodeAt(N-3)&&(F=I);case 8:111===L&&(F=L)}break;case 58:0===S+x+O&
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 79 29 2f 67 2c 62 3d 2f 5b 73 76 68 5d 5c 77 2b 2d 5b 74 62 6c 72 5d 7b 32 7d 2f 2c 79 3d 2f 5c 28 5c 73 2a 28 2e 2a 29 5c 73 2a 5c 29 2f 67 2c 43 3d 2f 28 5b 5c 73 5c 53 5d 2a 3f 29 3b 2f 67 2c 4f 3d 2f 2d 73 65 6c 66 7c 66 6c 65 78 2d 2f 67 2c 78 3d 2f 5b 5e 5d 2a 3f 28 3a 5b 72 70 5d 5b 65 6c 5d 61 5b 5c 77 2d 5d 2b 29 5b 5e 5d 2a 2f 2c 41 3d 2f 73 74 72 65 74 63 68 7c 3a 5c 73 2a 5c 77 2b 5c 2d 28 3f 3a 63 6f 6e 74 65 7c 61 76 61 69 6c 29 2f 2c 53 3d 2f 28 5b 5e 2d 5d 29 28 69 6d 61 67 65 2d 73 65 74 5c 28 29 2f 2c 77 3d 31 2c 6b 3d 31 2c 46 3d 30 2c 44 3d 31 2c 4d 3d 5b 5d 2c 49 3d 5b 5d 2c 50 3d 30 2c 4c 3d 6e 75 6c 6c 2c 56 3d 30 2c 54 3d 22 22 3b 72 65 74 75 72 6e 20 73 2e 75 73 65 3d 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 73 77 69 74 63 68 28 Data Ascii: y)/g,b=/[svh]\w+-[tblr]{2}/,y=/$\s(.)\s$/g,C=/([\s\S]?);/g,O=/-self\|flex-/g,x=/[^]?(:[rp][el]a[\w-]+)[^]/,A=/stretch\|:\s*\w+\-(?:conte\|avail)/,S=/([^-])(image-set\()/,w=1,k=1,F=0,D=1,M=[],I=[],P=0,L=null,V=0,T="";return s.use=function e(t){switch(
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 69 73 4e 61 4e 28 74 29 7c 7c 30 3d 3d 3d 74 3f 74 3a 74 2b 22 70 78 22 7d 2c 64 3d 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 74 2e 6c 65 6e 67 74 68 2c 6f 3d 30 2c 72 3d 22 22 3b 6f 3c 6e 3b 6f 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 6f 5d 3b 69 66 28 6e 75 6c 6c 21 3d 69 29 7b 76 61 72 20 61 3d 76 6f 69 64 20 30 3b 73 77 69 74 63 68 28 74 79 70 65 6f 66 20 69 29 7b 63 61 73 65 22 62 6f 6f 6c 65 61 6e 22 3a 62 72 65 61 6b 3b 63 61 73 65 22 66 75 6e 63 74 69 6f 6e 22 3a 61 3d 65 28 5b 69 28 29 5d 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 6f 62 6a 65 63 74 22 3a 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 69 29 29 61 3d 65 28 69 29 3b 65 6c 73 65 20 66 6f 72 28 76 61 72 20 75 20 69 6e 20 61 3d 22 22 2c 69 29 69 5b 75 5d 26 26 Data Ascii: isNaN(t)\|\|0===t?t:t+"px"},d=function e(t){for(var n=t.length,o=0,r="";o<n;o++){var i=t[o];if(null!=i){var a=void 0;switch(typeof i){case"boolean":break;case"function":a=e([i()]);break;case"object":if(Array.isArray(i))a=e(i);else for(var u in a="",i)i[u]&&
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 29 7d 2c 74 2e 66 6c 75 73 68 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 74 61 67 73 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 65 29 7d 29 2c 74 68 69 73 2e 74 61 67 73 3d 5b 5d 2c 74 68 69 73 2e 63 74 72 3d 30 2c 74 68 69 73 2e 69 6e 6a 65 63 74 65 64 3d 21 31 7d 2c 65 7d 28 29 3b 74 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 76 6f 69 64 20 30 21 3d 3d 65 2e 5f 5f 53 45 43 52 45 54 5f 45 4d 4f 54 49 4f 4e 5f 5f 29 72 65 74 75 72 6e 20 65 2e 5f 5f 53 45 43 52 45 54 5f 45 4d 4f 54 49 4f 4e 5f 5f 3b 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 74 3d 7b 7d 29 3b 76 61 72 20 6e 2c 6f 2c 72 2c 75 2c 6c 3d 74 2e 6b 65 79 7c 7c Data Ascii: )},t.flush=function(){this.tags.forEach(function(e){return e.parentNode.removeChild(e)}),this.tags=[],this.ctr=0,this.injected=!1},e}();t.Z=function(e,t){if(void 0!==e.__SECRET_EMOTION__)return e.__SECRET_EMOTION__;void 0===t&&(t={});var n,o,r,u,l=t.key\|\|

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.7	49843	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:45 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:45 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:45 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 31e4fe8c-301e-0033-38f2-21fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071545Z-16849878b78z5q7jpbgf6e9mcw00000007f0000000006p17 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:45 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.7	49845	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:45 UTC	745	OUT	GET /assets/5067a2ec1b24a6de868c.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/assets/ac625b77a0bab0ee72df.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:45 UTC	975	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:45 GMT Content-Type: application/javascript Content-Length: 13374 Connection: close CF-Ray: 8d782d734a092cc6-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "d0c788b157ff96a2dd902c97bfc889f6" Last-Modified: Fri, 28 Jun 2024 00:43:12 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IscIY7qK%2F5ZlX71tw7ALFh4V9aAioqpBacmbNaRkUzKu0cfMS%2F%2B32JNvcRdlHDXdhITXlK%2BVuXgBWD32U51EzFx2bg8mUSxz5u8MMN8Si4%2BMKdzSd%2BNJVUh29OQT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:45 UTC	394	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 37 38 31 38 37 22 5d 2c 7b 35 32 36 39 38 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 33 35 34 38 34 38 29 2c 6f 3d 72 28 39 33 38 35 30 37 29 2c 69 3d 54 79 70 65 45 72 72 6f 72 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 65 28 74 29 29 72 65 74 75 72 6e 20 74 3b 74 68 72 6f 77 20 69 28 6f 28 74 29 2b 22 20 69 73 20 6e 6f 74 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 7d 7d 2c 32 34 30 33 33 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["78187"],{526988:function(t,n,r){var e=r(354848),o=r(938507),i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not a function")}},24033:function(t,n,r){
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 65 3d 72 28 32 39 39 36 32 33 29 2c 6f 3d 72 28 39 38 30 38 35 35 29 2c 69 3d 72 28 34 39 36 39 33 29 2c 75 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 2c 72 2c 75 29 7b 76 61 72 20 63 2c 66 3d 65 28 6e 29 2c 61 3d 69 28 66 29 2c 73 3d 6f 28 75 2c 61 29 3b 69 66 28 74 26 26 72 21 3d 72 29 7b 66 6f 72 28 3b 61 3e 73 3b 29 69 66 28 28 63 3d 66 5b 73 2b 2b 5d 29 21 3d 63 29 72 65 74 75 72 6e 21 30 7d 65 6c 73 65 20 66 6f 72 28 3b 61 3e 73 3b 73 2b 2b 29 69 66 28 28 74 7c 7c 73 20 69 6e 20 66 29 26 26 66 5b 73 5d 3d 3d 3d 72 29 72 65 74 75 72 6e 20 74 7c 7c 73 7c 7c 30 3b 72 65 74 75 72 6e 21 74 26 26 2d 31 7d 7d 3b 74 2e 65 78 70 6f 72 74 73 3d 7b 69 6e 63 6c 75 64 65 73 3a 75 28 21 30 29 2c 69 6e 64 65 78 4f 66 Data Ascii: e=r(299623),o=r(980855),i=r(49693),u=function(t){return function(n,r,u){var c,f=e(n),a=i(f),s=o(u,a);if(t&&r!=r){for(;a>s;)if((c=f[s++])!=c)return!0}else for(;a>s;s++)if((t\|\|s in f)&&f[s]===r)return t\|\|s\|\|0;return!t&&-1}};t.exports={includes:u(!0),indexOf
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 31 36 31 35 38 31 29 2c 6f 3d 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 74 72 79 7b 6f 28 65 2c 74 2c 7b 76 61 6c 75 65 3a 6e 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 7d 63 61 74 63 68 28 72 29 7b 65 5b 74 5d 3d 6e 7d 72 65 74 75 72 6e 20 6e 7d 7d 2c 33 32 35 30 30 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 39 33 36 39 34 30 29 3b 74 2e 65 78 70 6f 72 74 73 3d 21 65 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 37 21 3d 3d 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 7b 7d 2c 31 2c 7b 67 65 74 3a 66 75 6e 63 Data Ascii: n,r){var e=r(161581),o=Object.defineProperty;t.exports=function(t,n){try{o(e,t,{value:n,configurable:!0,writable:!0})}catch(r){e[t]=n}return n}},325008:function(t,n,r){var e=r(936940);t.exports=!e(function(){return 7!==Object.defineProperty({},1,{get:func
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 65 64 29 26 26 76 6f 69 64 20 30 21 3d 3d 70 29 7b 69 66 28 74 79 70 65 6f 66 20 6c 3d 3d 74 79 70 65 6f 66 20 70 29 63 6f 6e 74 69 6e 75 65 3b 66 28 6c 2c 70 29 7d 28 74 2e 73 68 61 6d 7c 7c 70 26 26 70 2e 73 68 61 6d 29 26 26 69 28 6c 2c 22 73 68 61 6d 22 2c 21 30 29 2c 75 28 72 2c 73 2c 6c 2c 74 29 7d 7d 7d 2c 39 33 36 39 34 30 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 72 79 7b 72 65 74 75 72 6e 21 21 74 28 29 7d 63 61 74 63 68 28 74 29 7b 72 65 74 75 72 6e 21 30 7d 7d 7d 2c 39 36 32 35 35 37 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 39 33 36 39 34 30 29 3b 74 2e 65 78 70 6f 72 74 73 3d 21 65 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 28 66 75 Data Ascii: ed)&&void 0!==p){if(typeof l==typeof p)continue;f(l,p)}(t.sham\|\|p&&p.sham)&&i(l,"sham",!0),u(r,s,l,t)}}},936940:function(t){t.exports=function(t){try{return!!t()}catch(t){return!0}}},962557:function(t,n,r){var e=r(936940);t.exports=!e(function(){var t=(fu
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 28 29 7c 7c 74 68 69 73 7c 7c 46 75 6e 63 74 69 6f 6e 28 22 72 65 74 75 72 6e 20 74 68 69 73 22 29 28 29 7d 2c 37 34 30 33 36 32 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 35 38 31 30 33 31 29 2c 6f 3d 72 28 33 33 39 37 31 38 29 2c 69 3d 65 28 7b 7d 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 29 3b 74 2e 65 78 70 6f 72 74 73 3d 4f 62 6a 65 63 74 2e 68 61 73 4f 77 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 72 65 74 75 72 6e 20 69 28 6f 28 74 29 2c 6e 29 7d 7d 2c 36 32 34 39 30 36 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 7b 7d 7d 2c 33 34 39 32 34 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 33 32 35 30 30 38 29 2c 6f 3d 72 28 39 33 36 39 34 30 29 2c 69 3d 72 Data Ascii: ()\|\|this\|\|Function("return this")()},740362:function(t,n,r){var e=r(581031),o=r(339718),i=e({}.hasOwnProperty);t.exports=Object.hasOwn\|\|function(t,n){return i(o(t),n)}},624906:function(t){t.exports={}},34924:function(t,n,r){var e=r(325008),o=r(936940),i=r
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 72 6e 20 69 28 74 29 3f 6f 28 74 29 3a 65 28 74 2c 7b 7d 29 7d 2c 67 65 74 74 65 72 46 6f 72 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 72 3b 69 66 28 21 66 28 6e 29 7c 7c 28 72 3d 6f 28 6e 29 29 2e 74 79 70 65 21 3d 3d 74 29 74 68 72 6f 77 20 79 28 22 49 6e 63 6f 6d 70 61 74 69 62 6c 65 20 72 65 63 65 69 76 65 72 2c 20 22 2b 74 2b 22 20 72 65 71 75 69 72 65 64 22 29 3b 72 65 74 75 72 6e 20 72 7d 7d 7d 7d 2c 33 35 34 38 34 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 31 37 34 31 32 34 29 2c 6f 3d 65 2e 61 6c 6c 3b 74 2e 65 78 70 6f 72 74 73 3d 65 2e 49 53 5f 48 54 4d 4c 44 44 41 3f 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f Data Ascii: rn i(t)?o(t):e(t,{})},getterFor:function(t){return function(n){var r;if(!f(n)\|\|(r=o(n)).type!==t)throw y("Incompatible receiver, "+t+" required");return r}}}},354848:function(t,n,r){var e=r(174124),o=e.all;t.exports=e.IS_HTMLDDA?function(t){return"functio
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 68 3d 65 28 5b 5d 2e 6a 6f 69 6e 29 2c 6d 3d 63 26 26 21 6f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 38 21 3d 3d 62 28 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 22 6c 65 6e 67 74 68 22 2c 7b 76 61 6c 75 65 3a 38 7d 29 2e 6c 65 6e 67 74 68 7d 29 2c 78 3d 53 74 72 69 6e 67 28 53 74 72 69 6e 67 29 2e 73 70 6c 69 74 28 22 53 74 72 69 6e 67 22 29 2c 64 3d 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 22 53 79 6d 62 6f 6c 28 22 3d 3d 3d 79 28 76 28 6e 29 2c 30 2c 37 29 26 26 28 6e 3d 22 5b 22 2b 67 28 76 28 6e 29 2c 2f 5e 53 79 6d 62 6f 6c 5c 28 28 5b 5e 29 5d 2a 29 5c 29 2f 2c 22 24 31 22 29 2b 22 5d 22 29 2c 72 26 26 72 2e 67 65 74 74 65 72 26 26 28 6e 3d 22 67 65 74 20 22 2b 6e 29 2c 72 26 26 72 2e 73 65 74 74 65 Data Ascii: h=e([].join),m=c&&!o(function(){return 8!==b(function(){},"length",{value:8}).length}),x=String(String).split("String"),d=t.exports=function(t,n,r){"Symbol("===y(v(n),0,7)&&(n="["+g(v(n),/^Symbol$([^)]*)$/,"$1")+"]"),r&&r.getter&&(n="get "+n),r&&r.sette
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 65 73 73 6f 72 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 22 29 3b 72 65 74 75 72 6e 22 76 61 6c 75 65 22 69 6e 20 72 26 26 28 74 5b 6e 5d 3d 72 2e 76 61 6c 75 65 29 2c 74 7d 7d 2c 33 34 37 37 32 32 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 33 32 35 30 30 38 29 2c 6f 3d 72 28 39 32 36 35 31 35 29 2c 69 3d 72 28 36 31 30 30 36 37 29 2c 75 3d 72 28 38 37 39 29 2c 63 3d 72 28 32 39 39 36 32 33 29 2c 66 3d 72 28 39 36 36 36 30 36 29 2c 61 3d 72 28 37 34 30 33 36 32 29 2c 73 3d 72 28 33 34 39 32 34 29 2c 70 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 3b 6e 2e 66 3d 65 3f 70 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 69 66 28 74 3d 63 28 74 29 2c 6e 3d 66 28 6e 29 2c 73 29 Data Ascii: essors not supported");return"value"in r&&(t[n]=r.value),t}},347722:function(t,n,r){var e=r(325008),o=r(926515),i=r(610067),u=r(879),c=r(299623),f=r(966606),a=r(740362),s=r(34924),p=Object.getOwnPropertyDescriptor;n.f=e?p:function(t,n){if(t=c(t),n=f(n),s)
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 39 29 2c 63 3d 72 28 32 34 30 33 33 29 2c 66 3d 6f 28 5b 5d 2e 63 6f 6e 63 61 74 29 3b 74 2e 65 78 70 6f 72 74 73 3d 65 28 22 52 65 66 6c 65 63 74 22 2c 22 6f 77 6e 4b 65 79 73 22 29 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 69 2e 66 28 63 28 74 29 29 2c 72 3d 75 2e 66 3b 72 65 74 75 72 6e 20 72 3f 66 28 6e 2c 72 28 74 29 29 3a 6e 7d 7d 2c 36 37 36 31 32 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 33 35 31 37 39 29 2c 6f 3d 54 79 70 65 45 72 72 6f 72 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 65 28 74 29 29 74 68 72 6f 77 20 6f 28 22 43 61 6e 27 74 20 63 61 6c 6c 20 6d 65 74 68 6f 64 20 6f 6e 20 22 2b 74 29 3b 72 65 74 75 72 6e 20 74 7d 7d 2c 38 38 33 35 33 39 3a 66 75 Data Ascii: 9),c=r(24033),f=o([].concat);t.exports=e("Reflect","ownKeys")\|\|function(t){var n=i.f(c(t)),r=u.f;return r?f(n,r(t)):n}},676125:function(t,n,r){var e=r(35179),o=TypeError;t.exports=function(t){if(e(t))throw o("Can't call method on "+t);return t}},883539:fu
2024-10-24 07:15:45 UTC	1369	IN	Data Raw: 2c 72 29 7b 76 61 72 20 65 3d 72 28 39 35 39 33 31 38 29 2c 6f 3d 4d 61 74 68 2e 6d 69 6e 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 3e 30 3f 6f 28 65 28 74 29 2c 39 30 30 37 31 39 39 32 35 34 37 34 30 39 39 31 29 3a 30 7d 7d 2c 33 33 39 37 31 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 36 37 36 31 32 35 29 2c 6f 3d 4f 62 6a 65 63 74 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6f 28 65 28 74 29 29 7d 7d 2c 36 39 31 35 35 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 39 32 36 35 31 35 29 2c 6f 3d 72 28 36 32 32 32 38 31 29 2c 69 3d 72 28 33 32 33 39 37 39 29 2c 75 3d 72 28 39 39 35 37 33 39 29 2c Data Ascii: ,r){var e=r(959318),o=Math.min;t.exports=function(t){return t>0?o(e(t),9007199254740991):0}},339718:function(t,n,r){var e=r(676125),o=Object;t.exports=function(t){return o(e(t))}},691558:function(t,n,r){var e=r(926515),o=r(622281),i=r(323979),u=r(995739),

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.7	49846	35.190.80.1	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:45 UTC	532	OUT	OPTIONS /report/v4?s=j%2Bvd4db%2FnJKCksUnQfxjBqA4P2wy21wAjR7kq6JYdLd%2FTbNxOzyMaYLuPY17E8B%2FD%2F%2BiDYDVFjxhoHe1BcFjfFi%2ByBAYR84%2FDXlHVVAubpNZo4eIyM3Ue30CgBVX HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://discord.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 07:15:45 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Thu, 24 Oct 2024 07:15:45 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.7	49844	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:45 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:45 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:45 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: f0c9e92d-201e-0000-1199-25a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071545Z-15b8d89586frzkk2umu6w8qnt80000000dwg000000006g57 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:15:45 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.7	49847	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:45 UTC	1686	OUT	POST /api/v9/science HTTP/1.1 Host: discord.com Connection: keep-alive Content-Length: 1126 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Super-Properties: eyJvcyI6IldpbmRvd3MiLCJicm93c2VyIjoiQ2hyb21lIiwiZGV2aWNlIjoiIiwic3lzdGVtX2xvY2FsZSI6ImVuLVVTIiwiYnJvd3Nlcl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2IiwiYnJvd3Nlcl92ZXJzaW9uIjoiMTE3LjAuMC4wIiwib3NfdmVyc2lvbiI6IjEwIiwicmVmZXJyZXIiOiIiLCJyZWZlcnJpbmdfZG9tYWluIjoiIiwicmVmZXJyZXJfY3VycmVudCI6IiIsInJlZmVycmluZ19kb21haW5fY3VycmVudCI6IiIsInJlbGVhc2VfY2hhbm5lbCI6InN0YWJsZSIsImNsaWVudF9idWlsZF9udW1iZXIiOjMzODU0MCwiY2xpZW50X2V2ZW50X3NvdXJjZSI6bnVsbH0= X-Fingerprint: 1298907770543669269.3mKIt_b3e6cjNLa98gAmbtR2lvU X-Debug-Options: bugReporterEnabled sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Discord-Timezone: America/New_York Content-Type: application/json X-Discord-Locale: en-US sec-ch-ua-platform: "Windows" Accept: / Origin: https://discord.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:45 UTC	1126	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 74 79 70 65 22 3a 22 75 73 65 72 5f 66 69 6e 67 65 72 70 72 69 6e 74 5f 63 68 61 6e 67 65 64 22 2c 22 70 72 6f 70 65 72 74 69 65 73 22 3a 7b 22 63 6c 69 65 6e 74 5f 74 72 61 63 6b 5f 74 69 6d 65 73 74 61 6d 70 22 3a 31 37 32 39 37 35 34 31 34 34 36 35 31 2c 22 6f 6c 64 5f 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 6e 75 6c 6c 2c 22 6e 65 77 5f 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 31 32 39 38 39 30 37 37 37 30 35 34 33 36 36 39 32 36 39 22 2c 22 63 6c 69 65 6e 74 5f 70 65 72 66 6f 72 6d 61 6e 63 65 5f 6d 65 6d 6f 72 79 22 3a 30 2c 22 61 63 63 65 73 73 69 62 69 6c 69 74 79 5f 66 65 61 74 75 72 65 73 22 3a 31 32 38 2c 22 72 65 6e 64 65 72 65 64 5f 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 55 53 22 2c 22 75 70 74 69 6d 65 5f Data Ascii: {"events":[{"type":"user_fingerprint_changed","properties":{"client_track_timestamp":1729754144651,"old_fingerprint":null,"new_fingerprint":"1298907770543669269","client_performance_memory":0,"accessibility_features":128,"rendered_locale":"en-US","uptime_
2024-10-24 07:15:45 UTC	825	IN	HTTP/1.1 204 No Content Date: Thu, 24 Oct 2024 07:15:45 GMT Connection: close access-control-allow-origin: https://discord.com vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GbeZYQW6jPBIV%2B%2Fl8PkHhwWhgiOB2VQT47SOC3dhLecDpLvF9H1jhQdzmbpCfskwvlsFK%2Fw%2B1FSLRG764jzUrRmuFGk2caNAWQOmxXmSujFeLMjNVsV076SRPnHE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Server: cloudflare CF-RAY: 8d782d73bc612c8f-DFW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.7	49848	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:45 UTC	1685	OUT	POST /api/v9/science HTTP/1.1 Host: discord.com Connection: keep-alive Content-Length: 722 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Super-Properties: eyJvcyI6IldpbmRvd3MiLCJicm93c2VyIjoiQ2hyb21lIiwiZGV2aWNlIjoiIiwic3lzdGVtX2xvY2FsZSI6ImVuLVVTIiwiYnJvd3Nlcl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2IiwiYnJvd3Nlcl92ZXJzaW9uIjoiMTE3LjAuMC4wIiwib3NfdmVyc2lvbiI6IjEwIiwicmVmZXJyZXIiOiIiLCJyZWZlcnJpbmdfZG9tYWluIjoiIiwicmVmZXJyZXJfY3VycmVudCI6IiIsInJlZmVycmluZ19kb21haW5fY3VycmVudCI6IiIsInJlbGVhc2VfY2hhbm5lbCI6InN0YWJsZSIsImNsaWVudF9idWlsZF9udW1iZXIiOjMzODU0MCwiY2xpZW50X2V2ZW50X3NvdXJjZSI6bnVsbH0= X-Fingerprint: 1298907770543669269.3mKIt_b3e6cjNLa98gAmbtR2lvU X-Debug-Options: bugReporterEnabled sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Discord-Timezone: America/New_York Content-Type: application/json X-Discord-Locale: en-US sec-ch-ua-platform: "Windows" Accept: / Origin: https://discord.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:45 UTC	722	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 74 79 70 65 22 3a 22 65 78 70 65 72 69 6d 65 6e 74 5f 75 73 65 72 5f 74 72 69 67 67 65 72 65 64 22 2c 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 31 32 39 38 39 30 37 37 37 30 35 34 33 36 36 39 32 36 39 2e 33 6d 4b 49 74 5f 62 33 65 36 63 6a 4e 4c 61 39 38 67 41 6d 62 74 52 32 6c 76 55 22 2c 22 70 72 6f 70 65 72 74 69 65 73 22 3a 7b 22 63 6c 69 65 6e 74 5f 74 72 61 63 6b 5f 74 69 6d 65 73 74 61 6d 70 22 3a 31 37 32 39 37 35 34 31 34 34 36 36 35 2c 22 6e 61 6d 65 22 3a 22 32 30 32 33 2d 30 39 5f 72 65 64 65 73 69 67 6e 65 64 5f 69 63 6f 6e 73 5f 65 78 70 65 72 69 6d 65 6e 74 22 2c 22 72 65 76 69 73 69 6f 6e 22 3a 31 2c 22 70 6f 70 75 6c 61 74 69 6f 6e 22 3a 30 2c 22 62 75 63 6b 65 74 22 3a 31 2c 22 6c 6f 63 61 74 69 Data Ascii: {"events":[{"type":"experiment_user_triggered","fingerprint":"1298907770543669269.3mKIt_b3e6cjNLa98gAmbtR2lvU","properties":{"client_track_timestamp":1729754144665,"name":"2023-09_redesigned_icons_experiment","revision":1,"population":0,"bucket":1,"locati
2024-10-24 07:15:45 UTC	825	IN	HTTP/1.1 204 No Content Date: Thu, 24 Oct 2024 07:15:45 GMT Connection: close access-control-allow-origin: https://discord.com vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6jTtgeAlWrJWNJbPQKPCTRWwUYAo0jn5jT6lnoXHlUWTAtF8%2BbPCCO5%2BWYINZzTOQyuCuXjCHiIHbi2eaCrq7D%2B1%2Bmm33Tkj3L1aTxrAbwO9TVrEuQX3uDd9ykGF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Server: cloudflare CF-RAY: 8d782d73db414769-DFW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.7	49849	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:45 UTC	868	OUT	GET /assets/1f7f046253c197b5a419.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:46 UTC	968	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:45 GMT Content-Type: text/javascript Content-Length: 17462 Connection: close CF-Ray: 8d782d741a506bb9-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "3b98c1ef9293d482a5099fdb6984946f" Last-Modified: Tue, 15 Oct 2024 21:50:02 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3HLrpAqxxA0W79Qmvw%2FsiufFG9%2BPnkvow%2BH%2FdCwCo2iClE6XHZb2qcdtIUJyKHBiJdFLpDtOHms5c1ebubc%2BNAos2zfglgXw67ll54mv4Ldh8aHhbp4%2Fm9sItAfW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 31 35 38 31 32 22 5d 2c 7b 38 38 34 38 33 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6f 3d 72 28 33 31 31 35 39 36 29 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 7d 69 2e 72 65 73 65 74 57 61 72 6e 69 6e 67 43 61 63 68 65 3d 6e 2c 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 74 2c 65 2c 72 2c 6e 2c 69 2c 61 29 7b 69 66 28 61 21 3d 3d 6f 29 7b 76 61 72 20 75 3d 45 72 72 6f 72 28 22 43 61 6c 6c Data Ascii: (this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["15812"],{884835:function(t,e,r){"use strict";var o=r(311596);function n(){}function i(){}i.resetWarningCache=n,t.exports=function(){function t(t,e,r,n,i,a){if(a!==o){var u=Error("Call
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6c 65 6e 67 74 68 7d 2c 70 75 74 42 69 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 74 68 69 73 2e 6c 65 6e 67 74 68 2f 38 29 3b 74 68 69 73 2e 62 75 66 66 65 72 2e 6c 65 6e 67 74 68 3c 3d 65 26 26 74 68 69 73 2e 62 75 66 66 65 72 2e 70 75 73 68 28 30 29 2c 74 26 26 28 74 68 69 73 2e 62 75 66 66 65 72 5b 65 5d 7c 3d 31 32 38 3e 3e 3e 74 68 69 73 2e 6c 65 6e 67 74 68 25 38 29 2c 74 68 69 73 2e 6c 65 6e 67 74 68 2b 2b 7d 7d 2c 74 2e 65 78 70 6f 72 74 73 3d 65 7d 2c 39 33 33 39 38 32 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 7b 4c 3a 31 2c 4d 3a 30 2c 51 3a 33 2c 48 3a 32 7d 7d 2c 36 36 39 30 31 33 3a 66 75 6e 63 Data Ascii: :function(){return this.length},putBit:function(t){var e=Math.floor(this.length/8);this.buffer.length<=e&&this.buffer.push(0),t&&(this.buffer[e]\|=128>>>this.length%8),this.length++}},t.exports=e},933982:function(t){t.exports={L:1,M:0,Q:3,H:2}},669013:func
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 74 3c 30 7c 7c 74 68 69 73 2e 6d 6f 64 75 6c 65 43 6f 75 6e 74 3c 3d 74 7c 7c 65 3c 30 7c 7c 74 68 69 73 2e 6d 6f 64 75 6c 65 43 6f 75 6e 74 3c 3d 65 29 74 68 72 6f 77 20 45 72 72 6f 72 28 74 2b 22 2c 22 2b 65 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 74 5d 5b 65 5d 7d 2c 6c 2e 67 65 74 4d 6f 64 75 6c 65 43 6f 75 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6d 6f 64 75 6c 65 43 6f 75 6e 74 7d 2c 6c 2e 6d 61 6b 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 74 79 70 65 4e 75 6d 62 65 72 3c 31 29 7b 76 61 72 20 74 3d 31 3b 66 6f 72 28 74 3d 31 3b 74 3c 34 30 3b 74 2b 2b 29 7b 66 6f 72 28 76 61 72 20 65 3d 6e 2e 67 65 74 52 53 42 6c 6f Data Ascii: function(t,e){if(t<0\|\|this.moduleCount<=t\|\|e<0\|\|this.moduleCount<=e)throw Error(t+","+e);return this.modules[t][e]},l.getModuleCount=function(){return this.moduleCount},l.make=function(){if(this.typeNumber<1){var t=1;for(t=1;t<40;t++){for(var e=n.getRSBlo
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 3c 3d 65 2b 6f 29 26 26 28 30 3c 3d 72 26 26 72 3c 3d 36 26 26 28 30 3d 3d 6f 7c 7c 36 3d 3d 6f 29 7c 7c 30 3c 3d 6f 26 26 6f 3c 3d 36 26 26 28 30 3d 3d 72 7c 7c 36 3d 3d 72 29 7c 7c 32 3c 3d 72 26 26 72 3c 3d 34 26 26 32 3c 3d 6f 26 26 6f 3c 3d 34 3f 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 74 2b 72 5d 5b 65 2b 6f 5d 3d 21 30 3a 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 74 2b 72 5d 5b 65 2b 6f 5d 3d 21 31 29 7d 2c 6c 2e 67 65 74 42 65 73 74 4d 61 73 6b 50 61 74 74 65 72 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 30 2c 65 3d 30 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 74 68 69 73 2e 6d 61 6b 65 49 6d 70 6c 28 21 30 2c 72 29 3b 76 61 72 20 6f 3d 61 2e 67 65 74 4c 6f 73 74 50 6f 69 6e 74 28 74 68 69 73 29 3b 28 30 3d 3d 72 7c 7c 74 3e Data Ascii: <=e+o)&&(0<=r&&r<=6&&(0==o\|\|6==o)\|\|0<=o&&o<=6&&(0==r\|\|6==r)\|\|2<=r&&r<=4&&2<=o&&o<=4?this.modules[t+r][e+o]=!0:this.modules[t+r][e+o]=!1)},l.getBestMaskPattern=function(){for(var t=0,e=0,r=0;r<8;r++){this.makeImpl(!0,r);var o=a.getLostPoint(this);(0==r\|\|t>
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 5d 5b 4d 61 74 68 2e 66 6c 6f 6f 72 28 72 2f 33 29 5d 3d 6f 7d 7d 2c 6c 2e 73 65 74 75 70 54 79 70 65 49 6e 66 6f 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 74 68 69 73 2e 65 72 72 6f 72 43 6f 72 72 65 63 74 4c 65 76 65 6c 3c 3c 33 7c 65 2c 6f 3d 61 2e 67 65 74 42 43 48 54 79 70 65 49 6e 66 6f 28 72 29 2c 6e 3d 30 3b 6e 3c 31 35 3b 6e 2b 2b 29 7b 76 61 72 20 69 3d 21 74 26 26 28 6f 3e 3e 6e 26 31 29 3d 3d 31 3b 6e 3c 36 3f 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 6e 5d 5b 38 5d 3d 69 3a 6e 3c 38 3f 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 6e 2b 31 5d 5b 38 5d 3d 69 3a 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 74 68 69 73 2e 6d 6f 64 75 6c 65 43 6f 75 6e 74 2d 31 35 2b 6e 5d 5b 38 5d 3d 69 7d 66 6f 72 28 76 61 72 20 6e 3d 30 3b 6e Data Ascii: ][Math.floor(r/3)]=o}},l.setupTypeInfo=function(t,e){for(var r=this.errorCorrectLevel<<3\|e,o=a.getBCHTypeInfo(r),n=0;n<15;n++){var i=!t&&(o>>n&1)==1;n<6?this.modules[n][8]=i:n<8?this.modules[n+1][8]=i:this.modules[this.moduleCount-15+n][8]=i}for(var n=0;n
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 74 68 29 2c 73 3d 41 72 72 61 79 28 65 2e 6c 65 6e 67 74 68 29 2c 6c 3d 30 3b 6c 3c 65 2e 6c 65 6e 67 74 68 3b 6c 2b 2b 29 7b 76 61 72 20 66 3d 65 5b 6c 5d 2e 64 61 74 61 43 6f 75 6e 74 2c 68 3d 65 5b 6c 5d 2e 74 6f 74 61 6c 43 6f 75 6e 74 2d 66 3b 6f 3d 4d 61 74 68 2e 6d 61 78 28 6f 2c 66 29 2c 6e 3d 4d 61 74 68 2e 6d 61 78 28 6e 2c 68 29 2c 69 5b 6c 5d 3d 41 72 72 61 79 28 66 29 3b 66 6f 72 28 76 61 72 20 67 3d 30 3b 67 3c 69 5b 6c 5d 2e 6c 65 6e 67 74 68 3b 67 2b 2b 29 69 5b 6c 5d 5b 67 5d 3d 32 35 35 26 74 2e 62 75 66 66 65 72 5b 67 2b 72 5d 3b 72 2b 3d 66 3b 76 61 72 20 63 3d 61 2e 67 65 74 45 72 72 6f 72 43 6f 72 72 65 63 74 50 6f 6c 79 6e 6f 6d 69 61 6c 28 68 29 2c 64 3d 6e 65 77 20 75 28 69 5b 6c 5d 2c 63 2e 67 65 74 4c 65 6e 67 74 68 28 29 2d 31 Data Ascii: th),s=Array(e.length),l=0;l<e.length;l++){var f=e[l].dataCount,h=e[l].totalCount-f;o=Math.max(o,f),n=Math.max(n,h),i[l]=Array(f);for(var g=0;g<i[l].length;g++)i[l][g]=255&t.buffer[g+r];r+=f;var c=a.getErrorCorrectPolynomial(h),d=new u(i[l],c.getLength()-1
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 32 31 5d 2c 5b 37 2c 34 32 2c 31 34 2c 34 2c 34 33 2c 31 35 5d 2c 5b 34 2c 31 33 33 2c 31 30 37 5d 2c 5b 38 2c 35 39 2c 33 37 2c 31 2c 36 30 2c 33 38 5d 2c 5b 38 2c 34 34 2c 32 30 2c 34 2c 34 35 2c 32 31 5d 2c 5b 31 32 2c 33 33 2c 31 31 2c 34 2c 33 34 2c 31 32 5d 2c 5b 33 2c 31 34 35 2c 31 31 35 2c 31 2c 31 34 36 2c 31 31 36 5d 2c 5b 34 2c 36 34 2c 34 30 2c 35 2c 36 35 2c 34 31 5d 2c 5b 31 31 2c 33 36 2c 31 36 2c 35 2c 33 37 2c 31 37 5d 2c 5b 31 31 2c 33 36 2c 31 32 2c 35 2c 33 37 2c 31 33 5d 2c 5b 35 2c 31 30 39 2c 38 37 2c 31 2c 31 31 30 2c 38 38 5d 2c 5b 35 2c 36 35 2c 34 31 2c 35 2c 36 36 2c 34 32 5d 2c 5b 35 2c 35 34 2c 32 34 2c 37 2c 35 35 2c 32 35 5d 2c 5b 31 31 2c 33 36 2c 31 32 5d 2c 5b 35 2c 31 32 32 2c 39 38 2c 31 2c 31 32 33 2c 39 39 5d 2c 5b Data Ascii: 21],[7,42,14,4,43,15],[4,133,107],[8,59,37,1,60,38],[8,44,20,4,45,21],[12,33,11,4,34,12],[3,145,115,1,146,116],[4,64,40,5,65,41],[11,36,16,5,37,17],[11,36,12,5,37,13],[5,109,87,1,110,88],[5,65,41,5,66,42],[5,54,24,7,55,25],[11,36,12],[5,122,98,1,123,99],[
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 35 34 2c 32 34 2c 32 35 2c 35 35 2c 32 35 5d 2c 5b 32 33 2c 34 35 2c 31 35 2c 32 35 2c 34 36 2c 31 36 5d 2c 5b 31 33 2c 31 34 35 2c 31 31 35 2c 33 2c 31 34 36 2c 31 31 36 5d 2c 5b 32 2c 37 34 2c 34 36 2c 32 39 2c 37 35 2c 34 37 5d 2c 5b 34 32 2c 35 34 2c 32 34 2c 31 2c 35 35 2c 32 35 5d 2c 5b 32 33 2c 34 35 2c 31 35 2c 32 38 2c 34 36 2c 31 36 5d 2c 5b 31 37 2c 31 34 35 2c 31 31 35 5d 2c 5b 31 30 2c 37 34 2c 34 36 2c 32 33 2c 37 35 2c 34 37 5d 2c 5b 31 30 2c 35 34 2c 32 34 2c 33 35 2c 35 35 2c 32 35 5d 2c 5b 31 39 2c 34 35 2c 31 35 2c 33 35 2c 34 36 2c 31 36 5d 2c 5b 31 37 2c 31 34 35 2c 31 31 35 2c 31 2c 31 34 36 2c 31 31 36 5d 2c 5b 31 34 2c 37 34 2c 34 36 2c 32 31 2c 37 35 2c 34 37 5d 2c 5b 32 39 2c 35 34 2c 32 34 2c 31 39 2c 35 35 2c 32 35 5d 2c 5b 31 Data Ascii: 54,24,25,55,25],[23,45,15,25,46,16],[13,145,115,3,146,116],[2,74,46,29,75,47],[42,54,24,1,55,25],[23,45,15,28,46,16],[17,145,115],[10,74,46,23,75,47],[10,54,24,35,55,25],[19,45,15,35,46,16],[17,145,115,1,146,116],[14,74,46,21,75,47],[29,54,24,19,55,25],[1
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 7b 67 6c 6f 67 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 74 3c 31 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 67 6c 6f 67 28 22 2b 74 2b 22 29 22 29 3b 72 65 74 75 72 6e 20 65 2e 4c 4f 47 5f 54 41 42 4c 45 5b 74 5d 7d 2c 67 65 78 70 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 3b 74 3c 30 3b 29 74 2b 3d 32 35 35 3b 66 6f 72 28 3b 74 3e 3d 32 35 36 3b 29 74 2d 3d 32 35 35 3b 72 65 74 75 72 6e 20 65 2e 45 58 50 5f 54 41 42 4c 45 5b 74 5d 7d 2c 45 58 50 5f 54 41 42 4c 45 3a 41 72 72 61 79 28 32 35 36 29 2c 4c 4f 47 5f 54 41 42 4c 45 3a 41 72 72 61 79 28 32 35 36 29 7d 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 65 2e 45 58 50 5f 54 41 42 4c 45 5b 72 5d 3d 31 3c 3c 72 3b 66 6f 72 28 76 61 72 20 72 3d 38 Data Ascii: ion(t){for(var e={glog:function(t){if(t<1)throw Error("glog("+t+")");return e.LOG_TABLE[t]},gexp:function(t){for(;t<0;)t+=255;for(;t>=256;)t-=255;return e.EXP_TABLE[t]},EXP_TABLE:Array(256),LOG_TABLE:Array(256)},r=0;r<8;r++)e.EXP_TABLE[r]=1<<r;for(var r=8
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 3c 3c 31 30 3b 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 65 29 2d 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 75 2e 47 31 35 29 3e 3d 30 3b 29 65 5e 3d 75 2e 47 31 35 3c 3c 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 65 29 2d 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 75 2e 47 31 35 29 3b 72 65 74 75 72 6e 28 74 3c 3c 31 30 7c 65 29 5e 75 2e 47 31 35 5f 4d 41 53 4b 7d 2c 67 65 74 42 43 48 54 79 70 65 4e 75 6d 62 65 72 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 3c 3c 31 32 3b 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 65 29 2d 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 75 2e 47 31 38 29 3e 3d 30 3b 29 65 5e 3d 75 2e 47 31 38 3c 3c 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 65 Data Ascii: ction(t){for(var e=t<<10;u.getBCHDigit(e)-u.getBCHDigit(u.G15)>=0;)e^=u.G15<<u.getBCHDigit(e)-u.getBCHDigit(u.G15);return(t<<10\|e)^u.G15_MASK},getBCHTypeNumber:function(t){for(var e=t<<12;u.getBCHDigit(e)-u.getBCHDigit(u.G18)>=0;)e^=u.G18<<u.getBCHDigit(e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.7	49854	162.159.138.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:45 UTC	673	OUT	GET /assets/ac625b77a0bab0ee72df.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:46 UTC	970	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:45 GMT Content-Type: application/javascript Content-Length: 3530 Connection: close CF-Ray: 8d782d74191f28b1-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "be6064ff8c1d480afb80fe48762a06c1" Last-Modified: Fri, 28 Jun 2024 00:43:11 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w8ub6LopK6AU6R%2BtnU2HVSF%2FZ6ZYsJEgfaAJiQeKqaE5Lz%2BokSFkgsPA19XoB07Ydzgeb3Cmb2Jnjf0apaOGHU7y0VIpdECetBcL2MOaQXrFpRQ%2BYTLGuwTxzo2V"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:46 UTC	399	IN	Data Raw: 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 7b 35 30 34 30 35 33 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 65 29 7b 65 2e 64 28 74 2c 7b 46 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 65 28 35 31 38 32 36 33 29 2c 65 28 39 37 30 31 37 33 29 2c 65 28 35 32 30 37 31 32 29 2c 65 28 32 36 38 31 31 31 29 2c 65 28 39 34 31 34 39 37 29 2c 65 28 33 32 30 32 36 29 2c 65 28 34 38 30 38 33 39 29 2c 65 28 37 34 34 32 38 35 29 2c 65 28 34 39 32 32 35 37 29 2c 65 28 38 37 33 38 31 37 29 2c 65 28 38 36 33 39 34 32 29 2c 65 28 36 34 32 35 34 39 29 2c 65 28 36 35 33 30 34 31 29 3b 76 61 72 20 6e 3d 65 28 37 38 38 39 30 30 29 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 72 29 7b 6c 65 74 20 74 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: (()=>{"use strict";var r={504053:function(r,t,e){e.d(t,{F:function(){return o}}),e(518263),e(970173),e(520712),e(268111),e(941497),e(32026),e(480839),e(744285),e(492257),e(873817),e(863942),e(642549),e(653041);var n=e(788900);function o(r){let t=function(
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 31 36 2c 6c 3d 72 5b 33 5d 7c 72 5b 34 5d 3c 3c 38 2c 73 3d 28 36 33 26 63 29 2f 36 33 2c 70 3d 28 63 3e 3e 36 26 36 33 29 2f 33 31 2e 35 2d 31 2c 64 3d 28 63 3e 3e 31 32 26 36 33 29 2f 33 31 2e 35 2d 31 2c 76 3d 63 3e 3e 32 33 2c 68 3d 6c 3e 3e 31 35 2c 62 3d 69 28 33 2c 68 3f 76 3f 35 3a 37 3a 37 26 6c 29 2c 67 3d 69 28 33 2c 68 3f 37 26 6c 3a 76 3f 35 3a 37 29 2c 79 3d 76 3f 28 31 35 26 72 5b 35 5d 29 2f 31 35 3a 31 2c 4f 3d 28 72 5b 35 5d 3e 3e 34 29 2f 31 35 2c 6d 3d 76 3f 36 3a 35 2c 77 3d 30 2c 78 3d 28 74 2c 65 2c 6e 29 3d 3e 7b 6c 65 74 20 6f 3d 5b 5d 3b 66 6f 72 28 6c 65 74 20 66 3d 30 3b 66 3c 65 3b 66 2b 2b 29 66 6f 72 28 6c 65 74 20 69 3d 66 3f 30 3a 31 3b 69 2a 65 3c 74 2a 28 65 2d 66 29 3b 69 2b 2b 29 6f 2e 70 75 73 68 28 28 28 72 5b 6d 2b Data Ascii: 16,l=r[3]\|r[4]<<8,s=(63&c)/63,p=(c>>6&63)/31.5-1,d=(c>>12&63)/31.5-1,v=c>>23,h=l>>15,b=i(3,h?v?5:7:7&l),g=i(3,h?7&l:v?5:7),y=v?(15&r[5])/15:1,O=(r[5]>>4)/15,m=v?6:5,w=0,x=(t,e,n)=>{let o=[];for(let f=0;f<e;f++)for(let i=f?0:1;ie<t(e-f);i++)o.push(((r[m+
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 72 20 6f 3d 74 5b 6e 5d 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 6f 29 72 65 74 75 72 6e 20 6f 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 66 3d 74 5b 6e 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 72 5b 6e 5d 2e 63 61 6c 6c 28 66 2e 65 78 70 6f 72 74 73 2c 66 2c 66 2e 65 78 70 6f 72 74 73 2c 65 29 2c 66 2e 65 78 70 6f 72 74 73 7d 65 2e 6d 3d 72 2c 65 2e 78 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 65 2e 4f 28 76 6f 69 64 20 30 2c 5b 22 37 38 31 38 37 22 2c 22 37 31 39 38 34 22 2c 22 34 33 32 32 32 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 28 22 31 37 31 37 31 36 22 29 7d 29 3b 72 65 74 75 72 6e 20 72 3d 65 2e 4f 28 72 29 7d 2c 65 2e 6e 3d 66 75 6e 63 74 69 6f 6e 28 72 29 7b 76 61 72 20 74 3d 72 26 26 72 Data Ascii: r o=t[n];if(void 0!==o)return o.exports;var f=t[n]={exports:{}};return r[n].call(f.exports,f,f.exports,e),f.exports}e.m=r,e.x=function(){var r=e.O(void 0,["78187","71984","43222"],function(){return e("171716")});return r=e.O(r)},e.n=function(r){var t=r&&r
2024-10-24 07:15:46 UTC	393	IN	Data Raw: 37 22 2c 22 37 31 39 38 34 22 2c 22 34 33 32 32 32 22 5d 2e 6d 61 70 28 65 2e 65 2c 65 29 29 2e 74 68 65 6e 28 72 29 7d 7d 29 28 29 2c 28 28 29 3d 3e 7b 76 61 72 20 72 3d 7b 37 37 34 35 39 3a 31 7d 3b 65 2e 66 2e 69 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 21 72 5b 74 5d 26 26 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 65 2e 70 2b 65 2e 75 28 74 29 29 7d 3b 76 61 72 20 74 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 2c 6e 3d 74 2e 70 75 73 68 2e 62 69 6e 64 28 74 29 3b 74 2e 70 75 73 68 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6f 3d 74 5b 30 5d 2c 66 3d 74 5b 31 5d 2c 69 3d 74 5b 32 5d 3b 66 6f 72 28 76 Data Ascii: 7","71984","43222"].map(e.e,e)).then(r)}})(),(()=>{var r={77459:1};e.f.i=function(t,n){!r[t]&&importScripts(e.p+e.u(t))};var t=this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[],n=t.push.bind(t);t.push=function(t){var o=t[0],f=t[1],i=t[2];for(v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.7	49853	162.159.138.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:45 UTC	673	OUT	GET /assets/29a63f12209c956d9204.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:46 UTC	970	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:45 GMT Content-Type: application/javascript Content-Length: 2750 Connection: close CF-Ray: 8d782d742afbe70e-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "390a7ab1f964aa8cb1b87dd13732c3bc" Last-Modified: Tue, 30 Jul 2024 22:07:30 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hnb3dHCol3mZJxD0vT24viyAsNZveHELblQBx%2BQvHzS%2BTRPkgo%2BgFKYUXTY3LnhQ89MRLlgZyr4OJfoMqrnCm3Lnz29efHQ11L%2BBFGUnq1AL07vrh0B68ZurO1CX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:46 UTC	399	IN	Data Raw: 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 7b 31 33 37 39 32 30 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 2c 69 3b 6e 2e 64 28 72 2c 7b 4a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 7d 2c 7a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 7d 7d 29 2c 28 69 3d 65 7c 7c 28 65 3d 7b 7d 29 29 5b 69 2e 4e 4f 4e 45 3d 30 5d 3d 22 4e 4f 4e 45 22 2c 69 5b 69 2e 53 4f 43 49 41 4c 3d 31 5d 3d 22 53 4f 43 49 41 4c 22 2c 69 5b 69 2e 43 41 53 55 41 4c 3d 32 5d 3d 22 43 41 53 55 41 4c 22 2c 69 5b 69 2e 43 4f 4d 50 45 54 49 54 49 56 45 3d 33 5d 3d 22 43 4f 4d 50 45 54 49 54 49 56 45 22 2c 69 5b 69 2e 43 52 45 41 54 49 56 45 3d 34 5d 3d 22 43 52 45 41 54 49 56 45 22 2c 69 5b 69 2e 56 45 Data Ascii: (()=>{"use strict";var t={137920:function(t,r,n){var e,i;n.d(r,{J:function(){return u},z:function(){return e}}),(i=e\|\|(e={}))[i.NONE=0]="NONE",i[i.SOCIAL=1]="SOCIAL",i[i.CASUAL=2]="CASUAL",i[i.COMPETITIVE=3]="COMPETITIVE",i[i.CREATIVE=4]="CREATIVE",i[i.VE
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 3b 76 61 72 20 65 3d 6e 28 31 33 37 39 32 30 29 3b 66 75 6e 63 74 69 6f 6e 20 69 28 74 2c 72 29 7b 6c 65 74 20 6e 3d 30 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 72 2e 67 61 6d 65 73 26 26 28 6e 2b 3d 32 2a 72 2e 67 61 6d 65 73 2e 66 69 6c 74 65 72 28 72 3d 3e 74 2e 67 61 6d 65 73 2e 69 6e 63 6c 75 64 65 73 28 72 29 29 2e 6c 65 6e 67 74 68 29 2c 6e 75 6c 6c 21 3d 72 2e 70 6c 61 79 73 74 79 6c 65 26 26 28 72 2e 70 6c 61 79 73 74 79 6c 65 3d 3d 3d 74 2e 70 6c 61 79 73 74 79 6c 65 3f 6e 2b 3d 32 3a 65 2e 4a 5b 74 2e 70 6c 61 79 73 74 79 6c 65 5d 3d 3d 3d 65 2e 4a 5b 72 2e 70 6c 61 79 73 74 79 6c 65 5d 26 26 28 6e 2b 3d 31 29 29 2c 6e 75 6c 6c 21 3d 72 2e 74 72 61 69 74 73 26 26 28 6e 2b 3d 32 Data Ascii: function(){return i}});var e=n(137920);function i(t,r){let n=0;return null!=r.games&&(n+=2*r.games.filter(r=>t.games.includes(r)).length),null!=r.playstyle&&(r.playstyle===t.playstyle?n+=2:e.J[t.playstyle]===e.J[r.playstyle]&&(n+=1)),null!=r.traits&&(n+=2
2024-10-24 07:15:46 UTC	982	IN	Data Raw: 73 3b 74 72 79 7b 72 65 74 75 72 6e 20 74 68 69 73 7c 7c 46 75 6e 63 74 69 6f 6e 28 22 72 65 74 75 72 6e 20 74 68 69 73 22 29 28 29 7d 63 61 74 63 68 28 74 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 29 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 7d 7d 28 29 2c 6e 2e 6f 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 72 29 7d 2c 28 28 29 3d 3e 7b 76 61 72 20 74 3d 5b 5d 3b 6e 2e 4f 3d 66 75 6e 63 74 69 6f 6e 28 72 2c 65 2c 69 2c 75 29 7b 69 66 28 65 29 7b 75 3d 75 7c 7c 30 3b 66 6f 72 28 76 61 72 20 6f 3d 74 2e 6c 65 6e 67 74 68 3b 6f 3e 30 26 26 74 5b 6f 2d 31 5d 5b 32 5d 3e 75 3b 6f 2d Data Ascii: s;try{return this\|\|Function("return this")()}catch(t){if("object"==typeof window)return window}}(),n.o=function(t,r){return Object.prototype.hasOwnProperty.call(t,r)},(()=>{var t=[];n.O=function(r,e,i,u){if(e){u=u\|\|0;for(var o=t.length;o>0&&t[o-1][2]>u;o-

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.7	49852	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:45 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:46 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:46 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: cbb0b495-901e-005b-56e4-212005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071546Z-16849878b7862vlcc7m66axrs000000007bg00000000aaa8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:46 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.7	49850	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:45 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:46 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:46 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 67bef8b6-101e-008d-2df2-2492e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071546Z-15b8d89586frzkk2umu6w8qnt80000000dy00000000037b4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:46 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.7	49851	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:45 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:46 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:46 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 9aa7f8dd-901e-0048-781b-24b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071546Z-r197bdfb6b4kq4j5t834fh90qn0000000ahg000000001spw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:46 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.7	49855	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:46 UTC	745	OUT	GET /assets/a6f6204cd40c3c5f5c14.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/assets/ac625b77a0bab0ee72df.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:46 UTC	969	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:46 GMT Content-Type: application/javascript Content-Length: 21811 Connection: close CF-Ray: 8d782d75dc6d3596-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "0fbb77d1b69f18df0fdcf836de1c4106" Last-Modified: Fri, 28 Jun 2024 00:43:11 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c%2BL%2FE4ZZ7hIbyYCMF%2BkPWXOhVjw7FBnMbvZMaKUhC7muKe8ygaQrkp6a8oTn1YyR7ejqGSw50peh6Ufetm6cnhGxG7I0eAcqSVO1cxT3EgsrJzMTJuXyQvsNQiHC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:46 UTC	400	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 37 31 39 38 34 22 5d 2c 7b 37 37 32 34 32 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 39 33 33 36 37 36 29 2c 6f 3d 6e 28 39 33 38 35 30 37 29 2c 69 3d 54 79 70 65 45 72 72 6f 72 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 65 28 74 29 29 72 65 74 75 72 6e 20 74 3b 74 68 72 6f 77 20 69 28 6f 28 74 29 2b 22 20 69 73 20 6e 6f 74 20 61 20 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 7d 7d 2c 36 30 33 35 32 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["71984"],{772425:function(t,r,n){var e=n(933676),o=n(938507),i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not a constructor")}},603528:function(t,r
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 41 72 72 61 79 42 75 66 66 65 72 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 44 61 74 61 56 69 65 77 7d 2c 31 39 32 32 39 31 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 2c 6f 2c 69 2c 75 3d 6e 28 32 31 32 30 33 36 29 2c 66 3d 6e 28 33 32 35 30 30 38 29 2c 61 3d 6e 28 31 36 31 35 38 31 29 2c 63 3d 6e 28 33 35 34 38 34 38 29 2c 73 3d 6e 28 36 32 32 32 38 31 29 2c 79 3d 6e 28 37 34 30 33 36 32 29 2c 70 3d 6e 28 39 37 34 39 37 31 29 2c 68 3d 6e 28 39 33 38 35 30 37 29 2c 76 3d 6e 28 32 35 31 30 36 39 29 2c 64 3d 6e 28 38 35 39 32 30 39 29 2c 67 3d 6e 28 34 33 34 30 29 2c 6c 3d 6e 28 38 33 38 39 35 37 29 2c 41 3d 6e 28 31 34 34 37 34 38 29 2c 77 3d 6e 28 32 37 36 33 32 31 29 2c Data Ascii: ned"!=typeof ArrayBuffer&&"undefined"!=typeof DataView},192291:function(t,r,n){var e,o,i,u=n(212036),f=n(325008),a=n(161581),c=n(354848),s=n(622281),y=n(740362),p=n(974971),h=n(938507),v=n(251069),d=n(859209),g=n(4340),l=n(838957),A=n(144748),w=n(276321),
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 28 74 29 29 72 65 74 75 72 6e 20 74 3b 74 68 72 6f 77 20 4c 28 22 54 61 72 67 65 74 20 69 73 20 6e 6f 74 20 61 20 74 79 70 65 64 20 61 72 72 61 79 22 29 7d 2c 61 54 79 70 65 64 41 72 72 61 79 43 6f 6e 73 74 72 75 63 74 6f 72 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 63 28 74 29 26 26 28 21 77 7c 7c 6c 28 46 2c 74 29 29 29 72 65 74 75 72 6e 20 74 3b 74 68 72 6f 77 20 4c 28 68 28 74 29 2b 22 20 69 73 20 6e 6f 74 20 61 20 74 79 70 65 64 20 61 72 72 61 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 7d 2c 65 78 70 6f 72 74 54 79 70 65 64 41 72 72 61 79 4d 65 74 68 6f 64 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 2c 65 29 7b 69 66 28 66 29 7b 69 66 28 6e 29 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 4e 29 7b 76 61 72 20 69 3d 61 5b 6f 5d 3b 69 66 28 69 26 26 Data Ascii: (t))return t;throw L("Target is not a typed array")},aTypedArrayConstructor:function(t){if(c(t)&&(!w\|\|l(F,t)))return t;throw L(h(t)+" is not a typed array constructor")},exportTypedArrayMethod:function(t,r,n,e){if(f){if(n)for(var o in N){var i=a[o];if(i&&
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 3e 38 26 32 35 35 5d 7d 2c 71 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 5b 32 35 35 26 74 2c 74 3e 3e 38 26 32 35 35 2c 74 3e 3e 31 36 26 32 35 35 2c 74 3e 3e 32 34 26 32 35 35 5d 7d 2c 48 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 5b 33 5d 3c 3c 32 34 7c 74 5b 32 5d 3c 3c 31 36 7c 74 5b 31 5d 3c 3c 38 7c 74 5b 30 5d 7d 2c 4a 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 44 28 74 2c 32 33 2c 34 29 7d 2c 51 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 44 28 74 2c 35 32 2c 38 29 7d 2c 58 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 63 28 74 5b 4d 5d 2c 72 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 28 74 68 69 Data Ascii: >8&255]},q=function(t){return[255&t,t>>8&255,t>>16&255,t>>24&255]},H=function(t){return t[3]<<24\|t[2]<<16\|t[1]<<8\|t[0]},J=function(t){return D(t,23,4)},Q=function(t){return D(t,52,8)},X=function(t,r,n){c(t[M],r,{configurable:!0,get:function(){return n(thi
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 20 30 3d 3d 3d 6e 3f 6f 2d 75 3a 76 28 6e 29 2c 75 2b 6e 3e 6f 29 74 68 72 6f 77 20 6a 28 22 57 72 6f 6e 67 20 6c 65 6e 67 74 68 22 29 3b 4c 28 74 68 69 73 2c 7b 74 79 70 65 3a 4f 2c 62 75 66 66 65 72 3a 74 2c 62 79 74 65 4c 65 6e 67 74 68 3a 6e 2c 62 79 74 65 4f 66 66 73 65 74 3a 75 2c 62 79 74 65 73 3a 65 2e 62 79 74 65 73 7d 29 2c 21 69 26 26 28 74 68 69 73 2e 62 75 66 66 65 72 3d 74 2c 74 68 69 73 2e 62 79 74 65 4c 65 6e 67 74 68 3d 6e 2c 74 68 69 73 2e 62 79 74 65 4f 66 66 73 65 74 3d 75 29 7d 29 5b 4d 5d 2c 69 26 26 28 58 28 43 2c 22 62 79 74 65 4c 65 6e 67 74 68 22 2c 55 29 2c 58 28 50 2c 22 62 75 66 66 65 72 22 2c 5f 29 2c 58 28 50 2c 22 62 79 74 65 4c 65 6e 67 74 68 22 2c 5f 29 2c 58 28 50 2c 22 62 79 74 65 4f 66 66 73 65 74 22 2c 5f 29 29 2c 73 Data Ascii: 0===n?o-u:v(n),u+n>o)throw j("Wrong length");L(this,{type:O,buffer:t,byteLength:n,byteOffset:u,bytes:e.bytes}),!i&&(this.buffer=t,this.byteLength=n,this.byteOffset=u)})[M],i&&(X(C,"byteLength",U),X(P,"buffer",_),X(P,"byteLength",_),X(P,"byteOffset",_)),s
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 73 2e 6c 65 6e 67 74 68 3e 32 26 26 61 72 67 75 6d 65 6e 74 73 5b 32 5d 29 7d 7d 29 3b 54 28 43 2c 6d 29 2c 54 28 50 2c 4f 29 2c 74 2e 65 78 70 6f 72 74 73 3d 7b 41 72 72 61 79 42 75 66 66 65 72 3a 43 2c 44 61 74 61 56 69 65 77 3a 50 7d 7d 2c 36 39 32 39 39 34 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 33 33 39 37 31 38 29 2c 6f 3d 6e 28 39 38 30 38 35 35 29 2c 69 3d 6e 28 34 39 36 39 33 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 72 3d 65 28 74 68 69 73 29 2c 6e 3d 69 28 72 29 2c 75 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 66 3d 6f 28 75 3e 31 3f 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3a 76 6f 69 64 20 30 2c 6e 29 2c 61 3d 75 3e 32 3f 61 72 67 75 6d 65 6e 74 73 Data Ascii: s.length>2&&arguments[2])}});T(C,m),T(P,O),t.exports={ArrayBuffer:C,DataView:P}},692994:function(t,r,n){var e=n(339718),o=n(980855),i=n(49693);t.exports=function(t){for(var r=e(this),n=i(r),u=arguments.length,f=o(u>1?arguments[1]:void 0,n),a=u>2?arguments
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 20 65 3d 6e 28 33 32 35 30 30 38 29 2c 6f 3d 6e 28 34 39 38 35 37 36 29 2c 69 3d 54 79 70 65 45 72 72 6f 72 2c 75 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 2c 66 3d 65 26 26 21 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 76 6f 69 64 20 30 21 3d 3d 74 68 69 73 29 72 65 74 75 72 6e 21 30 3b 74 72 79 7b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 5b 5d 2c 22 6c 65 6e 67 74 68 22 2c 7b 77 72 69 74 61 62 6c 65 3a 21 31 7d 29 2e 6c 65 6e 67 74 68 3d 31 7d 63 61 74 63 68 28 74 29 7b 72 65 74 75 72 6e 20 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 54 79 70 65 45 72 72 6f 72 7d 7d 28 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 3f 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 69 66 28 6f 28 74 29 26 26 21 Data Ascii: e=n(325008),o=n(498576),i=TypeError,u=Object.getOwnPropertyDescriptor,f=e&&!function(){if(void 0!==this)return!0;try{Object.defineProperty([],"length",{writable:!1}).length=1}catch(t){return t instanceof TypeError}}();t.exports=f?function(t,r){if(o(t)&&!
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 65 3d 6e 28 34 39 36 39 33 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 66 6f 72 28 76 61 72 20 6e 3d 65 28 74 29 2c 6f 3d 6e 65 77 20 72 28 6e 29 2c 69 3d 30 3b 69 3c 6e 3b 69 2b 2b 29 6f 5b 69 5d 3d 74 5b 6e 2d 69 2d 31 5d 3b 72 65 74 75 72 6e 20 6f 7d 7d 2c 37 31 37 34 34 31 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 34 39 36 39 33 29 2c 6f 3d 6e 28 39 35 39 33 31 38 29 2c 69 3d 52 61 6e 67 65 45 72 72 6f 72 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 2c 75 29 7b 76 61 72 20 66 3d 65 28 74 29 2c 61 3d 6f 28 6e 29 2c 63 3d 61 3c 30 3f 66 2b 61 3a 61 3b 69 66 28 63 3e 3d 66 7c 7c 63 3c 30 29 74 68 72 6f 77 20 69 28 22 49 6e 63 6f 72 72 65 63 74 20 69 6e 64 65 Data Ascii: e=n(49693);t.exports=function(t,r){for(var n=e(t),o=new r(n),i=0;i<n;i++)o[i]=t[n-i-1];return o}},717441:function(t,r,n){var e=n(49693),o=n(959318),i=RangeError;t.exports=function(t,r,n,u){var f=e(t),a=o(n),c=a<0?f+a:a;if(c>=f\|\|c<0)throw i("Incorrect inde
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 39 31 29 74 68 72 6f 77 20 72 28 22 4d 61 78 69 6d 75 6d 20 61 6c 6c 6f 77 65 64 20 69 6e 64 65 78 20 65 78 63 65 65 64 65 64 22 29 3b 72 65 74 75 72 6e 20 74 7d 7d 2c 36 37 39 36 32 32 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 36 32 36 35 34 34 29 2e 6d 61 74 63 68 28 2f 66 69 72 65 66 6f 78 5c 2f 28 5c 64 2b 29 2f 69 29 3b 74 2e 65 78 70 6f 72 74 73 3d 21 21 65 26 26 2b 65 5b 31 5d 7d 2c 33 31 30 37 33 31 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 36 32 36 35 34 34 29 3b 74 2e 65 78 70 6f 72 74 73 3d 2f 4d 53 49 45 7c 54 72 69 64 65 6e 74 2f 2e 74 65 73 74 28 65 29 7d 2c 33 36 31 32 37 30 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 36 32 36 35 34 34 29 2e 6d Data Ascii: 91)throw r("Maximum allowed index exceeded");return t}},679622:function(t,r,n){var e=n(626544).match(/firefox\/(\d+)/i);t.exports=!!e&&+e[1]},310731:function(t,r,n){var e=n(626544);t.exports=/MSIE\|Trident/.test(e)},361270:function(t,r,n){var e=n(626544).m
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 2e 35 3d 3d 3d 6e 26 26 72 25 32 21 3d 30 3f 72 2b 65 28 74 29 3a 72 7d 3b 74 2e 65 78 70 6f 72 74 73 3d 7b 70 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 2c 6f 2c 70 2c 68 3d 69 28 6e 29 2c 76 3d 38 2a 6e 2d 72 2d 31 2c 64 3d 28 31 3c 3c 76 29 2d 31 2c 67 3d 64 3e 3e 31 2c 6c 3d 32 33 3d 3d 3d 72 3f 66 28 32 2c 2d 32 34 29 2d 66 28 32 2c 2d 37 37 29 3a 30 2c 41 3d 74 3c 30 7c 7c 30 3d 3d 3d 74 26 26 31 2f 74 3c 30 3f 31 3a 30 2c 77 3d 30 3b 66 6f 72 28 28 74 3d 75 28 74 29 29 21 3d 74 7c 7c 74 3d 3d 3d 31 2f 30 3f 28 6f 3d 74 21 3d 74 3f 31 3a 30 2c 65 3d 64 29 3a 28 70 3d 66 28 32 2c 2d 28 65 3d 61 28 63 28 74 29 2f 73 29 29 29 2c 74 2a 70 3c 31 26 26 28 65 2d 2d 2c 70 2a 3d 32 29 2c 65 2b 67 3e 3d 31 3f 74 2b 3d 6c 2f 70 Data Ascii: .5===n&&r%2!=0?r+e(t):r};t.exports={pack:function(t,r,n){var e,o,p,h=i(n),v=8n-r-1,d=(1<<v)-1,g=d>>1,l=23===r?f(2,-24)-f(2,-77):0,A=t<0\|\|0===t&&1/t<0?1:0,w=0;for((t=u(t))!=t\|\|t===1/0?(o=t!=t?1:0,e=d):(p=f(2,-(e=a(c(t)/s))),tp<1&&(e--,p*=2),e+g>=1?t+=l/p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.7	49856	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:46 UTC	868	OUT	GET /assets/d67c5e680608266a1f63.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:46 UTC	964	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:46 GMT Content-Type: application/javascript Content-Length: 7728 Connection: close CF-Ray: 8d782d76eba4476a-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "1c6b9d0ad743762986197ae0e81874c1" Last-Modified: Fri, 28 Jun 2024 00:43:11 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FMIkmLINbBf2RYaeDXDb0IRUZMzCxvHUrinGVNaSaZYtSzdtB9Gqd6fMUR35lZr9x3nmZYbM6WErLTvaYKIzqXcT55qyliVTd4KFL%2Bl1BjIOesrKQlwY2iZjFI48"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 37 35 34 39 32 22 5d 2c 7b 38 34 39 31 34 36 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 4d 61 70 29 72 65 74 75 72 6e 20 4d 61 70 3b 66 75 6e 63 74 69 6f 6e 20 74 28 74 2c 65 29 7b 76 61 72 20 6e 3d 2d 31 3b 72 65 74 75 72 6e 20 74 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 72 65 74 75 72 6e 20 74 5b 30 5d 3d 3d 3d 65 26 26 28 6e 3d 72 2c 21 30 29 7d 29 2c 6e 7d Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["75492"],{849146:function(t,e,n){var r=function(){if("undefined"!=typeof Map)return Map;function t(t,e){var n=-1;return t.some(function(t,r){return t[0]===e&&(n=r,!0)}),n}
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 29 29 7d 2c 31 65 33 2f 36 30 29 7d 2c 63 3d 5b 22 74 6f 70 22 2c 22 72 69 67 68 74 22 2c 22 62 6f 74 74 6f 6d 22 2c 22 6c 65 66 74 22 2c 22 77 69 64 74 68 22 2c 22 68 65 69 67 68 74 22 2c 22 73 69 7a 65 22 2c 22 77 65 69 67 68 74 22 5d 2c 61 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 4d 75 74 61 74 69 6f 6e 4f 62 73 65 72 76 65 72 2c 68 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 74 68 69 73 2e 63 6f 6e 6e 65 63 74 65 64 5f 3d 21 31 2c 74 68 69 73 2e 6d 75 74 61 74 69 6f 6e 45 76 65 6e 74 73 41 64 64 65 64 5f 3d 21 31 2c 74 68 69 73 2e 6d 75 74 61 74 69 6f 6e 73 4f 62 73 65 72 76 65 72 5f 3d 6e 75 6c 6c 2c 74 68 69 73 2e 6f 62 73 65 72 76 65 72 73 5f 3d 5b 5d 2c 74 68 69 73 2e 6f 6e 54 72 61 6e 73 69 74 Data Ascii: ))},1e3/60)},c=["top","right","bottom","left","width","height","size","weight"],a="undefined"!=typeof MutationObserver,h=function(){function t(){this.connected_=!1,this.mutationEventsAdded_=!1,this.mutationsObserver_=null,this.observers_=[],this.onTransit
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 72 44 61 74 61 3a 21 30 2c 73 75 62 74 72 65 65 3a 21 30 7d 29 29 3a 28 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 53 75 62 74 72 65 65 4d 6f 64 69 66 69 65 64 22 2c 74 68 69 73 2e 72 65 66 72 65 73 68 29 2c 74 68 69 73 2e 6d 75 74 61 74 69 6f 6e 45 76 65 6e 74 73 41 64 64 65 64 5f 3d 21 30 29 2c 74 68 69 73 2e 63 6f 6e 6e 65 63 74 65 64 5f 3d 21 30 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 64 69 73 63 6f 6e 6e 65 63 74 5f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 21 69 26 26 21 21 74 68 69 73 2e 63 6f 6e 6e 65 63 74 65 64 5f 29 64 6f 63 75 6d 65 6e 74 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 74 72 61 6e 73 69 74 69 6f 6e 65 6e 64 22 2c 74 68 69 73 2e 6f 6e 54 72 61 6e 73 69 74 Data Ascii: rData:!0,subtree:!0})):(document.addEventListener("DOMSubtreeModified",this.refresh),this.mutationEventsAdded_=!0),this.connected_=!0},t.prototype.disconnect_=function(){if(!!i&&!!this.connected_)document.removeEventListener("transitionend",this.onTransit
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 6c 65 6d 65 6e 74 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 42 42 6f 78 7d 3b 66 75 6e 63 74 69 6f 6e 20 6c 28 74 2c 65 2c 6e 2c 72 29 7b 72 65 74 75 72 6e 7b 78 3a 74 2c 79 3a 65 2c 77 69 64 74 68 3a 6e 2c 68 65 69 67 68 74 3a 72 7d 7d 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 74 29 7b 74 68 69 73 2e 62 72 6f 61 64 63 61 73 74 57 69 64 74 68 3d 30 2c 74 68 69 73 2e 62 72 6f 61 64 63 61 73 74 48 65 69 67 68 74 3d 30 2c 74 68 69 73 2e 63 6f 6e 74 65 6e 74 52 65 63 74 5f 3d 6c 28 30 2c 30 2c 30 2c 30 29 2c 74 68 69 73 2e 74 61 72 67 65 74 3d 74 7d 72 65 74 75 72 6e 20 74 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 41 63 74 69 76 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d Data Ascii: lement&&"function"==typeof t.getBBox};function l(t,e,n,r){return{x:t,y:e,width:n,height:r}}var b=function(){function t(t){this.broadcastWidth=0,this.broadcastHeight=0,this.contentRect_=l(0,0,0,0),this.target=t}return t.prototype.isActive=function(){var t=
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 6f 2c 68 65 69 67 68 74 3a 73 2c 74 6f 70 3a 69 2c 72 69 67 68 74 3a 72 2b 6f 2c 62 6f 74 74 6f 6d 3a 73 2b 69 2c 6c 65 66 74 3a 72 7d 29 2c 63 29 3b 75 28 74 68 69 73 2c 7b 74 61 72 67 65 74 3a 74 2c 63 6f 6e 74 65 6e 74 52 65 63 74 3a 61 7d 29 7d 2c 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 74 2c 65 2c 6e 29 7b 69 66 28 74 68 69 73 2e 61 63 74 69 76 65 4f 62 73 65 72 76 61 74 69 6f 6e 73 5f 3d 5b 5d 2c 74 68 69 73 2e 6f 62 73 65 72 76 61 74 69 6f 6e 73 5f 3d 6e 65 77 20 72 2c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 74 29 74 68 72 6f 77 20 54 79 70 65 45 72 72 6f 72 28 22 54 68 65 20 63 61 6c 6c 62 61 63 6b 20 70 72 6f 76 69 64 65 64 20 61 73 20 70 61 72 61 6d 65 74 65 72 20 31 20 69 73 20 6e 6f 74 20 61 20 Data Ascii: o,height:s,top:i,right:r+o,bottom:s+i,left:r}),c);u(this,{target:t,contentRect:a})},y=function(){function t(t,e,n){if(this.activeObservations_=[],this.observations_=new r,"function"!=typeof t)throw TypeError("The callback provided as parameter 1 is not a
2024-10-24 07:15:46 UTC	883	IN	Data Raw: 79 70 65 2e 62 72 6f 61 64 63 61 73 74 41 63 74 69 76 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 21 74 68 69 73 2e 68 61 73 41 63 74 69 76 65 28 29 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 63 61 6c 6c 62 61 63 6b 43 74 78 5f 2c 65 3d 74 68 69 73 2e 61 63 74 69 76 65 4f 62 73 65 72 76 61 74 69 6f 6e 73 5f 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 6d 28 74 2e 74 61 72 67 65 74 2c 74 2e 62 72 6f 61 64 63 61 73 74 52 65 63 74 28 29 29 7d 29 3b 74 68 69 73 2e 63 61 6c 6c 62 61 63 6b 5f 2e 63 61 6c 6c 28 74 2c 65 2c 74 29 2c 74 68 69 73 2e 63 6c 65 61 72 41 63 74 69 76 65 28 29 7d 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 41 63 74 69 76 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 61 63 74 Data Ascii: ype.broadcastActive=function(){if(!!this.hasActive()){var t=this.callbackCtx_,e=this.activeObservations_.map(function(t){return new m(t.target,t.broadcastRect())});this.callback_.call(t,e,t),this.clearActive()}},t.prototype.clearActive=function(){this.act

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.7	49857	162.159.138.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:46 UTC	689	OUT	GET /api/v9/experiments?with_guild_experiments=true HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:46 UTC	780	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:46 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=31536000; includeSubDomains; preload vary: Accept-Encoding via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: BYPASS Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xwRDKTk%2FbLuxTuozg%2B3aYE%2FP52pr8vhk9SGW9rnKJgJy3AToZ%2FIRpamZB%2Fe41%2FQE5HP5XeWMBBbTXS0iryfDnPVZ262HG%2FQ4dgPfaUM8G8ZbUXA%2FxPgChB6iVL6z"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Server: cloudflare CF-RAY: 8d782d76fe044620-DFW
2024-10-24 07:15:46 UTC	589	IN	Data Raw: 37 30 63 30 0d 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 31 32 39 38 39 30 37 37 37 36 36 33 34 30 36 34 39 39 36 2e 63 68 49 72 2d 4c 69 6a 69 47 56 63 68 2d 7a 67 46 6e 7a 73 43 4b 55 47 53 65 51 22 2c 22 61 73 73 69 67 6e 6d 65 6e 74 73 22 3a 5b 5b 32 38 31 30 32 30 35 34 38 37 2c 31 2c 31 2c 2d 31 2c 33 2c 33 36 30 30 2c 30 2c 30 5d 2c 5b 32 36 31 37 32 31 38 34 34 34 2c 34 2c 31 2c 2d 31 2c 32 2c 36 35 32 34 2c 30 2c 30 5d 2c 5b 33 30 33 35 36 37 34 37 36 37 2c 30 2c 31 2c 2d 31 2c 30 2c 35 38 39 36 2c 30 2c 30 5d 2c 5b 31 36 30 39 37 38 32 31 35 31 2c 30 2c 31 2c 2d 31 2c 32 2c 31 38 30 35 2c 30 2c 30 5d 2c 5b 33 36 34 33 33 36 32 37 35 31 2c 30 2c 31 2c 2d 31 2c 30 2c 36 36 32 36 2c 30 2c 30 5d 2c 5b 33 37 35 33 30 33 34 34 36 36 2c 31 2c Data Ascii: 70c0{"fingerprint":"1298907776634064996.chIr-LijiGVch-zgFnzsCKUGSeQ","assignments":[[2810205487,1,1,-1,3,3600,0,0],[2617218444,4,1,-1,2,6524,0,0],[3035674767,0,1,-1,0,5896,0,0],[1609782151,0,1,-1,2,1805,0,0],[3643362751,0,1,-1,0,6626,0,0],[3753034466,1,
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 33 33 2c 34 2c 31 2c 2d 31 2c 30 2c 39 34 37 33 2c 30 2c 30 5d 2c 5b 32 34 39 31 30 30 35 30 31 39 2c 34 2c 31 2c 2d 31 2c 30 2c 36 38 32 37 2c 30 2c 30 5d 2c 5b 33 38 38 39 30 37 37 38 30 34 2c 32 2c 31 2c 2d 31 2c 30 2c 32 38 31 36 2c 30 2c 30 5d 2c 5b 34 30 37 39 32 31 34 33 31 39 2c 32 2c 31 2c 2d 31 2c 30 2c 35 31 30 31 2c 30 2c 30 5d 2c 5b 31 30 33 34 36 36 31 33 30 36 2c 30 2c 31 2c 2d 31 2c 30 2c 32 39 39 30 2c 30 2c 30 5d 2c 5b 38 32 38 32 35 31 37 31 30 2c 32 2c 31 2c 2d 31 2c 31 2c 32 35 31 30 2c 30 2c 30 5d 2c 5b 33 31 32 34 30 30 33 33 31 36 2c 31 2c 31 2c 2d 31 2c 30 2c 33 35 35 33 2c 30 2c 30 5d 2c 5b 32 36 37 36 33 34 38 35 30 36 2c 30 2c 31 2c 2d 31 2c 30 2c 34 31 30 38 2c 30 2c 30 5d 2c 5b 34 31 33 36 35 37 34 38 30 32 2c 30 2c 31 2c 2d Data Ascii: 33,4,1,-1,0,9473,0,0],[2491005019,4,1,-1,0,6827,0,0],[3889077804,2,1,-1,0,2816,0,0],[4079214319,2,1,-1,0,5101,0,0],[1034661306,0,1,-1,0,2990,0,0],[828251710,2,1,-1,1,2510,0,0],[3124003316,1,1,-1,0,3553,0,0],[2676348506,0,1,-1,0,4108,0,0],[4136574802,0,1,-
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 5d 2c 5b 31 38 38 34 34 32 36 34 37 31 2c 30 2c 31 2c 2d 31 2c 30 2c 36 34 33 37 2c 30 2c 30 5d 2c 5b 33 32 30 35 30 32 37 35 35 36 2c 30 2c 31 2c 2d 31 2c 32 2c 32 33 34 37 2c 30 2c 30 5d 2c 5b 32 37 39 31 38 32 37 32 36 33 2c 32 2c 31 2c 2d 31 2c 30 2c 34 32 31 36 2c 30 2c 30 5d 2c 5b 38 36 38 30 38 38 35 34 35 2c 30 2c 31 2c 2d 31 2c 30 2c 31 32 39 38 2c 30 2c 30 5d 2c 5b 31 37 39 34 38 30 31 38 39 31 2c 30 2c 35 2c 2d 31 2c 30 2c 37 30 32 32 2c 30 2c 30 5d 2c 5b 33 33 38 32 30 33 36 36 39 36 2c 33 2c 35 2c 2d 31 2c 34 2c 34 34 35 37 2c 30 2c 30 5d 2c 5b 31 33 32 30 30 37 36 37 35 33 2c 30 2c 31 2c 2d 31 2c 30 2c 32 39 33 37 2c 30 2c 30 5d 2c 5b 38 32 35 36 31 38 32 30 38 2c 30 2c 31 2c 2d 31 2c 30 2c 31 31 35 32 2c 30 2c 31 5d 2c 5b 32 31 38 30 33 37 Data Ascii: ],[1884426471,0,1,-1,0,6437,0,0],[3205027556,0,1,-1,2,2347,0,0],[2791827263,2,1,-1,0,4216,0,0],[868088545,0,1,-1,0,1298,0,0],[1794801891,0,5,-1,0,7022,0,0],[3382036696,3,5,-1,4,4457,0,0],[1320076753,0,1,-1,0,2937,0,0],[825618208,0,1,-1,0,1152,0,1],[218037
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 2c 33 34 36 33 2c 30 2c 30 5d 2c 5b 32 34 38 37 38 32 33 37 34 32 2c 35 2c 31 2c 2d 31 2c 30 2c 37 31 38 2c 30 2c 30 5d 2c 5b 32 37 32 36 37 38 39 30 39 30 2c 30 2c 31 2c 2d 31 2c 30 2c 39 38 36 38 2c 30 2c 30 5d 2c 5b 38 37 38 30 34 30 30 34 34 2c 31 2c 31 2c 2d 31 2c 30 2c 35 31 32 36 2c 30 2c 31 5d 2c 5b 31 36 35 38 33 32 34 33 33 39 2c 32 2c 31 2c 2d 31 2c 30 2c 37 37 38 34 2c 30 2c 30 5d 2c 5b 31 36 33 33 32 38 39 31 32 34 2c 30 2c 31 2c 2d 31 2c 32 2c 31 39 31 31 2c 30 2c 30 5d 2c 5b 31 37 30 35 36 37 31 32 32 35 2c 30 2c 31 2c 2d 31 2c 30 2c 38 35 35 37 2c 30 2c 30 5d 2c 5b 34 37 34 31 35 39 36 31 36 2c 31 2c 31 2c 2d 31 2c 30 2c 34 31 37 2c 30 2c 30 5d 2c 5b 32 35 35 38 39 39 30 30 32 38 2c 30 2c 31 2c 2d 31 2c 30 2c 37 34 39 2c 30 2c 30 5d 2c 5b Data Ascii: ,3463,0,0],[2487823742,5,1,-1,0,718,0,0],[2726789090,0,1,-1,0,9868,0,0],[878040044,1,1,-1,0,5126,0,1],[1658324339,2,1,-1,0,7784,0,0],[1633289124,0,1,-1,2,1911,0,0],[1705671225,0,1,-1,0,8557,0,0],[474159616,1,1,-1,0,417,0,0],[2558990028,0,1,-1,0,749,0,0],[
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 2c 2d 31 2c 30 2c 31 33 31 31 2c 30 2c 31 5d 2c 5b 31 36 32 34 35 37 37 38 39 33 2c 30 2c 31 2c 2d 31 2c 30 2c 34 36 38 32 2c 30 2c 30 5d 5d 2c 22 67 75 69 6c 64 5f 65 78 70 65 72 69 6d 65 6e 74 73 22 3a 5b 5b 31 34 30 35 38 33 31 39 35 35 2c 22 32 30 32 31 2d 30 36 5f 67 75 69 6c 64 5f 72 6f 6c 65 5f 73 75 62 73 63 72 69 70 74 69 6f 6e 73 22 2c 30 2c 5b 5b 5b 5b 2d 31 2c 5b 7b 22 73 22 3a 37 32 30 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 2c 5b 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 34 37 35 30 7d 2c 7b 22 73 22 3a 34 37 35 30 2c 22 65 22 3a 35 32 30 30 7d 2c 7b 22 73 22 3a 35 32 30 30 2c 22 65 22 3a 35 37 30 30 7d 2c 7b 22 73 22 3a 35 37 30 30 2c 22 65 22 3a 36 32 30 30 7d 2c 7b 22 73 22 3a 36 32 30 30 2c 22 65 22 3a 37 32 30 30 7d 5d 5d 5d 2c 5b 5b Data Ascii: ,-1,0,1311,0,1],[1624577893,0,1,-1,0,4682,0,0]],"guild_experiments":[[1405831955,"2021-06_guild_role_subscriptions",0,[[[[-1,[{"s":7200,"e":10000}]],[1,[{"s":0,"e":4750},{"s":4750,"e":5200},{"s":5200,"e":5700},{"s":5700,"e":6200},{"s":6200,"e":7200}]]],[[
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 5f 54 52 49 41 4c 53 22 5d 5d 5d 5d 5d 5d 5d 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 30 5d 2c 5b 33 38 33 32 31 31 33 32 30 32 2c 6e 75 6c 6c 2c 34 2c 5b 5b 5b 5b 2d 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5d 5d 5d 2c 5b 7b 22 62 22 3a 30 2c 22 6b 22 3a 5b 22 38 31 34 36 36 39 36 30 34 38 34 30 30 31 33 38 37 34 22 5d 7d 2c 7b 22 62 22 3a 32 2c 22 6b 22 3a 5b 22 31 30 36 34 39 35 39 35 36 30 38 39 30 32 30 34 32 37 31 22 5d 7d 5d 2c 5b 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 30 5d 2c 5b 31 34 31 32 33 33 37 39 39 30 2c 6e 75 6c 6c 2c 30 2c 5b 5b 5b 5b 2d 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5d 5d 5d 2c 5b 7b 22 62 22 3a 31 2c 22 6b 22 3a 5b 22 37 39 39 33 34 39 33 35 38 37 37 36 Data Ascii: _TRIALS"]]]]]]]],null,null,0,0],[3832113202,null,4,[[[[-1,[{"s":0,"e":10000}]]],[]]],[{"b":0,"k":["814669604840013874"]},{"b":2,"k":["1064959560890204271"]}],[],null,null,0,0],[1412337990,null,0,[[[[-1,[{"s":0,"e":10000}]]],[]]],[{"b":1,"k":["799349358776
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 38 34 32 22 5d 7d 5d 2c 5b 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 30 5d 2c 5b 33 36 38 33 30 36 33 36 34 39 2c 6e 75 6c 6c 2c 30 2c 5b 5b 5b 5b 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5b 31 36 30 34 36 31 32 30 34 35 2c 5b 5b 31 31 38 33 32 35 31 32 34 38 2c 5b 22 50 41 52 54 4e 45 52 45 44 22 5d 5d 5d 5d 5d 5d 2c 5b 5b 5b 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5b 31 36 30 34 36 31 32 30 34 35 2c 5b 5b 31 31 38 33 32 35 31 32 34 38 2c 5b 22 43 4f 4d 4d 55 4e 49 54 59 22 5d 5d 5d 5d 5d 5d 5d 2c 5b 7b 22 62 22 3a 31 2c 22 6b 22 3a 5b 22 37 36 33 38 33 38 34 37 39 32 39 33 33 34 39 38 39 39 22 2c 22 36 35 31 35 39 37 35 31 34 34 30 37 30 31 38 35 31 36 22 2c 22 38 39 37 31 36 32 30 39 Data Ascii: 842"]}],[],null,null,0,0],[3683063649,null,0,[[[[1,[{"s":0,"e":10000}]]],[[1604612045,[[1183251248,["PARTNERED"]]]]]],[[[1,[{"s":0,"e":10000}]]],[[1604612045,[[1183251248,["COMMUNITY"]]]]]]],[{"b":1,"k":["763838479293349899","651597514407018516","89716209
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 73 22 3a 36 30 30 30 2c 22 65 22 3a 38 30 30 30 7d 5d 5d 5d 2c 5b 5b 31 36 30 34 36 31 32 30 34 35 2c 5b 5b 31 31 38 33 32 35 31 32 34 38 2c 5b 22 43 4f 4d 4d 55 4e 49 54 59 5f 45 58 50 5f 4c 41 52 47 45 5f 47 41 54 45 44 22 5d 5d 5d 5d 5d 5d 5d 2c 5b 5d 2c 5b 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 30 5d 2c 5b 31 34 34 33 38 37 36 30 34 35 2c 6e 75 6c 6c 2c 30 2c 5b 5b 5b 5b 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5d 5d 5d 2c 5b 7b 22 62 22 3a 31 2c 22 6b 22 3a 5b 22 39 35 39 35 34 34 39 31 36 38 34 38 30 32 39 37 31 36 22 2c 22 39 36 36 30 39 35 30 30 33 31 33 36 39 38 33 31 32 31 22 2c 22 39 36 38 32 33 32 30 34 33 37 31 34 35 38 38 37 30 33 22 2c 22 39 35 39 31 39 35 36 35 34 38 31 33 35 33 32 32 30 32 22 2c 22 39 Data Ascii: s":6000,"e":8000}]]],[[1604612045,[[1183251248,["COMMUNITY_EXP_LARGE_GATED"]]]]]]],[],[],null,null,0,0],[1443876045,null,0,[[[[1,[{"s":0,"e":10000}]]],[]]],[{"b":1,"k":["959544916848029716","966095003136983121","968232043714588703","959195654813532202","9
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 30 2c 5b 5b 5b 5b 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5b 32 32 39 34 38 38 38 39 34 33 2c 5b 5b 32 36 39 30 37 35 32 31 35 36 2c 39 38 37 38 38 34 39 32 37 5d 2c 5b 31 39 38 32 38 30 34 31 32 31 2c 31 30 30 30 30 5d 5d 5d 5d 5d 2c 5b 5b 5b 2d 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5d 5d 5d 2c 5b 5d 2c 5b 5b 5b 5b 5b 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5b 31 36 30 34 36 31 32 30 34 35 2c 5b 5b 31 31 38 33 32 35 31 32 34 38 2c 5b 22 49 4e 54 45 52 4e 41 4c 5f 45 4d 50 4c 4f 59 45 45 5f 4f 4e 4c 59 22 5d 5d 5d 5d 5d 5d 5d 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 30 5d 2c 5b 32 34 36 32 32 31 36 37 38 35 2c 6e 75 6c 6c 2c 30 2c 5b 5b 5b 5b 2d 31 Data Ascii: 0,[[[[1,[{"s":0,"e":10000}]]],[[2294888943,[[2690752156,987884927],[1982804121,10000]]]]],[[[-1,[{"s":0,"e":10000}]]],[]]],[],[[[[[1,[{"s":0,"e":10000}]]],[[1604612045,[[1183251248,["INTERNAL_EMPLOYEE_ONLY"]]]]]]]],null,null,0,0],[2462216785,null,0,[[[[-1
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 37 36 22 2c 22 31 30 33 39 39 34 30 37 36 35 37 35 30 36 36 35 32 32 36 22 5d 7d 5d 2c 5b 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 30 5d 2c 5b 32 38 30 38 36 36 36 36 30 2c 6e 75 6c 6c 2c 30 2c 5b 5b 5b 5b 2d 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5b 31 36 30 34 36 31 32 30 34 35 2c 5b 5b 31 31 38 33 32 35 31 32 34 38 2c 5b 22 49 4e 54 45 52 4e 41 4c 5f 45 4d 50 4c 4f 59 45 45 5f 4f 4e 4c 59 22 5d 5d 5d 5d 5d 5d 2c 5b 5b 5b 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5b 31 36 30 34 36 31 32 30 34 35 2c 5b 5b 31 31 38 33 32 35 31 32 34 38 2c 5b 22 53 48 41 52 45 44 5f 43 41 4e 56 41 53 5f 46 52 49 45 4e 44 53 5f 41 4e 44 5f 46 41 4d 49 4c 59 5f 54 45 53 54 22 5d 5d 5d 5d 5d 5d 5d 2c 5b 7b Data Ascii: 76","1039940765750665226"]}],[],null,null,0,0],[280866660,null,0,[[[[-1,[{"s":0,"e":10000}]]],[[1604612045,[[1183251248,["INTERNAL_EMPLOYEE_ONLY"]]]]]],[[[1,[{"s":0,"e":10000}]]],[[1604612045,[[1183251248,["SHARED_CANVAS_FRIENDS_AND_FAMILY_TEST"]]]]]]],[{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.7	49858	162.159.138.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:46 UTC	673	OUT	GET /assets/55ad931ed92a15c15709.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:46 UTC	963	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:46 GMT Content-Type: text/javascript Content-Length: 109613 Connection: close CF-Ray: 8d782d770bba2c98-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "80f500d4d0495e5c74e9b92cbc26f088" Last-Modified: Tue, 15 Oct 2024 21:49:59 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U9df%2BzW2PMBR6kc9EjuKk77bDpkntjpUfKhy3p1mRkFb%2FEoTnJZ0lNvEp4C59BIJbkaQGAtmMea0ksLq6daakPc0mTt5720cCzUX8dEgFRZfyFck%2BbMnfMID5WR6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 36 33 32 38 38 22 5d 2c 7b 34 37 33 34 35 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 3d 65 2e 6c 65 6e 67 74 68 2c 6f 3d 6e 5e 6e 2c 72 3d 30 3b 6e 3e 3d 34 3b 29 74 3d 28 36 35 35 33 35 26 28 74 3d 32 35 35 26 65 2e 63 68 61 72 43 6f 64 65 41 74 28 72 29 7c 28 32 35 35 26 65 2e 63 68 61 72 43 6f 64 65 41 74 28 2b 2b 72 29 29 3c 3c 38 7c 28 32 35 35 26 65 2e 63 68 61 72 43 6f 64 65 41 74 28 2b 2b 72 29 29 3c 3c 31 36 7c Data Ascii: (this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["63288"],{473452:function(e,t){"use strict";t.Z=function(e){for(var t,n=e.length,o=n^n,r=0;n>=4;)t=(65535&(t=255&e.charCodeAt(r)\|(255&e.charCodeAt(++r))<<8\|(255&e.charCodeAt(++r))<<16\|
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 69 66 28 30 3c 31 2a 6e 26 26 30 3c 74 2e 69 6e 64 65 78 4f 66 28 22 5c 66 22 29 29 72 65 74 75 72 6e 20 74 2e 72 65 70 6c 61 63 65 28 6d 2c 28 35 38 3d 3d 3d 65 2e 63 68 61 72 43 6f 64 65 41 74 28 30 29 3f 22 22 3a 22 24 31 22 29 2b 65 2e 74 72 69 6d 28 29 29 7d 72 65 74 75 72 6e 20 65 2b 74 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 65 2c 74 2c 6e 2c 69 29 7b 76 61 72 20 61 3d 65 2b 22 3b 22 2c 75 3d 32 2a 74 2b 33 2a 6e 2b 34 2a 69 3b 69 66 28 39 34 34 3d 3d 3d 75 29 7b 65 3d 61 2e 69 6e 64 65 78 4f 66 28 22 3a 22 2c 39 29 2b 31 3b 76 61 72 20 73 3d 61 2e 73 75 62 73 74 72 69 6e 67 28 65 2c 61 2e 6c 65 6e 67 74 68 2d 31 29 2e 74 72 69 6d 28 29 3b 72 65 74 75 72 6e 20 73 3d 61 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 65 29 2e 74 72 69 6d 28 29 2b 73 2b 22 3b 22 Data Ascii: if(0<1n&&0<t.indexOf("\f"))return t.replace(m,(58===e.charCodeAt(0)?"":"$1")+e.trim())}return e+t}function o(e,t,n,i){var a=e+";",u=2t+3n+4i;if(944===u){e=a.indexOf(":",9)+1;var s=a.substring(e,a.length-1).trim();return s=a.substring(0,e).trim()+s+";"
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 2b 73 2b 61 3b 63 61 73 65 20 31 30 30 35 3a 72 65 74 75 72 6e 20 64 2e 74 65 73 74 28 61 29 3f 61 2e 72 65 70 6c 61 63 65 28 70 2c 22 3a 2d 77 65 62 6b 69 74 2d 22 29 2b 61 2e 72 65 70 6c 61 63 65 28 70 2c 22 3a 2d 6d 6f 7a 2d 22 29 2b 61 3a 61 3b 63 61 73 65 20 31 65 33 3a 73 77 69 74 63 68 28 74 3d 28 73 3d 61 2e 73 75 62 73 74 72 69 6e 67 28 31 33 29 2e 74 72 69 6d 28 29 29 2e 69 6e 64 65 78 4f 66 28 22 2d 22 29 2b 31 2c 73 2e 63 68 61 72 43 6f 64 65 41 74 28 30 29 2b 73 2e 63 68 61 72 43 6f 64 65 41 74 28 74 29 29 7b 63 61 73 65 20 32 32 36 3a 73 3d 61 2e 72 65 70 6c 61 63 65 28 62 2c 22 74 62 22 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 33 32 3a 73 3d 61 2e 72 65 70 6c 61 63 65 28 62 2c 22 74 62 2d 72 6c 22 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 Data Ascii: +s+a;case 1005:return d.test(a)?a.replace(p,":-webkit-")+a.replace(p,":-moz-")+a:a;case 1e3:switch(t=(s=a.substring(13).trim()).indexOf("-")+1,s.charCodeAt(0)+s.charCodeAt(t)){case 226:s=a.replace(b,"tb");break;case 232:s=a.replace(b,"tb-rl");break;case 2
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 2d 6d 6f 7a 2d 22 2b 73 2e 72 65 70 6c 61 63 65 28 22 66 69 6c 6c 2d 22 2c 22 22 29 29 2b 61 3b 62 72 65 61 6b 3b 63 61 73 65 20 39 36 32 3a 69 66 28 61 3d 22 2d 77 65 62 6b 69 74 2d 22 2b 61 2b 28 31 30 32 3d 3d 3d 61 2e 63 68 61 72 43 6f 64 65 41 74 28 35 29 3f 22 2d 6d 73 2d 22 2b 61 3a 22 22 29 2b 61 2c 32 31 31 3d 3d 3d 6e 2b 69 26 26 31 30 35 3d 3d 3d 61 2e 63 68 61 72 43 6f 64 65 41 74 28 31 33 29 26 26 30 3c 61 2e 69 6e 64 65 78 4f 66 28 22 74 72 61 6e 73 66 6f 72 6d 22 2c 31 30 29 29 72 65 74 75 72 6e 20 61 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 61 2e 69 6e 64 65 78 4f 66 28 22 3b 22 2c 32 37 29 2b 31 29 2e 72 65 70 6c 61 63 65 28 66 2c 22 24 31 2d 77 65 62 6b 69 74 2d 24 32 22 29 2b 61 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 72 Data Ascii: -moz-"+s.replace("fill-",""))+a;break;case 962:if(a="-webkit-"+a+(102===a.charCodeAt(5)?"-ms-"+a:"")+a,211===n+i&&105===a.charCodeAt(13)&&0<a.indexOf("transform",10))return a.substring(0,a.indexOf(";",27)+1).replace(f,"$1-webkit-$2")+a}return a}function r
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 2b 2b 4e 3b 4e 3c 55 3b 29 7b 73 77 69 74 63 68 28 68 3d 73 2e 63 68 61 72 43 6f 64 65 41 74 28 4e 29 29 7b 63 61 73 65 20 31 32 33 3a 6d 2b 2b 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 32 35 3a 6d 2d 2d 3b 62 72 65 61 6b 3b 63 61 73 65 20 34 37 3a 73 77 69 74 63 68 28 68 3d 73 2e 63 68 61 72 43 6f 64 65 41 74 28 4e 2b 31 29 29 7b 63 61 73 65 20 34 32 3a 63 61 73 65 20 34 37 3a 65 3a 7b 66 6f 72 28 54 3d 4e 2b 31 3b 54 3c 6a 3b 2b 2b 54 29 73 77 69 74 63 68 28 73 2e 63 68 61 72 43 6f 64 65 41 74 28 54 29 29 7b 63 61 73 65 20 34 37 3a 69 66 28 34 32 3d 3d 3d 68 26 26 34 32 3d 3d 3d 73 2e 63 68 61 72 43 6f 64 65 41 74 28 54 2d 31 29 26 26 4e 2b 32 21 3d 3d 54 29 7b 4e 3d 54 2b 31 3b 62 72 65 61 6b 20 65 7d 62 72 65 61 6b 3b 63 61 73 65 20 31 30 3a 69 66 28 34 Data Ascii: ++N;N<U;){switch(h=s.charCodeAt(N)){case 123:m++;break;case 125:m--;break;case 47:switch(h=s.charCodeAt(N+1)){case 42:case 47:e:{for(T=N+1;T<j;++T)switch(s.charCodeAt(T)){case 47:if(42===h&&42===s.charCodeAt(T-1)&&N+2!==T){N=T+1;break e}break;case 10:if(4
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 6b 7d 64 65 66 61 75 6c 74 3a 35 38 21 3d 3d 48 2e 63 68 61 72 43 6f 64 65 41 74 28 5f 2d 31 29 26 26 28 57 2b 3d 6f 28 48 2c 66 2c 68 2c 48 2e 63 68 61 72 43 6f 64 65 41 74 28 32 29 29 29 7d 42 3d 52 3d 54 3d 66 3d 30 2c 48 3d 22 22 2c 68 3d 73 2e 63 68 61 72 43 6f 64 65 41 74 28 2b 2b 4e 29 7d 7d 73 77 69 74 63 68 28 68 29 7b 63 61 73 65 20 31 33 3a 63 61 73 65 20 31 30 3a 34 37 3d 3d 3d 78 3f 78 3d 30 3a 30 3d 3d 3d 31 2b 66 26 26 31 30 37 21 3d 3d 70 26 26 30 3c 48 2e 6c 65 6e 67 74 68 26 26 28 52 3d 31 2c 48 2b 3d 22 5c 30 22 29 2c 30 3c 50 2a 56 26 26 61 28 30 2c 48 2c 75 2c 6e 2c 6b 2c 77 2c 57 2e 6c 65 6e 67 74 68 2c 70 2c 64 2c 70 29 2c 77 3d 31 2c 6b 2b 2b 3b 62 72 65 61 6b 3b 63 61 73 65 20 35 39 3a 63 61 73 65 20 31 32 35 3a 69 66 28 30 3d 3d Data Ascii: k}default:58!==H.charCodeAt(_-1)&&(W+=o(H,f,h,H.charCodeAt(2)))}B=R=T=f=0,H="",h=s.charCodeAt(++N)}}switch(h){case 13:case 10:47===x?x=0:0===1+f&&107!==p&&0<H.length&&(R=1,H+="\0"),0<P*V&&a(0,H,u,n,k,w,W.length,p,d,p),w=1,k++;break;case 59:case 125:if(0==
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 31 31 31 3a 57 3d 57 2e 72 65 70 6c 61 63 65 28 45 2c 22 3a 2d 6d 6f 7a 2d 24 31 22 29 2b 57 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 31 32 3a 57 3d 57 2e 72 65 70 6c 61 63 65 28 67 2c 22 3a 3a 2d 77 65 62 6b 69 74 2d 69 6e 70 75 74 2d 24 31 22 29 2b 57 2e 72 65 70 6c 61 63 65 28 67 2c 22 3a 3a 2d 6d 6f 7a 2d 24 31 22 29 2b 57 2e 72 65 70 6c 61 63 65 28 67 2c 22 3a 2d 6d 73 2d 69 6e 70 75 74 2d 24 31 22 29 2b 57 7d 46 3d 30 7d 7d 72 65 74 75 72 6e 20 47 2b 57 2b 7a 7d 28 4d 2c 75 2c 6e 2c 30 2c 30 29 3b 72 65 74 75 72 6e 20 30 3c 50 26 26 76 6f 69 64 20 30 21 3d 3d 28 73 3d 61 28 2d 32 2c 70 2c 75 2c 75 2c 6b 2c 77 2c 70 2e 6c 65 6e 67 74 68 2c 30 2c 30 2c 30 29 29 26 26 28 70 3d 73 29 2c 54 3d 22 22 2c 46 3d 30 2c 77 3d 6b 3d 31 2c 70 7d 76 61 72 20 6c 3d Data Ascii: 111:W=W.replace(E,":-moz-$1")+W;break;case 112:W=W.replace(g,"::-webkit-input-$1")+W.replace(g,"::-moz-$1")+W.replace(g,":-ms-input-$1")+W}F=0}}return G+W+z}(M,u,n,0,0);return 0<P&&void 0!==(s=a(-2,p,u,u,k,w,p.length,0,0,0))&&(p=s),T="",F=0,w=k=1,p}var l=
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 6c 6c 4f 70 61 63 69 74 79 3a 31 2c 66 6c 6f 6f 64 4f 70 61 63 69 74 79 3a 31 2c 73 74 6f 70 4f 70 61 63 69 74 79 3a 31 2c 73 74 72 6f 6b 65 44 61 73 68 61 72 72 61 79 3a 31 2c 73 74 72 6f 6b 65 44 61 73 68 6f 66 66 73 65 74 3a 31 2c 73 74 72 6f 6b 65 4d 69 74 65 72 6c 69 6d 69 74 3a 31 2c 73 74 72 6f 6b 65 4f 70 61 63 69 74 79 3a 31 2c 73 74 72 6f 6b 65 57 69 64 74 68 3a 31 7d 7d 2c 36 32 34 38 31 33 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6f 3d 6e 28 32 33 30 33 37 31 29 2c 72 3d 6e 28 34 30 30 33 36 31 29 2c 69 3d 6e 28 34 37 33 34 35 32 29 2c 61 3d 6e 28 31 38 34 38 32 36 29 2c 75 3d 6e 28 39 39 32 32 37 38 29 2c 73 3d 6e 2e 6e 28 75 29 2c 6c 3d 2f 5b 41 2d 5a 5d 7c 5e 6d 73 2f 67 2c 63 3d Data Ascii: llOpacity:1,floodOpacity:1,stopOpacity:1,strokeDasharray:1,strokeDashoffset:1,strokeMiterlimit:1,strokeOpacity:1,strokeWidth:1}},624813:function(e,t,n){"use strict";var o=n(230371),r=n(400361),i=n(473452),a=n(184826),u=n(992278),s=n.n(u),l=/[A-Z]\|^ms/g,c=
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 74 68 69 73 2e 69 73 53 70 65 65 64 79 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 65 2e 73 68 65 65 74 29 72 65 74 75 72 6e 20 65 2e 73 68 65 65 74 3b 66 6f 72 28 76 61 72 20 74 3d 30 3b 74 3c 64 6f 63 75 6d 65 6e 74 2e 73 74 79 6c 65 53 68 65 65 74 73 2e 6c 65 6e 67 74 68 3b 74 2b 2b 29 69 66 28 64 6f 63 75 6d 65 6e 74 2e 73 74 79 6c 65 53 68 65 65 74 73 5b 74 5d 2e 6f 77 6e 65 72 4e 6f 64 65 3d 3d 3d 65 29 72 65 74 75 72 6e 20 64 6f 63 75 6d 65 6e 74 2e 73 74 79 6c 65 53 68 65 65 74 73 5b 74 5d 7d 28 74 68 69 73 2e 74 61 67 73 5b 74 68 69 73 2e 74 61 67 73 2e 6c 65 6e 67 74 68 2d 31 5d 29 3b 74 72 79 7b 6e 2e 69 6e 73 65 72 74 52 75 6c 65 28 65 2c 6e 2e 63 73 73 52 75 6c 65 73 2e 6c 65 6e 67 74 68 29 7d 63 61 74 63 68 28 65 29 Data Ascii: this.isSpeedy){var n=function(e){if(e.sheet)return e.sheet;for(var t=0;t<document.styleSheets.length;t++)if(document.styleSheets[t].ownerNode===e)return document.styleSheets[t]}(this.tags[this.tags.length-1]);try{n.insertRule(e,n.cssRules.length)}catch(e)
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 63 74 69 6f 6e 28 6e 29 7b 22 6f 62 6a 65 63 74 22 21 3d 74 79 70 65 6f 66 20 65 5b 6e 5d 3f 76 6f 69 64 20 30 21 3d 3d 76 2e 72 65 67 69 73 74 65 72 65 64 5b 65 5b 6e 5d 5d 3f 74 2b 3d 6e 2b 22 7b 22 2b 76 2e 72 65 67 69 73 74 65 72 65 64 5b 65 5b 6e 5d 5d 2b 22 7d 22 3a 74 2b 3d 63 28 6e 29 2b 22 3a 22 2b 70 28 6e 2c 65 5b 6e 5d 29 2b 22 3b 22 3a 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 5b 6e 5d 29 26 26 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 5b 6e 5d 5b 30 5d 26 26 76 6f 69 64 20 30 3d 3d 3d 76 2e 72 65 67 69 73 74 65 72 65 64 5b 65 5b 6e 5d 5b 30 5d 5d 3f 65 5b 6e 5d 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 2b 3d 63 28 6e 29 2b 22 3a 22 2b 70 28 6e 2c 65 29 2b 22 3b 22 7d 29 3a 74 2b 3d 6e 2b 22 7b 22 2b 79 Data Ascii: ction(n){"object"!=typeof e[n]?void 0!==v.registered[e[n]]?t+=n+"{"+v.registered[e[n]]+"}":t+=c(n)+":"+p(n,e[n])+";":Array.isArray(e[n])&&"string"==typeof e[n][0]&&void 0===v.registered[e[n][0]]?e[n].forEach(function(e){t+=c(n)+":"+p(n,e)+";"}):t+=n+"{"+y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.7	49860	35.190.80.1	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:46 UTC	478	OUT	POST /report/v4?s=j%2Bvd4db%2FnJKCksUnQfxjBqA4P2wy21wAjR7kq6JYdLd%2FTbNxOzyMaYLuPY17E8B%2FD%2F%2BiDYDVFjxhoHe1BcFjfFi%2ByBAYR84%2FDXlHVVAubpNZo4eIyM3Ue30CgBVX HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 509 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 07:15:46 UTC	509	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 36 38 33 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 36 39 36 34 36 2e 32 61 66 38 65 33 66 32 65 36 30 62 32 63 63 61 31 63 62 66 2e 63 73 73 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 36 32 2e 31 35 39 2e 31 33 36 2e 32 33 32 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 72 65 Data Ascii: [{"age":0,"body":{"elapsed_time":1683,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css","sampling_fraction":1.0,"server_ip":"162.159.136.232","status_code":200,"type":"http.re
2024-10-24 07:15:46 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Thu, 24 Oct 2024 07:15:46 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.7	49861	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:46 UTC	745	OUT	GET /assets/1bab9b095996b8d024ce.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/assets/ac625b77a0bab0ee72df.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:46 UTC	966	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:46 GMT Content-Type: application/javascript Content-Length: 7078 Connection: close CF-Ray: 8d782d783eb92e78-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "45a3ee5ff96bdb2dd7fbb2846b5ea494" Last-Modified: Tue, 18 Jun 2024 19:13:27 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lltN2BIPceVtodfFNlp7%2FlGQBCl5IiDQLVlo3DdKvPX9yHyEO4EzZMS8WipQmQI46ln1e2ESpNzizxDNfVG9CFsLRENRQZxBQVFEeF2MBXPu%2BW8MnBtdJvVdt1NW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:46 UTC	403	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 34 33 32 32 32 22 5d 2c 7b 33 34 30 36 31 38 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 6f 29 7b 76 61 72 20 65 3d 6f 28 33 35 34 38 34 38 29 2c 6e 3d 53 74 72 69 6e 67 2c 63 3d 54 79 70 65 45 72 72 6f 72 3b 72 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 72 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 72 7c 7c 65 28 72 29 29 72 65 74 75 72 6e 20 72 3b 74 68 72 6f 77 20 63 28 22 43 61 6e 27 74 20 73 65 74 20 22 2b 6e 28 72 29 2b 22 20 61 73 20 61 20 70 72 6f 74 6f 74 79 70 65 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["43222"],{340618:function(r,t,o){var e=o(354848),n=String,c=TypeError;r.exports=function(r){if("object"==typeof r\|\|e(r))return r;throw c("Can't set "+n(r)+" as a prototype
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 3d 72 2e 70 72 6f 74 6f 74 79 70 65 7d 29 7d 2c 33 33 39 39 35 3a 66 75 6e 63 74 69 6f 6e 28 72 29 7b 72 2e 65 78 70 6f 72 74 73 3d 7b 49 6e 64 65 78 53 69 7a 65 45 72 72 6f 72 3a 7b 73 3a 22 49 4e 44 45 58 5f 53 49 5a 45 5f 45 52 52 22 2c 63 3a 31 2c 6d 3a 31 7d 2c 44 4f 4d 53 74 72 69 6e 67 53 69 7a 65 45 72 72 6f 72 3a 7b 73 3a 22 44 4f 4d 53 54 52 49 4e 47 5f 53 49 5a 45 5f 45 52 52 22 2c 63 3a 32 2c 6d 3a 30 7d 2c 48 69 65 72 61 72 63 68 79 52 65 71 75 65 73 74 45 72 72 6f 72 3a 7b 73 3a 22 48 49 45 52 41 52 43 48 59 5f 52 45 51 55 45 53 54 5f 45 52 52 22 2c 63 3a 33 2c 6d 3a 31 7d 2c 57 72 6f 6e 67 44 6f 63 75 6d 65 6e 74 45 72 72 6f 72 3a 7b 73 3a 22 57 52 4f 4e 47 5f 44 4f 43 55 4d 45 4e 54 5f 45 52 52 22 2c 63 3a 34 2c 6d 3a 31 7d 2c 49 6e 76 61 Data Ascii: =r.prototype})},33995:function(r){r.exports={IndexSizeError:{s:"INDEX_SIZE_ERR",c:1,m:1},DOMStringSizeError:{s:"DOMSTRING_SIZE_ERR",c:2,m:0},HierarchyRequestError:{s:"HIERARCHY_REQUEST_ERR",c:3,m:1},WrongDocumentError:{s:"WRONG_DOCUMENT_ERR",c:4,m:1},Inva
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 72 79 7b 72 65 74 75 72 6e 20 65 28 6e 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 72 2c 74 29 5b 6f 5d 29 29 7d 63 61 74 63 68 28 72 29 7b 7d 7d 7d 2c 36 32 30 36 32 33 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 6f 29 7b 76 61 72 20 65 3d 6f 28 35 34 35 35 37 36 29 3b 72 2e 65 78 70 6f 72 74 73 3d 65 28 22 64 6f 63 75 6d 65 6e 74 22 2c 22 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 22 29 7d 2c 38 37 34 36 35 32 3a 66 75 6e 63 74 69 6f 6e 28 72 29 7b 72 2e 65 78 70 6f 72 74 73 3d 7b 7d 7d 2c 38 30 33 39 33 38 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 6f 29 7b 76 61 72 20 65 2c 6e 3d 6f 28 32 34 30 33 33 29 2c 63 3d 6f 28 39 34 35 36 37 29 2c 69 3d 6f 28 32 30 32 32 33 34 29 2c 75 3d 6f 28 36 32 34 39 Data Ascii: ry{return e(n(Object.getOwnPropertyDescriptor(r,t)[o]))}catch(r){}}},620623:function(r,t,o){var e=o(545576);r.exports=e("document","documentElement")},874652:function(r){r.exports={}},803938:function(r,t,o){var e,n=o(24033),c=o(94567),i=o(202234),u=o(6249
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 6e 28 72 29 7b 76 61 72 20 74 3d 63 28 72 29 3b 69 66 28 65 28 74 2c 61 29 29 72 65 74 75 72 6e 20 74 5b 61 5d 3b 76 61 72 20 6f 3d 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 72 65 74 75 72 6e 20 6e 28 6f 29 26 26 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 6f 3f 6f 2e 70 72 6f 74 6f 74 79 70 65 3a 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 66 3f 45 3a 6e 75 6c 6c 7d 7d 2c 38 33 35 38 38 34 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 6f 29 7b 76 61 72 20 65 3d 6f 28 32 32 32 35 33 31 29 2c 6e 3d 6f 28 32 30 32 32 33 34 29 3b 72 2e 65 78 70 6f 72 74 73 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 7c 7c 66 75 6e 63 74 69 6f 6e 28 72 29 7b 72 65 74 75 72 6e 20 65 28 72 2c 6e 29 7d 7d 2c 32 37 36 33 32 31 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 6f 29 7b 76 61 72 20 65 3d 6f 28 Data Ascii: n(r){var t=c(r);if(e(t,a))return t[a];var o=t.constructor;return n(o)&&t instanceof o?o.prototype:t instanceof f?E:null}},835884:function(r,t,o){var e=o(222531),n=o(202234);r.exports=Object.keys\|\|function(r){return e(r,n)}},276321:function(r,t,o){var e=o(
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 28 31 2c 32 29 2c 79 3d 6d 26 26 6c 26 26 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 6e 2c 64 29 2c 4e 3d 21 21 79 26 26 21 28 79 2e 77 72 69 74 61 62 6c 65 26 26 79 2e 63 6f 6e 66 69 67 75 72 61 62 6c 65 29 2c 68 3d 76 26 26 21 4e 26 26 21 54 3b 65 28 7b 67 6c 6f 62 61 6c 3a 21 30 2c 63 6f 6e 73 74 72 75 63 74 6f 72 3a 21 30 2c 66 6f 72 63 65 64 3a 5f 7c 7c 68 7d 2c 7b 44 4f 4d 45 78 63 65 70 74 69 6f 6e 3a 68 3f 49 3a 6d 7d 29 3b 76 61 72 20 44 3d 63 28 64 29 2c 53 3d 44 2e 70 72 6f 74 6f 74 79 70 65 3b 69 66 28 53 2e 63 6f 6e 73 74 72 75 63 74 6f 72 21 3d 3d 44 29 7b 66 6f 72 28 76 61 72 20 62 20 69 6e 21 5f 26 26 75 28 53 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 2c 69 28 31 2c 44 29 29 2c 70 29 69 Data Ascii: (1,2),y=m&&l&&Object.getOwnPropertyDescriptor(n,d),N=!!y&&!(y.writable&&y.configurable),h=v&&!N&&!T;e({global:!0,constructor:!0,forced:_\|\|h},{DOMException:h?I:m});var D=c(d),S=D.prototype;if(S.constructor!==D){for(var b in!_&&u(S,"constructor",i(1,D)),p)i
2024-10-24 07:15:46 UTC	1199	IN	Data Raw: 74 7b 50 49 3a 74 2c 6d 69 6e 3a 6f 2c 6d 61 78 3a 6e 2c 63 6f 73 3a 63 2c 72 6f 75 6e 64 3a 69 7d 3d 4d 61 74 68 2c 75 3d 72 5b 30 5d 7c 72 5b 31 5d 3c 3c 38 7c 72 5b 32 5d 3c 3c 31 36 2c 61 3d 72 5b 33 5d 7c 72 5b 34 5d 3c 3c 38 2c 66 3d 28 36 33 26 75 29 2f 36 33 2c 45 3d 28 75 3e 3e 36 26 36 33 29 2f 33 31 2e 35 2d 31 2c 73 3d 28 75 3e 3e 31 32 26 36 33 29 2f 33 31 2e 35 2d 31 2c 70 3d 75 3e 3e 32 33 2c 52 3d 61 3e 3e 31 35 2c 6c 3d 6e 28 33 2c 52 3f 70 3f 35 3a 37 3a 37 26 61 29 2c 5f 3d 6e 28 33 2c 52 3f 37 26 61 3a 70 3f 35 3a 37 29 2c 64 3d 70 3f 28 31 35 26 72 5b 35 5d 29 2f 31 35 3a 31 2c 4f 3d 28 72 5b 35 5d 3e 3e 34 29 2f 31 35 2c 6d 3d 70 3f 36 3a 35 2c 49 3d 30 2c 41 3d 28 74 2c 6f 2c 65 29 3d 3e 7b 6c 65 74 20 6e 3d 5b 5d 3b 66 6f 72 28 6c Data Ascii: t{PI:t,min:o,max:n,cos:c,round:i}=Math,u=r[0]\|r[1]<<8\|r[2]<<16,a=r[3]\|r[4]<<8,f=(63&u)/63,E=(u>>6&63)/31.5-1,s=(u>>12&63)/31.5-1,p=u>>23,R=a>>15,l=n(3,R?p?5:7:7&a),_=n(3,R?7&a:p?5:7),d=p?(15&r[5])/15:1,O=(r[5]>>4)/15,m=p?6:5,I=0,A=(t,o,e)=>{let n=[];for(l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.7	49862	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:46 UTC	868	OUT	GET /assets/d86788be99e870993214.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:46 UTC	969	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:46 GMT Content-Type: text/javascript Content-Length: 8761 Connection: close CF-Ray: 8d782d7839ee464a-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "102fe4fdec4447c9891c9f3faeae0474" Last-Modified: Tue, 15 Oct 2024 21:50:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O7Pmtua5Tb2p%2BlZq9phc%2FTZ2wJlKQ6FOQ%2FNNsIPvI%2BET1AhDbXb%2F9iA9nQOpgDKzkJujsrebwk%2BWdIS6ZFFP10bPO0VPrDoUjC2Dqz1%2Fc19bvG12asqgDtYJKuew"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:46 UTC	400	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 31 38 35 34 33 22 5d 2c 7b 37 32 35 34 33 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 6d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 7d 7d 29 3b 76 61 72 20 73 3d 6e 28 34 35 34 35 38 35 29 2c 61 3d 6e 28 35 35 31 34 35 32 29 2c 6c 3d 6e 28 35 33 32 39 30 31 29 3b 6c 65 74 20 72 3d 7b 2e 2e 2e 73 2e 5a 2e 67 75 69 6c 64 45 76 65 6e 74 52 75 6c 65 73 2e 6c 69 6e 6b 2c 72 65 61 63 74 3a 28 30 2c 6c 2e 5a 29 28 7b 65 6e 61 62 6c 65 42 75 69 6c 64 4f 76 65 72 72 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["18543"],{725436:function(e,t,n){n.d(t,{m:function(){return u}});var s=n(454585),a=n(551452),l=n(532901);let r={...s.Z.guildEventRules.link,react:(0,l.Z)({enableBuildOverr
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 61 6c 73 3a 21 30 2c 73 68 6f 75 6c 64 53 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 3a 21 30 7d 29 2e 72 65 61 63 74 7d 2c 75 3d 73 2e 5a 2e 72 65 61 63 74 50 61 72 73 65 72 46 6f 72 28 7b 2e 2e 2e 73 2e 5a 2e 67 75 69 6c 64 45 76 65 6e 74 52 75 6c 65 73 2c 6c 69 6e 6b 3a 72 2c 63 68 61 6e 6e 65 6c 4d 65 6e 74 69 6f 6e 3a 69 7d 29 7d 2c 33 31 35 34 31 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 5a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 3b 76 61 72 20 73 3d 6e 28 31 39 32 33 37 39 29 2c 61 3d 6e 28 34 34 32 38 33 37 29 2c 6c 3d 6e 28 38 39 37 32 38 35 29 2c 72 3d 6e 28 39 32 34 33 30 31 29 3b 66 75 6e 63 74 69 6f 6e 20 69 28 65 2c 74 2c 6e 29 7b 6c 65 74 20 69 3d 28 30 2c 61 2e 65 37 29 28 5b 72 Data Ascii: als:!0,shouldStopPropagation:!0}).react},u=s.Z.reactParserFor({...s.Z.guildEventRules,link:r,channelMention:i})},315416:function(e,t,n){n.d(t,{Z:function(){return i}});var s=n(192379),a=n(442837),l=n(897285),r=n(924301);function i(e,t,n){let i=(0,a.e7)([r
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 6e 2e 6e 28 61 29 2c 72 3d 6e 28 37 33 31 30 30 36 29 3b 66 75 6e 63 74 69 6f 6e 20 69 28 65 29 7b 6c 65 74 7b 73 6f 75 72 63 65 3a 74 2c 63 6c 61 73 73 4e 61 6d 65 3a 6e 7d 3d 65 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 74 3f 6e 75 6c 6c 3a 28 30 2c 73 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 6c 28 29 28 72 2e 63 6f 6e 74 61 69 6e 65 72 2c 6e 29 2c 73 74 79 6c 65 3a 7b 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 3a 22 75 72 6c 28 22 2e 63 6f 6e 63 61 74 28 74 2c 22 29 22 29 7d 7d 29 7d 7d 2c 37 34 32 35 39 33 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 48 5a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 68 7d 2c 52 66 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 67 7d 2c 5a Data Ascii: n.n(a),r=n(731006);function i(e){let{source:t,className:n}=e;return null==t?null:(0,s.jsx)("div",{className:l()(r.container,n),style:{backgroundImage:"url(".concat(t,")")}})}},742593:function(e,t,n){n.d(t,{HZ:function(){return h},Rf:function(){return g},Z
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 74 61 72 2c 7b 2e 2e 2e 65 2c 73 72 63 3a 6e 2e 67 65 74 41 76 61 74 61 72 55 52 4c 28 61 2c 32 30 29 2c 73 69 7a 65 3a 69 2e 41 76 61 74 61 72 53 69 7a 65 73 2e 53 49 5a 45 5f 32 30 2c 22 61 72 69 61 2d 6c 61 62 65 6c 22 3a 6e 75 6c 6c 21 3d 41 3f 41 3a 6e 2e 75 73 65 72 6e 61 6d 65 2c 63 6c 61 73 73 4e 61 6d 65 3a 78 2e 63 72 65 61 74 6f 72 7d 29 7d 29 2c 28 30 2c 73 2e 6a 73 78 29 28 69 2e 54 6f 6f 6c 74 69 70 2c 7b 74 65 78 74 3a 76 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 45 56 45 4e 54 5f 49 4e 54 45 52 45 53 54 45 44 5f 43 4f 55 4e 54 2e 66 6f 72 6d 61 74 28 7b 63 6f 75 6e 74 3a 4c 7d 29 2c 63 68 69 6c 64 72 65 6e 3a 65 3d 3e 28 30 2c 73 2e 6a 73 78 73 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 78 2e 72 73 76 70 43 6f 75 Data Ascii: tar,{...e,src:n.getAvatarURL(a,20),size:i.AvatarSizes.SIZE_20,"aria-label":null!=A?A:n.username,className:x.creator})}),(0,s.jsx)(i.Tooltip,{text:v.Z.Messages.GUILD_EVENT_INTERESTED_COUNT.format({count:L}),children:e=>(0,s.jsxs)("div",{className:x.rsvpCou
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 3a 64 2c 65 76 65 6e 74 50 72 65 76 69 65 77 3a 4e 2c 72 65 63 75 72 72 65 6e 63 65 49 64 3a 5f 7d 29 2c 28 30 2c 73 2e 6a 73 78 29 28 67 2c 7b 6e 61 6d 65 3a 6c 2c 64 65 73 63 72 69 70 74 69 6f 6e 3a 72 2c 68 65 61 64 65 72 56 61 72 69 61 6e 74 3a 74 2c 64 65 73 63 72 69 70 74 69 6f 6e 43 6c 61 73 73 4e 61 6d 65 3a 6e 2c 74 72 75 6e 63 61 74 65 3a 63 2c 67 75 69 6c 64 49 64 3a 6f 2c 69 6d 61 67 65 53 6f 75 72 63 65 3a 69 7d 29 5d 7d 29 7d 7d 2c 33 39 30 39 36 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 7a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4c 7d 7d 29 2c 6e 28 34 37 31 32 30 29 3b 76 61 72 20 73 2c 61 2c 6c 3d 6e 28 32 30 30 36 35 31 29 2c 72 3d 6e 28 31 39 32 33 37 39 29 2c 69 3d 6e 28 31 32 30 33 35 Data Ascii: :d,eventPreview:N,recurrenceId:_}),(0,s.jsx)(g,{name:l,description:r,headerVariant:t,descriptionClassName:n,truncate:c,guildId:o,imageSource:i})]})}},390966:function(e,t,n){n.d(t,{z:function(){return L}}),n(47120);var s,a,l=n(200651),r=n(192379),i=n(12035
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 73 61 67 65 73 2e 53 54 41 47 45 5f 43 48 41 4e 4e 45 4c 5f 48 41 50 50 45 4e 49 4e 47 5f 4e 4f 57 3a 78 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 53 54 41 47 45 5f 43 48 41 4e 4e 45 4c 5f 4c 49 56 45 5f 4e 4f 57 29 3b 6c 65 74 20 70 3d 28 30 2c 5f 2e 5a 29 28 49 2c 41 29 2c 5b 7b 73 74 61 72 74 44 61 74 65 54 69 6d 65 53 74 72 69 6e 67 3a 6a 2c 65 6e 64 44 61 74 65 54 69 6d 65 53 74 72 69 6e 67 3a 4f 2c 63 75 72 72 65 6e 74 4f 72 50 61 73 74 45 76 65 6e 74 3a 4d 2c 75 70 63 6f 6d 69 6e 67 45 76 65 6e 74 3a 55 2c 64 69 66 66 4d 69 6e 75 74 65 73 3a 77 7d 2c 47 5d 3d 72 2e 75 73 65 53 74 61 74 65 28 28 30 2c 54 2e 75 62 29 28 74 2c 69 29 29 3b 72 2e 75 73 65 45 66 66 65 63 74 28 28 29 3d 3e 7b 47 28 28 30 2c 54 2e 75 62 29 28 74 2c 69 29 29 3b 6c 65 74 20 65 3d Data Ascii: sages.STAGE_CHANNEL_HAPPENING_NOW:x.Z.Messages.STAGE_CHANNEL_LIVE_NOW);let p=(0,_.Z)(I,A),[{startDateTimeString:j,endDateTimeString:O,currentOrPastEvent:M,upcomingEvent:U,diffMinutes:w},G]=r.useState((0,T.ub)(t,i));r.useEffect(()=>{G((0,T.ub)(t,i));let e=
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 75 72 6e 7b 49 63 6f 6e 3a 75 2c 69 63 6f 6e 43 6f 6c 6f 72 3a 63 2e 68 65 78 2c 74 65 78 74 43 6f 6c 6f 72 3a 6f 2c 74 6f 6f 6c 74 69 70 54 65 78 74 3a 74 7d 7d 29 28 7b 74 69 6d 65 53 74 61 74 75 73 3a 62 2c 74 65 78 74 42 72 61 6e 64 3a 5a 2c 74 65 78 74 50 6f 73 69 74 69 76 65 3a 43 2c 74 65 78 74 44 61 6e 67 65 72 3a 52 2c 65 6e 64 44 61 74 65 54 69 6d 65 53 74 72 69 6e 67 3a 4f 2c 73 74 61 72 74 44 61 74 65 54 69 6d 65 53 74 72 69 6e 67 3a 6a 7d 29 2c 5b 62 2c 5a 2c 43 2c 52 2c 4f 2c 6a 5d 29 2c 57 3d 6e 75 6c 6c 3b 69 66 28 6e 75 6c 6c 21 3d 53 29 7b 6c 65 74 20 65 3d 28 30 2c 54 2e 48 6f 29 28 53 29 3b 57 3d 78 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 53 43 48 45 44 55 4c 45 44 5f 45 56 45 4e 54 5f 52 45 43 55 52 52 45 4e 43 45 5f 52 Data Ascii: urn{Icon:u,iconColor:c.hex,textColor:o,tooltipText:t}})({timeStatus:b,textBrand:Z,textPositive:C,textDanger:R,endDateTimeString:O,startDateTimeString:j}),[b,Z,C,R,O,j]),W=null;if(null!=S){let e=(0,T.Ho)(S);W=x.Z.Messages.GUILD_SCHEDULED_EVENT_RECURRENCE_R
2024-10-24 07:15:46 UTC	147	IN	Data Raw: 6c 21 3d 57 26 26 28 30 2c 6c 2e 6a 73 78 29 28 64 2e 54 65 78 74 2c 7b 63 6f 6c 6f 72 3a 22 68 65 61 64 65 72 2d 73 65 63 6f 6e 64 61 72 79 22 2c 76 61 72 69 61 6e 74 3a 22 74 65 78 74 2d 78 73 2f 6e 6f 72 6d 61 6c 22 2c 63 68 69 6c 64 72 65 6e 3a 57 7d 29 5d 7d 29 5d 7d 29 7d 7d 7d 5d 29 3b 0a 2f 2f 23 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 3d 64 38 36 37 38 38 62 65 39 39 65 38 37 30 39 39 33 32 31 34 2e 6a 73 2e 6d 61 70 Data Ascii: l!=W&&(0,l.jsx)(d.Text,{color:"header-secondary",variant:"text-xs/normal",children:W})]})]})}}}]);//# sourceMappingURL=d86788be99e870993214.js.map

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.7	49863	162.159.138.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:46 UTC	673	OUT	GET /assets/5067a2ec1b24a6de868c.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:46 UTC	971	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:46 GMT Content-Type: application/javascript Content-Length: 13374 Connection: close CF-Ray: 8d782d785f0e6b27-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "d0c788b157ff96a2dd902c97bfc889f6" Last-Modified: Fri, 28 Jun 2024 00:43:12 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ReGwrPuX82Ba%2F20TNJ%2B2mJZPl09GZqlUxxp%2FiEg7hdeTgVFeHYHvWuOkfE9BRPz5EIxgJgUg7ylUXQ%2F0hf4Heta53hWBPsYYFKEyHCCg05uUEK9QzejWimiiLJb1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 37 38 31 38 37 22 5d 2c 7b 35 32 36 39 38 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 33 35 34 38 34 38 29 2c 6f 3d 72 28 39 33 38 35 30 37 29 2c 69 3d 54 79 70 65 45 72 72 6f 72 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 65 28 74 29 29 72 65 74 75 72 6e 20 74 3b 74 68 72 6f 77 20 69 28 6f 28 74 29 2b 22 20 69 73 20 6e 6f 74 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 7d 7d 2c 32 34 30 33 33 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["78187"],{526988:function(t,n,r){var e=r(354848),o=r(938507),i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not a function")}},24033:function(t,n,r){
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 2e 66 28 74 2c 6e 2c 72 29 7d 7d 2c 38 35 39 32 30 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 33 35 34 38 34 38 29 2c 6f 3d 72 28 39 37 31 33 31 29 2c 69 3d 72 28 32 33 30 33 36 34 29 2c 75 3d 72 28 34 39 32 34 32 34 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 2c 63 29 7b 21 63 26 26 28 63 3d 7b 7d 29 3b 76 61 72 20 66 3d 63 2e 65 6e 75 6d 65 72 61 62 6c 65 2c 61 3d 76 6f 69 64 20 30 21 3d 3d 63 2e 6e 61 6d 65 3f 63 2e 6e 61 6d 65 3a 6e 3b 69 66 28 65 28 72 29 26 26 69 28 72 2c 61 2c 63 29 2c 63 2e 67 6c 6f 62 61 6c 29 66 3f 74 5b 6e 5d 3d 72 3a 75 28 6e 2c 72 29 3b 65 6c 73 65 7b 74 72 79 7b 63 2e 75 6e 73 61 66 65 3f 74 5b 6e 5d 26 26 28 66 3d 21 30 29 3a 64 65 6c 65 74 65 20 74 5b 6e Data Ascii: .f(t,n,r)}},859209:function(t,n,r){var e=r(354848),o=r(97131),i=r(230364),u=r(492424);t.exports=function(t,n,r,c){!c&&(c={});var f=c.enumerable,a=void 0!==c.name?c.name:n;if(e(r)&&i(r,a,c),c.global)f?t[n]=r:u(n,r);else{try{c.unsafe?t[n]&&(f=!0):delete t[n
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 74 79 70 65 4f 66 22 2c 22 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 22 2c 22 74 6f 4c 6f 63 61 6c 65 53 74 72 69 6e 67 22 2c 22 74 6f 53 74 72 69 6e 67 22 2c 22 76 61 6c 75 65 4f 66 22 5d 7d 2c 31 34 37 30 31 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 31 36 31 35 38 31 29 2c 6f 3d 72 28 33 34 37 37 32 32 29 2e 66 2c 69 3d 72 28 32 35 31 30 36 39 29 2c 75 3d 72 28 38 35 39 32 30 39 29 2c 63 3d 72 28 34 39 32 34 32 34 29 2c 66 3d 72 28 33 38 31 37 34 30 29 2c 61 3d 72 28 34 37 34 31 38 30 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 72 2c 73 2c 70 2c 6c 2c 76 2c 62 3d 74 2e 74 61 72 67 65 74 2c 79 3d 74 2e 67 6c 6f 62 61 6c 2c 67 3d 74 2e 73 74 61 74 3b 69 66 Data Ascii: typeOf","propertyIsEnumerable","toLocaleString","toString","valueOf"]},147018:function(t,n,r){var e=r(161581),o=r(347722).f,i=r(251069),u=r(859209),c=r(492424),f=r(381740),a=r(474180);t.exports=function(t,n){var r,s,p,l,v,b=t.target,y=t.global,g=t.stat;if
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 68 3c 32 3f 6f 28 72 3d 65 5b 74 5d 29 3f 72 3a 76 6f 69 64 20 30 3a 65 5b 74 5d 26 26 65 5b 74 5d 5b 6e 5d 7d 7d 2c 39 39 35 37 33 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 35 32 36 39 38 38 29 2c 6f 3d 72 28 33 35 31 37 39 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 72 3d 74 5b 6e 5d 3b 72 65 74 75 72 6e 20 6f 28 72 29 3f 76 6f 69 64 20 30 3a 65 28 72 29 7d 7d 2c 31 36 31 35 38 31 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 26 26 74 2e 4d 61 74 68 3d 3d 3d 4d 61 74 68 26 26 74 7d 3b 74 2e 65 78 70 6f 72 74 73 3d 65 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 Data Ascii: h<2?o(r=e[t])?r:void 0:e[t]&&e[t][n]}},995739:function(t,n,r){var e=r(526988),o=r(35179);t.exports=function(t,n){var r=t[n];return o(r)?void 0:e(r)}},161581:function(t,n,r){var e=function(t){return t&&t.Math===Math&&t};t.exports=e("object"==typeof globalT
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 77 20 67 29 3b 68 2e 67 65 74 3d 68 2e 67 65 74 2c 68 2e 68 61 73 3d 68 2e 68 61 73 2c 68 2e 73 65 74 3d 68 2e 73 65 74 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 69 66 28 68 2e 68 61 73 28 74 29 29 74 68 72 6f 77 20 79 28 62 29 3b 72 65 74 75 72 6e 20 6e 2e 66 61 63 61 64 65 3d 74 2c 68 2e 73 65 74 28 74 2c 6e 29 2c 6e 7d 2c 6f 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 68 2e 67 65 74 28 74 29 7c 7c 7b 7d 7d 2c 69 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 68 2e 68 61 73 28 74 29 7d 7d 65 6c 73 65 7b 76 61 72 20 6d 3d 6c 28 22 73 74 61 74 65 22 29 3b 76 5b 6d 5d 3d 21 30 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 69 66 28 73 28 74 2c 6d 29 29 74 68 72 6f 77 20 79 28 62 29 3b 72 65 74 75 72 6e 20 6e 2e 66 Data Ascii: w g);h.get=h.get,h.has=h.has,h.set=h.set,e=function(t,n){if(h.has(t))throw y(b);return n.facade=t,h.set(t,n),n},o=function(t){return h.get(t)\|\|{}},i=function(t){return h.has(t)}}else{var m=l("state");v[m]=!0,e=function(t,n){if(s(t,m))throw y(b);return n.f
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 74 29 7b 72 65 74 75 72 6e 22 73 79 6d 62 6f 6c 22 3d 3d 74 79 70 65 6f 66 20 74 7d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 65 28 22 53 79 6d 62 6f 6c 22 29 3b 72 65 74 75 72 6e 20 6f 28 6e 29 26 26 69 28 6e 2e 70 72 6f 74 6f 74 79 70 65 2c 63 28 74 29 29 7d 7d 2c 34 39 36 39 33 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 35 35 32 30 32 38 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 65 28 74 2e 6c 65 6e 67 74 68 29 7d 7d 2c 32 33 30 33 36 34 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 35 38 31 30 33 31 29 2c 6f 3d 72 28 39 33 36 39 34 30 29 2c 69 3d 72 28 33 35 34 38 34 38 29 2c 75 3d 72 28 37 34 30 33 36 32 29 2c 63 3d 72 28 33 Data Ascii: t){return"symbol"==typeof t}:function(t){var n=e("Symbol");return o(n)&&i(n.prototype,c(t))}},49693:function(t,n,r){var e=r(552028);t.exports=function(t){return e(t.length)}},230364:function(t,n,r){var e=r(581031),o=r(936940),i=r(354848),u=r(740362),c=r(3
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 74 6f 72 2c 70 3d 22 65 6e 75 6d 65 72 61 62 6c 65 22 2c 6c 3d 22 63 6f 6e 66 69 67 75 72 61 62 6c 65 22 2c 76 3d 22 77 72 69 74 61 62 6c 65 22 3b 6e 2e 66 3d 65 3f 69 3f 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 69 66 28 75 28 74 29 2c 6e 3d 63 28 6e 29 2c 75 28 72 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 22 70 72 6f 74 6f 74 79 70 65 22 3d 3d 3d 6e 26 26 22 76 61 6c 75 65 22 69 6e 20 72 26 26 76 20 69 6e 20 72 26 26 21 72 5b 76 5d 29 7b 76 61 72 20 65 3d 73 28 74 2c 6e 29 3b 65 26 26 65 5b 76 5d 26 26 28 74 5b 6e 5d 3d 72 2e 76 61 6c 75 65 2c 72 3d 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 6c 20 69 6e 20 72 3f 72 5b 6c 5d 3a 65 5b 6c 5d 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 70 20 69 6e 20 72 3f 72 5b 70 5d 3a 65 5b 70 Data Ascii: tor,p="enumerable",l="configurable",v="writable";n.f=e?i?function(t,n,r){if(u(t),n=c(n),u(r),"function"==typeof t&&"prototype"===n&&"value"in r&&v in r&&!r[v]){var e=s(t,n);e&&e[v]&&(t[n]=r.value,r={configurable:l in r?r[l]:e[l],enumerable:p in r?r[p]:e[p
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 74 29 3b 72 65 74 75 72 6e 21 21 6e 26 26 6e 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 3a 72 7d 2c 33 33 37 38 35 36 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 39 32 36 35 31 35 29 2c 6f 3d 72 28 33 35 34 38 34 38 29 2c 69 3d 72 28 36 32 32 32 38 31 29 2c 75 3d 54 79 70 65 45 72 72 6f 72 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 72 2c 63 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 3d 6e 26 26 6f 28 72 3d 74 2e 74 6f 53 74 72 69 6e 67 29 26 26 21 69 28 63 3d 65 28 72 2c 74 29 29 7c 7c 6f 28 72 3d 74 2e 76 61 6c 75 65 4f 66 29 26 26 21 69 28 63 3d 65 28 72 2c 74 29 29 7c 7c 22 73 74 72 69 6e 67 22 21 3d 3d 6e 26 26 6f 28 72 3d 74 2e 74 6f 53 74 72 69 6e 67 29 26 26 21 69 28 63 3d 65 28 72 Data Ascii: t);return!!n&&n.enumerable}:r},337856:function(t,n,r){var e=r(926515),o=r(354848),i=r(622281),u=TypeError;t.exports=function(t,n){var r,c;if("string"===n&&o(r=t.toString)&&!i(c=e(r,t))\|\|o(r=t.valueOf)&&!i(c=e(r,t))\|\|"string"!==n&&o(r=t.toString)&&!i(c=e(r
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 28 74 29 7c 7c 21 28 4f 62 6a 65 63 74 28 74 29 20 69 6e 73 74 61 6e 63 65 6f 66 20 53 79 6d 62 6f 6c 29 7c 7c 21 53 79 6d 62 6f 6c 2e 73 68 61 6d 26 26 65 26 26 65 3c 34 31 7d 29 7d 2c 39 38 30 38 35 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 39 35 39 33 31 38 29 2c 6f 3d 4d 61 74 68 2e 6d 61 78 2c 69 3d 4d 61 74 68 2e 6d 69 6e 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 72 3d 65 28 74 29 3b 72 65 74 75 72 6e 20 72 3c 30 3f 6f 28 72 2b 6e 2c 30 29 3a 69 28 72 2c 6e 29 7d 7d 2c 32 39 39 36 32 33 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 34 37 30 35 39 32 29 2c 6f 3d 72 28 36 37 36 31 32 35 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f Data Ascii: (t)\|\|!(Object(t) instanceof Symbol)\|\|!Symbol.sham&&e&&e<41})},980855:function(t,n,r){var e=r(959318),o=Math.max,i=Math.min;t.exports=function(t,n){var r=e(t);return r<0?o(r+n,0):i(r,n)}},299623:function(t,n,r){var e=r(470592),o=r(676125);t.exports=functio
2024-10-24 07:15:46 UTC	1053	IN	Data Raw: 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 7d 2c 37 33 33 36 36 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 33 32 35 30 30 38 29 2c 6f 3d 72 28 39 33 36 39 34 30 29 3b 74 2e 65 78 70 6f 72 74 73 3d 65 26 26 6f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 34 32 21 3d 3d 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 22 70 72 6f 74 6f 74 79 70 65 22 2c 7b 76 61 6c 75 65 3a 34 32 2c 77 72 69 74 61 62 6c 65 3a 21 31 7d 29 2e 70 72 6f 74 6f 74 79 70 65 7d 29 7d 2c 31 39 37 30 34 37 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 31 36 31 35 38 31 29 2c 6f 3d 72 28 33 35 34 38 34 38 29 2c 69 3d 65 2e 57 65 61 6b 4d 61 70 3b 74 2e Data Ascii: Symbol.iterator},733669:function(t,n,r){var e=r(325008),o=r(936940);t.exports=e&&o(function(){return 42!==Object.defineProperty(function(){},"prototype",{value:42,writable:!1}).prototype})},197047:function(t,n,r){var e=r(161581),o=r(354848),i=e.WeakMap;t.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.7	49865	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:46 UTC	868	OUT	GET /assets/a14c32460cf87caa605c.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:46 UTC	962	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:46 GMT Content-Type: text/javascript Content-Length: 12443 Connection: close CF-Ray: 8d782d78eecce546-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "1fb8462302f6fbb9323f187505f5393f" Last-Modified: Tue, 15 Oct 2024 21:50:01 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fKojT7NoES6aRi%2BoX%2BCbC0SvfiU2qZ2ceTbxX8hAt84xOGokHoVg1MEHPx9ZOtTedtHVNeNX7F9OOv0hvmRzdrUjAmqpAkHZWrvcbypCWN%2F42ecVDrYQylHyhulA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:46 UTC	407	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 39 35 33 39 33 22 5d 2c 7b 33 39 32 34 35 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 2c 25 33 43 73 76 67 20 78 6d 6c 6e 73 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 27 20 76 69 65 77 42 6f 78 3d 27 30 20 30 20 36 36 20 33 38 27 20 77 69 64 74 68 3d 27 36 36 27 20 68 65 69 67 68 74 3d 27 33 38 27 25 33 45 25 33 43 72 65 63 74 20 78 3d 27 30 27 20 79 3d 27 30 27 20 77 69 64 74 68 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["95393"],{392459:function(e){e.exports="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 66 38' width='66' height='38'%3E%3Crect x='0' y='0' width
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 6c 6e 73 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 27 20 76 69 65 77 42 6f 78 3d 27 36 2e 31 32 32 20 35 2e 38 36 34 20 32 35 39 20 35 30 27 20 77 69 64 74 68 3d 27 32 35 39 27 20 68 65 69 67 68 74 3d 27 35 30 27 25 33 45 25 33 43 70 61 74 68 20 66 69 6c 6c 3d 27 25 32 33 30 30 30 30 30 30 27 20 66 69 6c 6c 2d 72 75 6c 65 3d 27 65 76 65 6e 6f 64 64 27 20 64 3d 27 4d 20 36 38 2e 31 32 32 20 31 31 2e 38 36 34 20 4c 20 31 39 32 2e 31 32 32 20 31 31 2e 38 36 34 20 43 20 31 39 33 2e 37 37 39 20 31 31 2e 38 36 34 20 31 39 35 2e 31 32 32 20 31 33 2e 32 30 37 20 31 39 35 2e 31 32 32 20 31 34 2e 38 36 34 20 4c 20 31 39 35 2e 31 32 32 20 32 38 2e 38 36 34 20 43 20 31 39 35 2e 31 32 32 20 33 30 2e 35 32 31 20 31 39 33 2e 37 Data Ascii: lns='http://www.w3.org/2000/svg' viewBox='6.122 5.864 259 50' width='259' height='50'%3E%3Cpath fill='%23000000' fill-rule='evenodd' d='M 68.122 11.864 L 192.122 11.864 C 193.779 11.864 195.122 13.207 195.122 14.864 L 195.122 28.864 C 195.122 30.521 193.7
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 32 31 30 29 2c 69 3d 6c 28 35 39 34 31 37 34 29 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 6c 65 74 20 6e 3d 28 30 2c 74 2e 65 37 29 28 5b 69 2e 64 65 66 61 75 6c 74 5d 2c 28 29 3d 3e 69 2e 64 65 66 61 75 6c 74 2e 67 65 74 55 73 65 72 28 6e 75 6c 6c 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 63 72 65 61 74 6f 72 5f 69 64 29 2c 5b 65 5d 29 3b 72 65 74 75 72 6e 20 73 2e 75 73 65 45 66 66 65 63 74 28 28 29 3d 3e 7b 6e 75 6c 6c 3d 3d 6e 26 26 28 6e 75 6c 6c 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 63 72 65 61 74 6f 72 5f 69 64 29 21 3d 6e 75 6c 6c 26 26 61 2e 5a 2e 72 65 71 75 65 73 74 4d 65 6d 62 65 72 73 42 79 49 64 28 65 2e 67 75 69 6c 64 5f 69 64 2c 65 2e 63 72 65 61 74 6f 72 5f 69 64 29 7d 2c 5b 65 2c 6e 5d 29 2c 6e 7d 7d 2c 31 31 38 36 38 3a 66 75 6e 63 74 Data Ascii: 210),i=l(594174);function o(e){let n=(0,t.e7)([i.default],()=>i.default.getUser(null==e?void 0:e.creator_id),[e]);return s.useEffect(()=>{null==n&&(null==e?void 0:e.creator_id)!=null&&a.Z.requestMembersById(e.guild_id,e.creator_id)},[e,n]),n}},11868:funct
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 69 66 28 6e 75 6c 6c 3d 3d 4e 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 6c 65 74 20 49 3d 6e 75 6c 6c 3d 3d 43 3f 76 6f 69 64 20 30 3a 43 2e 49 63 6f 6e 43 6f 6d 70 6f 6e 65 6e 74 2c 78 3d 28 30 2c 73 2e 6a 73 78 73 29 28 73 2e 46 72 61 67 6d 65 6e 74 2c 7b 63 68 69 6c 64 72 65 6e 3a 5b 6e 75 6c 6c 21 3d 49 26 26 28 30 2c 73 2e 6a 73 78 29 28 49 2c 7b 73 69 7a 65 3a 22 78 73 22 2c 63 6f 6c 6f 72 3a 22 63 75 72 72 65 6e 74 43 6f 6c 6f 72 22 2c 63 6c 61 73 73 4e 61 6d 65 3a 6b 2e 63 68 61 6e 6e 65 6c 49 63 6f 6e 7d 29 2c 28 30 2c 73 2e 6a 73 78 29 28 72 2e 54 65 78 74 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 6b 2e 63 68 61 6e 6e 65 6c 44 65 73 63 72 69 70 74 69 6f 6e 2c 76 61 72 69 61 6e 74 3a 22 74 65 78 74 2d 78 73 2f 6e 6f 72 6d 61 6c 22 2c 63 68 69 6c 64 72 65 Data Ascii: if(null==N)return null;let I=null==C?void 0:C.IconComponent,x=(0,s.jsxs)(s.Fragment,{children:[null!=I&&(0,s.jsx)(I,{size:"xs",color:"currentColor",className:k.channelIcon}),(0,s.jsx)(r.Text,{className:k.channelDescription,variant:"text-xs/normal",childre
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 6f 6e 2e 53 69 7a 65 73 2e 53 4d 41 4c 4c 2c 6f 6e 43 6c 69 63 6b 3a 65 3d 3e 7b 21 63 26 26 76 28 65 29 7d 2c 63 6f 6c 6f 72 3a 63 3f 72 2e 42 75 74 74 6f 6e 2e 43 6f 6c 6f 72 73 2e 54 52 41 4e 53 50 41 52 45 4e 54 3a 72 2e 42 75 74 74 6f 6e 2e 43 6f 6c 6f 72 73 2e 47 52 45 45 4e 2c 63 68 69 6c 64 72 65 6e 3a 63 3f 5a 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 53 43 48 45 44 55 4c 45 44 5f 45 56 45 4e 54 5f 56 49 45 57 5f 44 45 54 41 49 4c 3a 5a 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 4a 4f 49 4e 5f 47 55 49 4c 44 7d 29 3a 69 3f 28 30 2c 73 2e 6a 73 78 29 28 72 2e 42 75 74 74 6f 6e 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 6b 2e 62 75 74 74 6f 6e 2c 73 69 7a 65 3a 72 2e 42 75 74 74 6f 6e 2e 53 69 7a 65 73 2e 53 4d 41 4c 4c 2c 64 69 73 61 62 6c 65 64 3a Data Ascii: on.Sizes.SMALL,onClick:e=>{!c&&v(e)},color:c?r.Button.Colors.TRANSPARENT:r.Button.Colors.GREEN,children:c?Z.Z.Messages.GUILD_SCHEDULED_EVENT_VIEW_DETAIL:Z.Z.Messages.JOIN_GUILD}):i?(0,s.jsx)(r.Button,{className:k.button,size:r.Button.Sizes.SMALL,disabled:
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 20 54 3d 28 30 2c 45 2e 78 74 29 28 6c 29 2c 5f 3d 28 30 2c 45 2e 5a 32 29 28 6c 29 2c 5a 3d 6c 2e 65 6e 74 69 74 79 5f 74 79 70 65 3d 3d 3d 42 2e 57 58 2e 45 58 54 45 52 4e 41 4c 3b 72 65 74 75 72 6e 28 30 2c 73 2e 6a 73 78 29 28 6d 2e 5a 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 69 28 29 28 7b 5b 6b 2e 63 6c 69 63 6b 61 62 6c 65 5d 3a 75 7d 29 2c 63 68 69 6c 64 72 65 6e 3a 28 30 2c 73 2e 6a 73 78 73 29 28 72 2e 43 6c 69 63 6b 61 62 6c 65 2c 7b 6f 6e 43 6c 69 63 6b 3a 67 2c 63 68 69 6c 64 72 65 6e 3a 5b 6e 75 6c 6c 21 3d 6c 2e 69 6d 61 67 65 26 26 28 30 2c 73 2e 6a 73 78 29 28 66 2e 5a 2c 7b 73 6f 75 72 63 65 3a 28 30 2c 4c 2e 5a 29 28 6c 29 2c 63 6c 61 73 73 4e 61 6d 65 3a 6b 2e 62 61 6e 6e 65 72 7d 29 2c 28 30 2c 73 2e 6a 73 78 29 28 53 2e 5a 50 2c 7b 6e 61 Data Ascii: T=(0,E.xt)(l),_=(0,E.Z2)(l),Z=l.entity_type===B.WX.EXTERNAL;return(0,s.jsx)(m.Z,{className:i()({[k.clickable]:u}),children:(0,s.jsxs)(r.Clickable,{onClick:g,children:[null!=l.image&&(0,s.jsx)(f.Z,{source:(0,L.Z)(l),className:k.banner}),(0,s.jsx)(S.ZP,{na
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 54 45 44 3f 72 2e 67 76 2e 55 4e 49 4e 54 45 52 45 53 54 45 44 3a 72 2e 67 76 2e 49 4e 54 45 52 45 53 54 45 44 2c 45 3d 68 3d 3d 3d 72 2e 67 76 2e 49 4e 54 45 52 45 53 54 45 44 3f 75 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 53 43 48 45 44 55 4c 45 44 5f 45 56 45 4e 54 5f 52 53 56 50 5f 50 49 43 4b 45 52 5f 48 45 41 44 45 52 5f 49 4e 54 45 52 45 53 54 45 44 3a 75 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 53 43 48 45 44 55 4c 45 44 5f 45 56 45 4e 54 5f 52 53 56 50 5f 50 49 43 4b 45 52 5f 48 45 41 44 45 52 5f 55 4e 49 4e 54 45 52 45 53 54 45 44 3b 72 65 74 75 72 6e 28 30 2c 73 2e 6a 73 78 29 28 61 2e 43 6f 6e 66 69 72 6d 4d 6f 64 61 6c 2c 7b 2e 2e 2e 4e 2c 68 65 61 64 65 72 3a 45 2c 63 6f 6e 66 69 72 6d 54 65 78 74 3a 75 2e 5a 2e 4d Data Ascii: TED?r.gv.UNINTERESTED:r.gv.INTERESTED,E=h===r.gv.INTERESTED?u.Z.Messages.GUILD_SCHEDULED_EVENT_RSVP_PICKER_HEADER_INTERESTED:u.Z.Messages.GUILD_SCHEDULED_EVENT_RSVP_PICKER_HEADER_UNINTERESTED;return(0,s.jsx)(a.ConfirmModal,{...N,header:E,confirmText:u.Z.M
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 78 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 67 2e 72 65 73 6f 6c 76 69 6e 67 42 61 63 6b 67 72 6f 75 6e 64 7d 29 7d 29 2c 28 30 2c 73 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 67 2e 72 65 73 6f 6c 76 69 6e 67 46 61 6b 65 42 75 74 74 6f 6e 2c 63 68 69 6c 64 72 65 6e 3a 28 30 2c 73 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 67 2e 72 65 73 6f 6c 76 69 6e 67 42 61 63 6b 67 72 6f 75 6e 64 7d 29 7d 29 5d 7d 29 3a 6c 7d 29 7d 2c 6a 3d 65 3d 3e 7b 76 61 72 20 6e 3b 6c 65 74 7b 61 70 70 6c 69 63 61 74 69 6f 6e 3a 6c 2c 67 75 69 6c 64 3a 74 2c 63 68 61 6e 6e 65 6c 3a 61 2c 6f 6e 43 6c 69 63 6b 3a 63 2c 65 78 70 69 72 65 64 3a 64 3d 21 31 2c 75 73 65 72 3a 76 2c 63 6c 61 73 73 4e 61 6d 65 3a 70 7d Data Ascii: x)("div",{className:g.resolvingBackground})}),(0,s.jsx)("div",{className:g.resolvingFakeButton,children:(0,s.jsx)("div",{className:g.resolvingBackground})})]}):l})},j=e=>{var n;let{application:l,guild:t,channel:a,onClick:c,expired:d=!1,user:v,className:p}
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 65 3d 3e 7b 6c 65 74 7b 6d 65 6d 62 65 72 73 4f 6e 6c 69 6e 65 3a 6e 2c 6d 65 6d 62 65 72 73 3a 6c 7d 3d 65 2c 74 3d 5b 5d 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 6e 26 26 6e 3e 30 26 26 74 2e 70 75 73 68 28 28 30 2c 73 2e 6a 73 78 73 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 67 2e 73 74 61 74 75 73 57 72 61 70 70 65 72 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 73 2e 6a 73 78 29 28 22 69 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 67 2e 73 74 61 74 75 73 4f 6e 6c 69 6e 65 7d 29 2c 28 30 2c 73 2e 6a 73 78 29 28 22 73 70 61 6e 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 67 2e 63 6f 75 6e 74 2c 63 68 69 6c 64 72 65 6e 3a 45 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 49 4e 53 54 41 4e 54 5f 49 4e 56 49 54 45 5f 47 55 49 4c 44 5f 4d 45 4d 42 45 52 53 5f 4f 4e Data Ascii: e=>{let{membersOnline:n,members:l}=e,t=[];return null!=n&&n>0&&t.push((0,s.jsxs)("div",{className:g.statusWrapper,children:[(0,s.jsx)("i",{className:g.statusOnline}),(0,s.jsx)("span",{className:g.count,children:E.Z.Messages.INSTANT_INVITE_GUILD_MEMBERS_ON
2024-10-24 07:15:46 UTC	1084	IN	Data Raw: 73 68 2c 73 69 7a 65 3a 34 30 30 2a 28 30 2c 76 2e 78 5f 29 28 29 7d 29 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 6f 3f 6e 75 6c 6c 3a 28 30 2c 73 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 67 2e 69 6e 76 69 74 65 53 70 6c 61 73 68 2c 63 68 69 6c 64 72 65 6e 3a 28 30 2c 73 2e 6a 73 78 29 28 22 69 6d 67 22 2c 7b 73 72 63 3a 6f 2c 61 6c 74 3a 22 22 2c 63 6c 61 73 73 4e 61 6d 65 3a 69 28 29 28 67 2e 69 6e 76 69 74 65 53 70 6c 61 73 68 49 6d 61 67 65 2c 7b 5b 67 2e 69 6e 76 69 74 65 53 70 6c 61 73 68 49 6d 61 67 65 4c 6f 61 64 65 64 5d 3a 6c 7d 29 2c 6f 6e 4c 6f 61 64 3a 28 29 3d 3e 61 28 21 30 29 7d 29 7d 29 7d 2c 5a 3d 65 3d 3e 7b 6c 65 74 7b 67 75 69 6c 64 3a 6e 7d 3d 65 3b 72 65 74 75 72 6e 28 30 2c 73 2e 6a 73 78 29 28 22 64 69 Data Ascii: sh,size:400*(0,v.x_)()});return null==o?null:(0,s.jsx)("div",{className:g.inviteSplash,children:(0,s.jsx)("img",{src:o,alt:"",className:i()(g.inviteSplashImage,{[g.inviteSplashImageLoaded]:l}),onLoad:()=>a(!0)})})},Z=e=>{let{guild:n}=e;return(0,s.jsx)("di

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.7	49864	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:46 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:46 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:46 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 95bc9e17-201e-0051-77f2-247340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071546Z-15b8d89586f989rks44whx5v7s0000000drg00000000a0aw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:46 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.7	49870	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:46 UTC	868	OUT	GET /assets/94ec0c2b39908933eed3.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:46 UTC	964	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:46 GMT Content-Type: text/javascript Content-Length: 20718 Connection: close CF-Ray: 8d782d79bf9547ab-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "a2754accda171158f8f581ad49dfbb9c" Last-Modified: Fri, 18 Oct 2024 01:03:30 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=25aoCYaKSWq1yIEQTiiRcUxqY0ltVZQrSNqvIANsgjFf1aZllXiFF8hDGuEaWSCV5%2Bu6ZoEGMqp%2FlKcpXPobqEwHqL3Zpcz6lPrsHD%2B4KkInhYw34R8s%2FQbPNrHV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:46 UTC	405	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 32 35 37 38 38 22 5d 2c 7b 35 33 33 33 30 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6c 65 74 20 69 3b 76 61 72 20 73 3d 6e 28 35 34 34 38 39 31 29 2c 72 3d 6e 28 35 37 30 31 34 30 29 2c 6c 3d 6e 28 37 32 38 33 34 35 29 2c 6f 3d 6e 28 38 31 32 32 30 36 29 2c 61 3d 6e 28 36 32 35 31 32 38 29 2c 64 3d 6e 28 33 33 35 31 33 31 29 2c 75 3d 6e 28 36 36 39 30 37 39 29 2c 63 3d 6e 28 39 38 31 36 33 31 29 2c 5f 3d 6e 28 34 37 34 39 33 36 29 3b 61 73 79 6e 63 20 66 75 6e 63 74 69 6f 6e 20 45 28 65 29 7b Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["25788"],{533307:function(e,t,n){let i;var s=n(544891),r=n(570140),l=n(728345),o=n(812206),a=n(625128),d=n(335131),u=n(669079),c=n(981631),_=n(474936);async function E(e){
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 52 45 53 4f 4c 56 45 22 2c 63 6f 64 65 3a 65 7d 29 3b 74 72 79 7b 6c 65 74 20 69 3d 61 77 61 69 74 20 28 30 2c 75 2e 62 54 29 28 65 2c 74 2c 6e 29 3b 69 66 28 6e 75 6c 6c 21 3d 69 2e 61 70 70 6c 69 63 61 74 69 6f 6e 5f 69 64 26 26 69 2e 61 70 70 6c 69 63 61 74 69 6f 6e 5f 69 64 21 3d 3d 5f 2e 43 4c 29 7b 6c 65 74 20 65 3d 6f 2e 5a 2e 67 65 74 41 70 70 6c 69 63 61 74 69 6f 6e 28 69 2e 61 70 70 6c 69 63 61 74 69 6f 6e 5f 69 64 29 3b 69 66 28 6e 75 6c 6c 3d 3d 65 29 74 72 79 7b 61 77 61 69 74 20 6c 2e 5a 50 2e 66 65 74 63 68 41 70 70 6c 69 63 61 74 69 6f 6e 28 69 2e 61 70 70 6c 69 63 61 74 69 6f 6e 5f 69 64 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 69 66 28 69 2e 61 70 70 6c 69 63 61 74 69 6f 6e 5f 69 64 3d 3d 3d 63 2e 58 41 4a 29 74 72 79 7b 61 77 61 69 74 20 Data Ascii: RESOLVE",code:e});try{let i=await (0,u.bT)(e,t,n);if(null!=i.application_id&&i.application_id!==_.CL){let e=o.Z.getApplication(i.application_id);if(null==e)try{await l.ZP.fetchApplication(i.application_id)}catch(e){}}if(i.application_id===c.XAJ)try{await
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 79 7d 29 2c 69 2e 62 6f 64 79 7d 63 61 74 63 68 28 6e 29 7b 72 2e 5a 2e 64 69 73 70 61 74 63 68 28 7b 74 79 70 65 3a 22 47 49 46 54 5f 43 4f 44 45 5f 43 52 45 41 54 45 5f 46 41 49 4c 55 52 45 22 2c 73 6b 75 49 64 3a 65 2c 73 75 62 73 63 72 69 70 74 69 6f 6e 50 6c 61 6e 49 64 3a 74 7d 29 7d 7d 2c 61 73 79 6e 63 20 72 65 76 6f 6b 65 47 69 66 74 43 6f 64 65 28 65 29 7b 72 2e 5a 2e 64 69 73 70 61 74 63 68 28 7b 74 79 70 65 3a 22 47 49 46 54 5f 43 4f 44 45 5f 52 45 56 4f 4b 45 22 2c 63 6f 64 65 3a 65 7d 29 3b 74 72 79 7b 61 77 61 69 74 20 73 2e 74 6e 2e 64 65 6c 28 7b 75 72 6c 3a 63 2e 41 4e 4d 2e 55 53 45 52 5f 47 49 46 54 5f 43 4f 44 45 5f 52 45 56 4f 4b 45 28 65 29 2c 6f 6c 64 46 6f 72 6d 45 72 72 6f 72 73 3a 21 30 7d 29 2c 72 2e 5a 2e 64 69 73 70 61 74 63 Data Ascii: y}),i.body}catch(n){r.Z.dispatch({type:"GIFT_CODE_CREATE_FAILURE",skuId:e,subscriptionPlanId:t})}},async revokeGiftCode(e){r.Z.dispatch({type:"GIFT_CODE_REVOKE",code:e});try{await s.tn.del({url:c.ANM.USER_GIFT_CODE_REVOKE(e),oldFormErrors:!0}),r.Z.dispatc
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 3d 3e 7b 76 61 72 20 74 3b 6c 65 74 7b 73 70 65 61 6b 65 72 3a 6e 2c 67 75 69 6c 64 49 64 3a 73 2c 69 73 45 6d 62 65 64 3a 72 7d 3d 65 2c 6c 3d 6e 65 77 20 45 2e 5a 28 6e 2e 75 73 65 72 29 3b 72 65 74 75 72 6e 28 30 2c 69 2e 6a 73 78 73 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 68 2e 73 70 65 61 6b 65 72 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 69 2e 6a 73 78 29 28 6f 2e 41 76 61 74 61 72 2c 7b 73 72 63 3a 6c 2e 67 65 74 41 76 61 74 61 72 55 52 4c 28 73 2c 72 3f 31 36 3a 32 34 29 2c 73 69 7a 65 3a 72 3f 6f 2e 41 76 61 74 61 72 53 69 7a 65 73 2e 53 49 5a 45 5f 31 36 3a 6f 2e 41 76 61 74 61 72 53 69 7a 65 73 2e 53 49 5a 45 5f 32 34 2c 22 61 72 69 61 2d 6c 61 62 65 6c 22 3a 22 22 2e 63 6f 6e 63 61 74 28 6e 2e 6e 69 63 6b 2c 22 2d 61 76 61 74 Data Ascii: =>{var t;let{speaker:n,guildId:s,isEmbed:r}=e,l=new E.Z(n.user);return(0,i.jsxs)("div",{className:h.speaker,children:[(0,i.jsx)(o.Avatar,{src:l.getAvatarURL(s,r?16:24),size:r?o.AvatarSizes.SIZE_16:o.AvatarSizes.SIZE_24,"aria-label":"".concat(n.nick,"-avat
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 3b 6c 65 74 7b 73 74 61 67 65 49 6e 73 74 61 6e 63 65 3a 6e 2c 67 75 69 6c 64 3a 72 2c 69 73 43 61 72 64 3a 45 3d 21 31 2c 69 73 45 6d 62 65 64 3a 66 3d 21 31 2c 6f 6e 43 6c 69 63 6b 3a 53 7d 3d 65 2c 49 3d 73 2e 75 73 65 4d 65 6d 6f 28 28 29 3d 3e 6e 75 6c 6c 3d 3d 72 3f 6e 75 6c 6c 3a 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 5a 50 3f 72 3a 6e 65 77 20 5f 2e 5a 50 28 72 29 2c 5b 72 5d 29 3b 69 66 28 6e 75 6c 6c 3d 3d 6e 7c 7c 6e 75 6c 6c 3d 3d 49 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 6c 65 74 7b 74 6f 70 69 63 3a 67 2c 73 70 65 61 6b 65 72 5f 63 6f 75 6e 74 3a 43 2c 70 61 72 74 69 63 69 70 61 6e 74 5f 63 6f 75 6e 74 3a 41 7d 3d 6e 2c 76 3d 6e 75 6c 6c 21 3d 3d 28 74 3d 6e 2e 6d 65 6d 62 65 72 73 29 26 26 76 6f 69 64 20 30 21 3d 3d 74 3f 74 3a 5b 5d Data Ascii: ;let{stageInstance:n,guild:r,isCard:E=!1,isEmbed:f=!1,onClick:S}=e,I=s.useMemo(()=>null==r?null:r instanceof _.ZP?r:new _.ZP(r),[r]);if(null==n\|\|null==I)return null;let{topic:g,speaker_count:C,participant_count:A}=n,v=null!==(t=n.members)&&void 0!==t?t:[]
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 6c 28 29 28 68 2e 6d 65 6d 62 65 72 73 2c 7b 5b 68 2e 65 6d 62 65 64 5d 3a 66 7d 29 2c 63 68 69 6c 64 72 65 6e 3a 5b 52 2e 6c 65 6e 67 74 68 3e 30 26 26 28 30 2c 69 2e 6a 73 78 73 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 68 2e 73 70 65 61 6b 65 72 73 2c 63 68 69 6c 64 72 65 6e 3a 5b 52 2e 6d 61 70 28 65 3d 3e 28 30 2c 69 2e 6a 73 78 29 28 6d 2c 7b 73 70 65 61 6b 65 72 3a 65 2c 67 75 69 6c 64 49 64 3a 49 2e 69 64 2c 69 73 45 6d 62 65 64 3a 66 7d 2c 65 2e 75 73 65 72 2e 69 64 29 29 2c 4f 3e 30 3f 28 30 2c 69 2e 6a 73 78 73 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 68 2e 73 70 65 61 6b 65 72 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 69 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b Data Ascii: ("div",{className:l()(h.members,{[h.embed]:f}),children:[R.length>0&&(0,i.jsxs)("div",{className:h.speakers,children:[R.map(e=>(0,i.jsx)(m,{speaker:e,guildId:I.id,isEmbed:f},e.user.id)),O>0?(0,i.jsxs)("div",{className:h.speaker,children:[(0,i.jsx)("div",{
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 28 70 2e 72 4d 78 2e 44 45 45 50 5f 4c 49 4e 4b 5f 43 4c 49 43 4b 45 44 2c 7b 66 69 6e 67 65 72 70 72 69 6e 74 3a 28 30 2c 6f 2e 4b 29 28 6e 2e 66 69 6e 67 65 72 70 72 69 6e 74 29 2c 61 74 74 65 6d 70 74 5f 69 64 3a 6e 2e 61 74 74 65 6d 70 74 49 64 2c 73 6f 75 72 63 65 3a 6e 2e 75 74 6d 53 6f 75 72 63 65 7d 29 2c 45 2e 5a 2e 6c 61 75 6e 63 68 28 74 2c 65 3d 3e 7b 21 65 26 26 28 30 2c 64 2e 64 4c 29 28 63 2e 5a 2e 66 61 6c 6c 62 61 63 6b 52 6f 75 74 65 29 7d 29 7d 7d 2c 31 34 34 31 31 34 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 4c 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 73 7d 7d 29 3b 76 61 72 20 69 2c 73 2c 72 3d 6e 28 39 39 30 35 34 37 29 2c 6c 3d 6e 28 35 34 34 38 39 31 29 2c 6f 3d 6e 28 35 37 30 31 34 30 Data Ascii: (p.rMx.DEEP_LINK_CLICKED,{fingerprint:(0,o.K)(n.fingerprint),attempt_id:n.attemptId,source:n.utmSource}),E.Z.launch(t,e=>{!e&&(0,d.dL)(c.Z.fallbackRoute)})}},144114:function(e,t,n){n.d(t,{L:function(){return s}});var i,s,r=n(990547),l=n(544891),o=n(570140
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 5f 72 65 61 73 6f 6e 3a 6e 7d 2c 6f 6c 64 46 6f 72 6d 45 72 72 6f 72 73 3a 21 30 7d 29 2c 76 61 6c 69 64 61 74 65 50 68 6f 6e 65 46 6f 72 53 75 70 70 6f 72 74 3a 65 3d 3e 6c 2e 74 6e 2e 70 6f 73 74 28 7b 75 72 6c 3a 63 2e 41 4e 4d 2e 56 45 52 49 46 59 5f 50 48 4f 4e 45 5f 46 4f 52 5f 54 49 43 4b 45 54 2c 62 6f 64 79 3a 7b 74 6f 6b 65 6e 3a 65 7d 2c 6f 6c 64 46 6f 72 6d 45 72 72 6f 72 73 3a 21 30 7d 29 2c 61 73 79 6e 63 20 76 65 72 69 66 79 50 68 6f 6e 65 28 65 2c 74 29 7b 6c 65 74 20 6e 3d 21 28 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 32 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 7c 7c 61 72 67 75 6d 65 6e 74 73 5b 32 5d 2c 69 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 33 26 26 76 6f 69 64 20 30 21 3d 3d Data Ascii: _reason:n},oldFormErrors:!0}),validatePhoneForSupport:e=>l.tn.post({url:c.ANM.VERIFY_PHONE_FOR_TICKET,body:{token:e},oldFormErrors:!0}),async verifyPhone(e,t){let n=!(arguments.length>2)\|\|void 0===arguments[2]\|\|arguments[2],i=arguments.length>3&&void 0!==
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 62 6f 74 3a 65 2e 62 6f 74 2c 64 69 73 63 72 69 6d 69 6e 61 74 6f 72 3a 22 30 30 30 30 22 7d 2c 74 2c 38 30 29 7d 66 75 6e 63 74 69 6f 6e 20 45 28 65 29 7b 6c 65 74 20 74 3d 28 30 2c 61 2e 5f 49 29 28 65 2e 75 73 65 72 6e 61 6d 65 29 2e 72 65 70 6c 61 63 65 28 75 2e 52 4e 2c 22 22 29 2e 72 65 70 6c 61 63 65 28 75 2e 69 46 2c 22 2e 22 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 72 65 74 75 72 6e 22 22 2e 63 6f 6e 63 61 74 28 74 29 2e 63 6f 6e 63 61 74 28 65 2e 64 69 73 63 72 69 6d 69 6e 61 74 6f 72 29 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 33 32 29 7d 6c 65 74 20 70 3d 5b 22 40 22 2c 22 23 22 2c 22 3a 22 5d 2c 68 3d 5b 22 60 60 60 22 2c 22 64 69 73 63 6f 72 64 22 2c 22 68 79 70 65 73 71 75 61 64 22 2c 22 73 79 73 74 65 6d 20 6d 65 73 73 61 67 65 22 2c Data Ascii: bot:e.bot,discriminator:"0000"},t,80)}function E(e){let t=(0,a._I)(e.username).replace(u.RN,"").replace(u.iF,".").toLowerCase();return"".concat(t).concat(e.discriminator).substring(0,32)}let p=["@","#",":"],h=["```","discord","hypesquad","system message",
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 4e 54 45 52 4e 41 4c 5f 45 52 52 4f 52 2c 6d 65 73 73 61 67 65 3a 22 22 7d 29 29 2e 6f 74 68 65 72 77 69 73 65 28 28 29 3d 3e 76 6f 69 64 20 30 29 7d 66 75 6e 63 74 69 6f 6e 20 43 28 65 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 44 61 74 65 28 32 30 32 34 2c 32 2c 34 29 2e 74 6f 4c 6f 63 61 6c 65 44 61 74 65 53 74 72 69 6e 67 28 65 2c 7b 6d 6f 6e 74 68 3a 22 6c 6f 6e 67 22 2c 64 61 79 3a 22 6e 75 6d 65 72 69 63 22 2c 79 65 61 72 3a 22 6e 75 6d 65 72 69 63 22 7d 29 7d 7d 2c 31 30 38 34 32 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 64 7d 7d 29 2c 6e 28 34 37 31 32 30 29 3b 76 61 72 20 69 3d 6e 28 37 37 32 38 34 38 29 2c 73 3d 6e 28 35 37 39 38 30 36 29 2c 72 3d 6e 28 36 Data Ascii: NTERNAL_ERROR,message:""})).otherwise(()=>void 0)}function C(e){return new Date(2024,2,4).toLocaleDateString(e,{month:"long",day:"numeric",year:"numeric"})}},108427:function(e,t,n){n.d(t,{e:function(){return d}}),n(47120);var i=n(772848),s=n(579806),r=n(6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.7	49871	162.159.138.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:46 UTC	673	OUT	GET /assets/1f7f046253c197b5a419.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:46 UTC	964	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:46 GMT Content-Type: text/javascript Content-Length: 17462 Connection: close CF-Ray: 8d782d79b97ee7f3-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "3b98c1ef9293d482a5099fdb6984946f" Last-Modified: Tue, 15 Oct 2024 21:50:02 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=reBwmpCsKi%2BTDhDWFgFWz3huWJtuXXunqXLU7dA9S3i%2FG90fOZAPzFxJvSPLYFtXOP%2F4JWipxaKCKSqWrr1Pjbs1z2D4TazlLOYDRJZG88auESsMF9HoZy%2BPZGlX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:46 UTC	405	IN	Data Raw: 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 31 35 38 31 32 22 5d 2c 7b 38 38 34 38 33 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6f 3d 72 28 33 31 31 35 39 36 29 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 7d 69 2e 72 65 73 65 74 57 61 72 6e 69 6e 67 43 61 63 68 65 3d 6e 2c 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 74 2c 65 2c 72 2c 6e 2c 69 2c 61 29 7b 69 66 28 61 21 3d 3d 6f 29 7b 76 61 72 20 75 3d 45 72 72 6f 72 28 22 43 61 6c 6c Data Ascii: (this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["15812"],{884835:function(t,e,r){"use strict";var o=r(311596);function n(){}function i(){}i.resetWarningCache=n,t.exports=function(){function t(t,e,r,n,i,a){if(a!==o){var u=Error("Call
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 2f 75 73 65 2d 63 68 65 63 6b 2d 70 72 6f 70 2d 74 79 70 65 73 22 29 3b 74 68 72 6f 77 20 75 2e 6e 61 6d 65 3d 22 49 6e 76 61 72 69 61 6e 74 20 56 69 6f 6c 61 74 69 6f 6e 22 2c 75 7d 7d 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 72 65 74 75 72 6e 20 74 7d 74 2e 69 73 52 65 71 75 69 72 65 64 3d 74 3b 76 61 72 20 72 3d 7b 61 72 72 61 79 3a 74 2c 62 69 67 69 6e 74 3a 74 2c 62 6f 6f 6c 3a 74 2c 66 75 6e 63 3a 74 2c 6e 75 6d 62 65 72 3a 74 2c 6f 62 6a 65 63 74 3a 74 2c 73 74 72 69 6e 67 3a 74 2c 73 79 6d 62 6f 6c 3a 74 2c 61 6e 79 3a 74 2c 61 72 72 61 79 4f 66 3a 65 2c 65 6c 65 6d 65 6e 74 3a 74 2c 65 6c 65 6d 65 6e 74 54 79 70 65 3a 74 2c 69 6e 73 74 61 6e 63 65 4f 66 3a 65 2c 6e 6f 64 65 3a 74 2c 6f 62 6a 65 63 74 4f 66 3a 65 2c 6f 6e 65 4f 66 3a 65 2c 6f 6e 65 Data Ascii: /use-check-prop-types");throw u.name="Invariant Violation",u}}function e(){return t}t.isRequired=t;var r={array:t,bigint:t,bool:t,func:t,number:t,object:t,string:t,symbol:t,any:t,arrayOf:e,element:t,elementType:t,instanceOf:e,node:t,objectOf:e,oneOf:e,one
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 74 68 2d 72 2b 65 29 3b 66 6f 72 28 76 61 72 20 6f 3d 30 3b 6f 3c 74 2e 6c 65 6e 67 74 68 2d 72 3b 6f 2b 2b 29 74 68 69 73 2e 6e 75 6d 5b 6f 5d 3d 74 5b 6f 2b 72 5d 7d 6e 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6e 75 6d 5b 74 5d 7d 2c 67 65 74 4c 65 6e 67 74 68 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6e 75 6d 2e 6c 65 6e 67 74 68 7d 2c 6d 75 6c 74 69 70 6c 79 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 41 72 72 61 79 28 74 68 69 73 2e 67 65 74 4c 65 6e 67 74 68 28 29 2b 74 2e 67 65 74 4c 65 6e 67 74 68 28 29 2d 31 29 2c 72 3d 30 3b 72 3c 74 68 69 73 2e 67 65 74 4c 65 6e 67 74 68 28 29 3b 72 2b 2b 29 66 6f 72 28 76 61 72 Data Ascii: th-r+e);for(var o=0;o<t.length-r;o++)this.num[o]=t[o+r]}n.prototype={get:function(t){return this.num[t]},getLength:function(){return this.num.length},multiply:function(t){for(var e=Array(this.getLength()+t.getLength()-1),r=0;r<this.getLength();r++)for(var
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 6d 6f 64 65 2c 34 29 2c 72 2e 70 75 74 28 73 2e 67 65 74 4c 65 6e 67 74 68 28 29 2c 61 2e 67 65 74 4c 65 6e 67 74 68 49 6e 42 69 74 73 28 73 2e 6d 6f 64 65 2c 74 29 29 2c 73 2e 77 72 69 74 65 28 72 29 7d 69 66 28 72 2e 67 65 74 4c 65 6e 67 74 68 49 6e 42 69 74 73 28 29 3c 3d 38 2a 6f 29 62 72 65 61 6b 7d 74 68 69 73 2e 74 79 70 65 4e 75 6d 62 65 72 3d 74 7d 74 68 69 73 2e 6d 61 6b 65 49 6d 70 6c 28 21 31 2c 74 68 69 73 2e 67 65 74 42 65 73 74 4d 61 73 6b 50 61 74 74 65 72 6e 28 29 29 7d 2c 6c 2e 6d 61 6b 65 49 6d 70 6c 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 74 68 69 73 2e 6d 6f 64 75 6c 65 43 6f 75 6e 74 3d 34 2a 74 68 69 73 2e 74 79 70 65 4e 75 6d 62 65 72 2b 31 37 2c 74 68 69 73 2e 6d 6f 64 75 6c 65 73 3d 41 72 72 61 79 28 74 68 69 73 2e 6d 6f 64 Data Ascii: mode,4),r.put(s.getLength(),a.getLengthInBits(s.mode,t)),s.write(r)}if(r.getLengthInBits()<=8o)break}this.typeNumber=t}this.makeImpl(!1,this.getBestMaskPattern())},l.makeImpl=function(t,e){this.moduleCount=4this.typeNumber+17,this.modules=Array(this.mod
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 20 69 3d 31 2a 6e 2c 61 3d 30 3b 61 3c 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 6e 5d 2e 6c 65 6e 67 74 68 3b 61 2b 2b 29 7b 76 61 72 20 75 3d 31 2a 61 3b 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 6e 5d 5b 61 5d 26 26 28 6f 2e 62 65 67 69 6e 46 69 6c 6c 28 30 2c 31 30 30 29 2c 6f 2e 6d 6f 76 65 54 6f 28 75 2c 69 29 2c 6f 2e 6c 69 6e 65 54 6f 28 75 2b 31 2c 69 29 2c 6f 2e 6c 69 6e 65 54 6f 28 75 2b 31 2c 69 2b 31 29 2c 6f 2e 6c 69 6e 65 54 6f 28 75 2c 69 2b 31 29 2c 6f 2e 65 6e 64 46 69 6c 6c 28 29 29 7d 7d 72 65 74 75 72 6e 20 6f 7d 2c 6c 2e 73 65 74 75 70 54 69 6d 69 6e 67 50 61 74 74 65 72 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 38 3b 74 3c 74 68 69 73 2e 6d 6f 64 75 6c 65 43 6f 75 6e 74 2d 38 3b 74 2b 2b 29 7b 69 66 28 6e 75 6c Data Ascii: i=1n,a=0;a<this.modules[n].length;a++){var u=1a;this.modules[n][a]&&(o.beginFill(0,100),o.moveTo(u,i),o.lineTo(u+1,i),o.lineTo(u+1,i+1),o.lineTo(u,i+1),o.endFill())}}return o},l.setupTimingPattern=function(){for(var t=8;t<this.moduleCount-8;t++){if(nul
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 2e 6d 6f 64 75 6c 65 43 6f 75 6e 74 2d 38 5d 5b 38 5d 3d 21 74 7d 2c 6c 2e 6d 61 70 44 61 74 61 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 2d 31 2c 6f 3d 74 68 69 73 2e 6d 6f 64 75 6c 65 43 6f 75 6e 74 2d 31 2c 6e 3d 37 2c 69 3d 30 2c 75 3d 74 68 69 73 2e 6d 6f 64 75 6c 65 43 6f 75 6e 74 2d 31 3b 75 3e 30 3b 75 2d 3d 32 29 66 6f 72 28 36 3d 3d 75 26 26 75 2d 2d 3b 3b 29 7b 66 6f 72 28 76 61 72 20 73 3d 30 3b 73 3c 32 3b 73 2b 2b 29 69 66 28 6e 75 6c 6c 3d 3d 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 6f 5d 5b 75 2d 73 5d 29 7b 76 61 72 20 6c 3d 21 31 3b 69 3c 74 2e 6c 65 6e 67 74 68 26 26 28 6c 3d 28 74 5b 69 5d 3e 3e 3e 6e 26 31 29 3d 3d 31 29 2c 61 2e 67 65 74 4d 61 73 6b 28 65 2c 6f 2c 75 2d 73 29 26 26 28 6c 3d 21 6c 29 2c Data Ascii: .moduleCount-8][8]=!t},l.mapData=function(t,e){for(var r=-1,o=this.moduleCount-1,n=7,i=0,u=this.moduleCount-1;u>0;u-=2)for(6==u&&u--;;){for(var s=0;s<2;s++)if(null==this.modules[o][u-s]){var l=!1;i<t.length&&(l=(t[i]>>>n&1)==1),a.getMask(e,o,u-s)&&(l=!l),
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 67 74 68 3b 67 2b 2b 29 76 2b 3d 65 5b 67 5d 2e 74 6f 74 61 6c 43 6f 75 6e 74 3b 66 6f 72 28 76 61 72 20 6d 3d 41 72 72 61 79 28 76 29 2c 54 3d 30 2c 67 3d 30 3b 67 3c 6f 3b 67 2b 2b 29 66 6f 72 28 76 61 72 20 6c 3d 30 3b 6c 3c 65 2e 6c 65 6e 67 74 68 3b 6c 2b 2b 29 67 3c 69 5b 6c 5d 2e 6c 65 6e 67 74 68 26 26 28 6d 5b 54 2b 2b 5d 3d 69 5b 6c 5d 5b 67 5d 29 3b 66 6f 72 28 76 61 72 20 67 3d 30 3b 67 3c 6e 3b 67 2b 2b 29 66 6f 72 28 76 61 72 20 6c 3d 30 3b 6c 3c 65 2e 6c 65 6e 67 74 68 3b 6c 2b 2b 29 67 3c 73 5b 6c 5d 2e 6c 65 6e 67 74 68 26 26 28 6d 5b 54 2b 2b 5d 3d 73 5b 6c 5d 5b 67 5d 29 3b 72 65 74 75 72 6e 20 6d 7d 2c 74 2e 65 78 70 6f 72 74 73 3d 73 7d 2c 38 36 30 33 37 37 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 76 61 72 20 6f 3d 72 28 39 Data Ascii: gth;g++)v+=e[g].totalCount;for(var m=Array(v),T=0,g=0;g<o;g++)for(var l=0;l<e.length;l++)g<i[l].length&&(m[T++]=i[l][g]);for(var g=0;g<n;g++)for(var l=0;l<e.length;l++)g<s[l].length&&(m[T++]=s[l][g]);return m},t.exports=s},860377:function(t,e,r){var o=r(9
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 2c 31 32 31 5d 2c 5b 39 2c 36 39 2c 34 33 2c 34 2c 37 30 2c 34 34 5d 2c 5b 31 37 2c 35 30 2c 32 32 2c 31 2c 35 31 2c 32 33 5d 2c 5b 32 2c 34 32 2c 31 34 2c 31 39 2c 34 33 2c 31 35 5d 2c 5b 33 2c 31 34 31 2c 31 31 33 2c 34 2c 31 34 32 2c 31 31 34 5d 2c 5b 33 2c 37 30 2c 34 34 2c 31 31 2c 37 31 2c 34 35 5d 2c 5b 31 37 2c 34 37 2c 32 31 2c 34 2c 34 38 2c 32 32 5d 2c 5b 39 2c 33 39 2c 31 33 2c 31 36 2c 34 30 2c 31 34 5d 2c 5b 33 2c 31 33 35 2c 31 30 37 2c 35 2c 31 33 36 2c 31 30 38 5d 2c 5b 33 2c 36 37 2c 34 31 2c 31 33 2c 36 38 2c 34 32 5d 2c 5b 31 35 2c 35 34 2c 32 34 2c 35 2c 35 35 2c 32 35 5d 2c 5b 31 35 2c 34 33 2c 31 35 2c 31 30 2c 34 34 2c 31 36 5d 2c 5b 34 2c 31 34 34 2c 31 31 36 2c 34 2c 31 34 35 2c 31 31 37 5d 2c 5b 31 37 2c 36 38 2c 34 32 5d 2c 5b Data Ascii: ,121],[9,69,43,4,70,44],[17,50,22,1,51,23],[2,42,14,19,43,15],[3,141,113,4,142,114],[3,70,44,11,71,45],[17,47,21,4,48,22],[9,39,13,16,40,14],[3,135,107,5,136,108],[3,67,41,13,68,42],[15,54,24,5,55,25],[15,43,15,10,44,16],[4,144,116,4,145,117],[17,68,42],[
2024-10-24 07:15:46 UTC	1369	IN	Data Raw: 34 2c 31 34 2c 35 35 2c 32 35 5d 2c 5b 32 32 2c 34 35 2c 31 35 2c 34 31 2c 34 36 2c 31 36 5d 2c 5b 36 2c 31 35 31 2c 31 32 31 2c 31 34 2c 31 35 32 2c 31 32 32 5d 2c 5b 36 2c 37 35 2c 34 37 2c 33 34 2c 37 36 2c 34 38 5d 2c 5b 34 36 2c 35 34 2c 32 34 2c 31 30 2c 35 35 2c 32 35 5d 2c 5b 32 2c 34 35 2c 31 35 2c 36 34 2c 34 36 2c 31 36 5d 2c 5b 31 37 2c 31 35 32 2c 31 32 32 2c 34 2c 31 35 33 2c 31 32 33 5d 2c 5b 32 39 2c 37 34 2c 34 36 2c 31 34 2c 37 35 2c 34 37 5d 2c 5b 34 39 2c 35 34 2c 32 34 2c 31 30 2c 35 35 2c 32 35 5d 2c 5b 32 34 2c 34 35 2c 31 35 2c 34 36 2c 34 36 2c 31 36 5d 2c 5b 34 2c 31 35 32 2c 31 32 32 2c 31 38 2c 31 35 33 2c 31 32 33 5d 2c 5b 31 33 2c 37 34 2c 34 36 2c 33 32 2c 37 35 2c 34 37 5d 2c 5b 34 38 2c 35 34 2c 32 34 2c 31 34 2c 35 35 2c Data Ascii: 4,14,55,25],[22,45,15,41,46,16],[6,151,121,14,152,122],[6,75,47,34,76,48],[46,54,24,10,55,25],[2,45,15,64,46,16],[17,152,122,4,153,123],[29,74,46,14,75,47],[49,54,24,10,55,25],[24,45,15,46,46,16],[4,152,122,18,153,123],[13,74,46,32,75,47],[48,54,24,14,55,
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 70 6f 72 74 73 3d 65 7d 2c 33 33 38 30 39 31 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 7b 4d 4f 44 45 5f 4e 55 4d 42 45 52 3a 31 2c 4d 4f 44 45 5f 41 4c 50 48 41 5f 4e 55 4d 3a 32 2c 4d 4f 44 45 5f 38 42 49 54 5f 42 59 54 45 3a 34 2c 4d 4f 44 45 5f 4b 41 4e 4a 49 3a 38 7d 7d 2c 37 34 36 32 37 32 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 76 61 72 20 6f 3d 72 28 33 33 38 30 39 31 29 2c 6e 3d 72 28 36 36 39 30 31 33 29 2c 69 3d 72 28 34 36 35 37 35 38 29 2c 61 3d 7b 50 41 54 54 45 52 4e 30 30 30 3a 30 2c 50 41 54 54 45 52 4e 30 30 31 3a 31 2c 50 41 54 54 45 52 4e 30 31 30 3a 32 2c 50 41 54 54 45 52 4e 30 31 31 3a 33 2c 50 41 54 54 45 52 4e 31 30 30 3a 34 2c 50 41 54 54 45 52 4e 31 30 31 3a 35 2c 50 41 54 54 45 52 4e 31 31 Data Ascii: ports=e},338091:function(t){t.exports={MODE_NUMBER:1,MODE_ALPHA_NUM:2,MODE_8BIT_BYTE:4,MODE_KANJI:8}},746272:function(t,e,r){var o=r(338091),n=r(669013),i=r(465758),a={PATTERN000:0,PATTERN001:1,PATTERN010:2,PATTERN011:3,PATTERN100:4,PATTERN101:5,PATTERN11

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.7	49868	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:46 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:46 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:46 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 332ff9ef-a01e-003d-42f3-2498d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071546Z-r197bdfb6b4kzncf21qcaynxz800000001mg000000003hkd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:46 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.7	49869	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:46 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:46 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:46 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 654233af-a01e-001e-0b27-2149ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071546Z-16849878b7877w64p2ge9s25rg00000000zg000000002g40 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:46 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.7	49867	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:46 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:47 UTC	591	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:46 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 0c5aa6f6-c01e-000b-5d92-25e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071546Z-16849878b78k8q5pxkgux3mbgg000000078g00000000ddq2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-24 07:15:47 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.7	49859	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:46 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:15:47 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:47 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 6115116d-c01e-00a1-6ef4-247e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071547Z-15b8d89586f6nn8zquf2vw6t5400000004d000000000euty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:15:47 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.7	49872	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:47 UTC	868	OUT	GET /assets/36e086bbcea2eace814d.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:47 UTC	964	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:47 GMT Content-Type: text/javascript Content-Length: 18183 Connection: close CF-Ray: 8d782d7b78a06b6a-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "cb2e31554ec3ce69856dd70c281a6db7" Last-Modified: Tue, 15 Oct 2024 21:50:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5LYQo89EKEsKnlDIuVjxmr6%2Fkd3RTg73eX5j2fkCMfjpd8htvCLo4ji9%2FCpnK67D9T%2BcmcjjTOxQ2UyMsxcebFwxxNcrBDO05Wll6ZWlf%2F25pZiGjbS9870etp9W"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 31 30 37 37 38 22 5d 2c 7b 34 31 38 37 35 37 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 62 37 64 31 64 63 36 62 30 37 34 36 31 30 31 37 31 39 63 35 2e 70 6e 67 22 7d 2c 34 39 34 32 30 37 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 38 35 31 35 33 66 65 37 31 38 37 33 64 61 30 66 35 38 30 32 2e 73 76 67 22 7d 2c 33 32 30 34 34 30 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["10778"],{418757:function(e){e.exports="/assets/b7d1dc6b0746101719c5.png"},494207:function(e){e.exports="/assets/85153fe71873da0f5802.svg"},320440:function(e){e.exports="/
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 36 36 39 35 37 4c 35 31 2e 30 33 35 34 20 33 2e 36 32 36 36 31 43 35 31 2e 39 37 38 33 20 33 2e 39 31 32 32 37 20 35 32 2e 39 30 35 37 20 34 2e 32 33 33 36 32 20 35 33 2e 38 31 36 31 20 34 2e 35 38 39 31 31 43 35 34 2e 31 33 31 31 20 33 2e 39 38 37 35 33 20 35 34 2e 34 38 33 32 20 33 2e 34 30 38 34 37 20 35 34 2e 38 36 39 34 20 32 2e 38 35 34 39 38 5a 4d 37 35 2e 34 31 30 39 20 32 36 2e 31 38 33 39 43 37 36 2e 30 31 32 35 20 32 35 2e 38 36 38 39 20 37 36 2e 35 39 31 35 20 32 35 2e 35 31 36 38 20 37 37 2e 31 34 35 20 32 35 2e 31 33 30 36 43 37 37 2e 35 37 30 39 20 32 36 2e 31 39 33 35 20 37 37 2e 39 35 32 35 20 32 37 2e 32 37 39 20 37 38 2e 32 38 37 35 20 32 38 2e 33 38 34 37 4c 37 37 2e 33 33 30 34 20 32 38 2e 36 37 34 36 4c 37 36 2e 33 37 33 34 20 32 38 Data Ascii: 66957L51.0354 3.62661C51.9783 3.91227 52.9057 4.23362 53.8161 4.58911C54.1311 3.98753 54.4832 3.40847 54.8694 2.85498ZM75.4109 26.1839C76.0125 25.8689 76.5915 25.5168 77.145 25.1306C77.5709 26.1935 77.9525 27.279 78.2875 28.3847L77.3304 28.6746L76.3734 28
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 2e 31 38 30 34 35 20 33 36 2e 32 37 31 35 43 32 2e 30 36 31 31 32 20 33 37 2e 34 39 37 37 20 32 20 33 38 2e 37 34 31 34 20 32 20 34 30 43 32 20 34 31 2e 32 35 38 36 20 32 2e 30 36 31 31 32 20 34 32 2e 35 30 32 33 20 32 2e 31 38 30 34 35 20 34 33 2e 37 32 38 35 4c 31 2e 31 38 35 31 35 20 34 33 2e 38 32 35 33 4c 30 2e 31 38 39 38 35 33 20 34 33 2e 39 32 32 32 43 30 2e 30 36 34 32 36 38 20 34 32 2e 36 33 31 38 20 30 20 34 31 2e 33 32 33 34 20 30 20 34 30 5a 4d 32 2e 36 36 39 35 37 20 35 31 2e 33 32 35 34 4c 31 2e 37 31 32 35 33 20 35 31 2e 36 31 35 33 43 32 2e 34 37 38 39 37 20 35 34 2e 31 34 35 31 20 33 2e 34 38 39 32 36 20 35 36 2e 35 36 38 38 20 34 2e 37 31 36 30 34 20 35 38 2e 38 35 39 32 4c 35 2e 35 39 37 35 36 20 35 38 2e 33 38 37 31 4c 36 2e 34 37 39 Data Ascii: .18045 36.2715C2.06112 37.4977 2 38.7414 2 40C2 41.2586 2.06112 42.5023 2.18045 43.7285L1.18515 43.8253L0.189853 43.9222C0.064268 42.6318 0 41.3234 0 40ZM2.66957 51.3254L1.71253 51.6153C2.47897 54.1451 3.48926 56.5688 4.71604 58.8592L5.59756 58.3871L6.479
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 31 2e 30 33 35 34 43 37 35 2e 36 34 35 36 20 35 33 2e 34 33 37 35 20 37 34 2e 36 38 36 32 20 35 35 2e 37 33 39 33 20 37 33 2e 35 32 30 39 20 35 37 2e 39 31 34 39 4c 37 34 2e 34 30 32 34 20 35 38 2e 33 38 37 31 5a 22 2c 66 69 6c 6c 3a 22 63 75 72 72 65 6e 74 43 6f 6c 6f 72 22 7d 29 2c 28 30 2c 45 2e 6a 73 78 29 28 22 63 69 72 63 6c 65 22 2c 7b 63 78 3a 22 36 38 22 2c 63 79 3a 22 31 32 22 2c 72 3a 22 31 32 22 2c 66 69 6c 6c 3a 22 23 35 38 36 35 66 32 22 7d 29 2c 28 30 2c 45 2e 6a 73 78 29 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 37 33 2e 33 33 33 32 20 31 31 2e 34 30 37 35 48 36 38 2e 35 39 32 34 56 36 2e 36 36 36 37 35 48 36 37 2e 34 30 37 32 56 31 31 2e 34 30 37 35 48 36 32 2e 36 36 36 35 56 31 32 2e 35 39 32 37 48 36 37 2e 34 30 37 32 56 31 37 2e 33 33 33 Data Ascii: 1.0354C75.6456 53.4375 74.6862 55.7393 73.5209 57.9149L74.4024 58.3871Z",fill:"currentColor"}),(0,E.jsx)("circle",{cx:"68",cy:"12",r:"12",fill:"#5865f2"}),(0,E.jsx)("path",{d:"M73.3332 11.4075H68.5924V6.66675H67.4072V11.4075H62.6665V12.5927H67.4072V17.333
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 34 20 32 38 2e 35 33 39 34 20 35 31 2e 37 30 34 48 32 38 2e 30 35 39 34 56 34 39 2e 32 36 38 48 32 38 2e 35 37 35 34 43 32 39 2e 34 38 37 34 20 34 39 2e 32 36 38 20 32 39 2e 39 35 35 34 20 34 39 2e 36 36 34 20 32 39 2e 39 35 35 34 20 35 30 2e 34 35 36 5a 4d 33 37 2e 38 32 39 32 20 35 36 4c 33 37 2e 35 35 33 32 20 35 34 2e 32 32 34 48 33 35 2e 30 30 39 32 56 34 37 2e 37 32 48 33 32 2e 39 35 37 32 56 35 36 48 33 37 2e 38 32 39 32 5a 4d 34 35 2e 39 35 35 38 20 35 31 2e 38 34 38 43 34 35 2e 39 35 35 38 20 34 39 2e 32 39 32 20 34 34 2e 34 30 37 38 20 34 37 2e 35 36 34 20 34 32 2e 30 30 37 38 20 34 37 2e 35 36 34 43 33 39 2e 36 30 37 38 20 34 37 2e 35 36 34 20 33 38 2e 30 34 37 38 20 34 39 2e 33 30 34 20 33 38 2e 30 34 37 38 20 35 31 2e 38 37 32 43 33 38 2e 30 Data Ascii: 4 28.5394 51.704H28.0594V49.268H28.5754C29.4874 49.268 29.9554 49.664 29.9554 50.456ZM37.8292 56L37.5532 54.224H35.0092V47.72H32.9572V56H37.8292ZM45.9558 51.848C45.9558 49.292 44.4078 47.564 42.0078 47.564C39.6078 47.564 38.0478 49.304 38.0478 51.872C38.0
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 6f 6c 64 46 6f 72 6d 45 72 72 6f 72 73 3a 21 30 7d 29 2e 74 68 65 6e 28 73 3d 3e 7b 6c 65 74 20 61 3d 73 2e 62 6f 64 79 3b 5f 2e 5a 2e 64 69 73 70 61 74 63 68 28 7b 74 79 70 65 3a 22 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 5f 41 43 43 45 50 54 5f 53 55 43 43 45 53 53 22 2c 63 6f 64 65 3a 65 2c 67 75 69 6c 64 3a 61 7d 29 2c 74 2e 5a 2e 69 73 43 6f 6e 6e 65 63 74 65 64 28 29 3f 72 2e 5a 2e 61 64 64 43 6f 6e 64 69 74 69 6f 6e 61 6c 43 68 61 6e 67 65 4c 69 73 74 65 6e 65 72 28 28 29 3d 3e 7b 69 66 28 6e 75 6c 6c 21 3d 72 2e 5a 2e 67 65 74 47 75 69 6c 64 28 61 2e 69 64 29 29 72 65 74 75 72 6e 28 30 2c 6e 2e 58 29 28 61 2e 69 64 29 2c 6c 28 61 29 2c 21 31 7d 29 3a 28 28 30 2c 6e 2e 58 29 28 61 2e 69 64 29 2c 6c 28 61 29 29 7d 2c 73 3d 3e 7b 5f 2e 5a 2e 64 69 Data Ascii: oldFormErrors:!0}).then(s=>{let a=s.body;_.Z.dispatch({type:"GUILD_TEMPLATE_ACCEPT_SUCCESS",code:e,guild:a}),t.Z.isConnected()?r.Z.addConditionalChangeListener(()=>{if(null!=r.Z.getGuild(a.id))return(0,n.X)(a.id),l(a),!1}):((0,n.X)(a.id),l(a))},s=>{_.Z.di
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 5f 4d 4f 44 41 4c 5f 54 49 54 4c 45 5f 43 52 45 41 54 4f 52 53 5f 48 4f 42 42 49 45 53 2c 64 65 73 63 72 69 70 74 69 6f 6e 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 5f 4d 4f 44 41 4c 5f 44 45 53 43 52 49 50 54 49 4f 4e 5f 43 52 45 41 54 4f 52 53 5f 48 4f 42 42 49 45 53 2c 6e 61 6d 65 4c 61 62 65 6c 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 53 5f 46 4f 52 4d 5f 4c 41 42 45 4c 5f 53 45 52 56 45 52 5f 4e 41 4d 45 5f 43 52 45 41 54 4f 52 53 5f 48 4f 42 42 49 45 53 2c 74 65 72 6d 73 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 43 52 45 41 54 45 5f 53 45 52 56 45 52 5f 47 55 49 44 45 4c 49 4e 45 53 2c 64 Data Ascii: .Z.Messages.GUILD_TEMPLATE_MODAL_TITLE_CREATORS_HOBBIES,description:_.Z.Messages.GUILD_TEMPLATE_MODAL_DESCRIPTION_CREATORS_HOBBIES,nameLabel:_.Z.Messages.GUILD_TEMPLATES_FORM_LABEL_SERVER_NAME_CREATORS_HOBBIES,terms:_.Z.Messages.CREATE_SERVER_GUIDELINES,d
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 54 45 4d 50 4c 41 54 45 53 5f 46 4f 52 4d 5f 4c 41 42 45 4c 5f 53 45 52 56 45 52 5f 4e 41 4d 45 5f 53 54 55 44 59 5f 47 52 4f 55 50 53 2c 74 65 72 6d 73 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 43 52 45 41 54 45 5f 53 45 52 56 45 52 5f 47 55 49 44 45 4c 49 4e 45 53 2c 64 65 66 61 75 6c 74 4e 61 6d 65 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 5f 44 45 46 41 55 4c 54 5f 53 45 52 56 45 52 5f 4e 41 4d 45 5f 53 54 55 44 59 5f 47 52 4f 55 50 53 2c 61 75 74 68 6f 72 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 44 49 53 43 4f 52 44 5f 4e 41 4d 45 7d 3b 63 61 73 65 20 45 2e 48 51 2e 43 52 45 41 54 45 5f 46 52 4f 4d 5f 53 43 52 41 54 43 48 3a 72 65 74 75 72 6e 7b 68 65 61 64 65 72 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 Data Ascii: TEMPLATES_FORM_LABEL_SERVER_NAME_STUDY_GROUPS,terms:_.Z.Messages.CREATE_SERVER_GUIDELINES,defaultName:_.Z.Messages.GUILD_TEMPLATE_DEFAULT_SERVER_NAME_STUDY_GROUPS,author:_.Z.Messages.DISCORD_NAME};case E.HQ.CREATE_FROM_SCRATCH:return{header:_.Z.Messages.G
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 5f 4d 4f 44 41 4c 5f 54 49 54 4c 45 5f 47 49 54 48 55 42 5f 48 41 43 4b 41 54 48 4f 4e 2c 64 65 73 63 72 69 70 74 69 6f 6e 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 5f 4d 4f 44 41 4c 5f 44 45 53 43 52 49 50 54 49 4f 4e 5f 47 49 54 48 55 42 5f 48 41 43 4b 41 54 48 4f 4e 2c 6e 61 6d 65 4c 61 62 65 6c 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 46 4f 52 4d 5f 4c 41 42 45 4c 5f 53 45 52 56 45 52 5f 4e 41 4d 45 2c 74 65 72 6d 73 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 43 52 45 41 54 45 5f 53 45 52 56 45 52 5f 47 55 49 44 45 4c 49 4e 45 53 2c 64 65 66 61 75 6c 74 4e 61 6d 65 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 43 52 45 41 54 45 5f 53 Data Ascii: _.Z.Messages.GUILD_TEMPLATE_MODAL_TITLE_GITHUB_HACKATHON,description:_.Z.Messages.GUILD_TEMPLATE_MODAL_DESCRIPTION_GITHUB_HACKATHON,nameLabel:_.Z.Messages.FORM_LABEL_SERVER_NAME,terms:_.Z.Messages.CREATE_SERVER_GUIDELINES,defaultName:_.Z.Messages.CREATE_S
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 7c 7c 61 72 67 75 6d 65 6e 74 73 5b 31 5d 2c 5b 61 2c 74 5d 3d 5f 2e 75 73 65 53 74 61 74 65 28 22 22 29 2c 5b 6e 2c 72 5d 3d 5f 2e 75 73 65 53 74 61 74 65 28 6e 75 6c 6c 29 2c 5b 4c 2c 6c 5d 3d 5f 2e 75 73 65 53 74 61 74 65 28 6e 75 6c 6c 29 2c 69 3d 28 30 2c 52 2e 5a 29 28 65 2e 63 6f 64 65 29 3b 5f 2e 75 73 65 45 66 66 65 63 74 28 28 29 3d 3e 7b 28 61 73 79 6e 63 20 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 6c 65 74 20 65 3d 6f 2e 64 65 66 61 75 6c 74 2e 67 65 74 43 75 72 72 65 6e 74 55 73 65 72 28 29 3b 69 66 28 6e 75 6c 6c 3d 3d 65 29 74 72 79 7b 65 3d 61 77 61 69 74 20 28 30 2c 43 2e 6b 29 28 29 7d 63 61 74 63 68 28 65 29 7b 63 2e 5a 2e 76 65 72 69 66 79 53 53 4f 54 6f 6b 65 6e 28 6e 75 6c 6c 29 7d 6e 75 6c 6c 21 3d 65 26 26 74 28 69 2e 64 65 66 61 75 Data Ascii: \|\|arguments[1],[a,t]=_.useState(""),[n,r]=_.useState(null),[L,l]=_.useState(null),i=(0,R.Z)(e.code);_.useEffect(()=>{(async function e(){let e=o.default.getCurrentUser();if(null==e)try{e=await (0,C.k)()}catch(e){c.Z.verifySSOToken(null)}null!=e&&t(i.defau

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.7	49873	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:47 UTC	868	OUT	GET /assets/6df906184440a6461f5c.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:47 UTC	960	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:47 GMT Content-Type: text/javascript Content-Length: 11167 Connection: close CF-Ray: 8d782d7b8f1b4671-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "8aaa605c48dc545f185ca77c921139d3" Last-Modified: Tue, 15 Oct 2024 21:50:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RaXK%2BWBxtr%2Fpz24Y2PmXsp0l5ioJEkrzcRQ7zUssz5smMLRgzT5xskYNpFG6EL16tHYrAZm0QpAZ3ZSOjv45qieNTBqfT5tvADRzhQqxEZqp0aVjLLCceetcEqUL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:47 UTC	409	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 35 32 30 33 30 22 5d 2c 7b 34 38 35 35 30 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 73 29 7b 73 2e 64 28 74 2c 7b 50 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 7d 7d 29 3b 76 61 72 20 6e 3d 73 28 36 38 39 39 33 38 29 3b 6c 65 74 20 6c 3d 7b 67 65 74 20 77 65 62 61 75 74 68 6e 28 29 7b 72 65 74 75 72 6e 20 6e 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 4d 46 41 5f 56 32 5f 57 45 42 41 55 54 48 4e 5f 4e 41 4d 45 7d 2c 67 65 74 20 74 6f 74 70 28 29 7b 72 65 74 75 72 6e 20 6e 2e 5a 2e 4d 65 73 73 61 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["52030"],{48550:function(e,t,s){s.d(t,{P:function(){return l}});var n=s(689938);let l={get webauthn(){return n.Z.Messages.MFA_V2_WEBAUTHN_NAME},get totp(){return n.Z.Messa
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 61 67 65 73 2e 4d 46 41 5f 56 32 5f 42 41 43 4b 55 50 5f 4e 41 4d 45 7d 7d 7d 2c 31 32 34 38 36 30 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 73 29 7b 73 2e 64 28 74 2c 7b 43 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 7d 2c 59 52 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 53 7d 7d 29 2c 73 28 34 37 31 32 30 29 2c 73 28 34 31 31 31 30 34 29 3b 76 61 72 20 6e 3d 73 28 32 30 30 36 35 31 29 2c 6c 3d 73 28 31 39 32 33 37 39 29 2c 69 3d 73 28 34 38 31 30 36 30 29 2c 72 3d 73 28 34 34 37 30 39 37 29 2c 6f 3d 73 28 38 37 33 31 32 34 29 2c 61 3d 73 28 32 34 38 39 30 32 29 2c 64 3d 73 28 31 36 30 35 31 31 29 2c 75 3d 73 28 35 31 36 39 33 29 2c 63 3d 73 28 39 37 33 38 31 30 29 2c 68 3d 73 28 36 38 39 39 33 38 29 3b 66 75 6e 63 74 69 Data Ascii: ages.MFA_V2_BACKUP_NAME}}},124860:function(e,t,s){s.d(t,{Cd:function(){return f},YR:function(){return S}}),s(47120),s(411104);var n=s(200651),l=s(192379),i=s(481060),r=s(447097),o=s(873124),a=s(248902),d=s(160511),u=s(51693),c=s(973810),h=s(689938);functi
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 28 66 2c 7b 6d 66 61 43 68 61 6c 6c 65 6e 67 65 3a 74 2c 6d 66 61 46 69 6e 69 73 68 3a 73 2c 6f 6e 43 6c 6f 73 65 3a 72 2c 6f 6e 45 61 72 6c 79 43 6c 6f 73 65 3a 72 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 53 28 65 2c 74 2c 73 29 7b 28 30 2c 69 2e 6f 70 65 6e 4d 6f 64 61 6c 29 28 73 3d 3e 28 30 2c 6e 2e 6a 73 78 29 28 6d 2c 7b 66 69 6e 69 73 68 3a 74 2c 6d 66 61 43 68 61 6c 6c 65 6e 67 65 3a 65 2c 2e 2e 2e 73 7d 29 2c 7b 6f 6e 43 6c 6f 73 65 43 61 6c 6c 62 61 63 6b 3a 28 29 3d 3e 7b 73 28 45 72 72 6f 72 28 68 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 4d 46 41 5f 56 32 5f 43 41 4e 43 45 4c 45 44 29 29 7d 7d 29 7d 7d 2c 35 30 37 34 35 33 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 73 29 7b 76 61 72 20 6e 3d 73 28 32 30 30 36 35 31 29 3b 73 28 31 39 32 33 37 39 29 Data Ascii: (f,{mfaChallenge:t,mfaFinish:s,onClose:r,onEarlyClose:r})})}function S(e,t,s){(0,i.openModal)(s=>(0,n.jsx)(m,{finish:t,mfaChallenge:e,...s}),{onCloseCallback:()=>{s(Error(h.Z.Messages.MFA_V2_CANCELED))}})}},507453:function(e,t,s){var n=s(200651);s(192379)
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 63 6c 61 73 73 4e 61 6d 65 3a 6f 2e 73 75 62 74 69 74 6c 65 2c 63 68 69 6c 64 72 65 6e 3a 74 7d 29 2c 28 30 2c 6e 2e 6a 73 78 29 28 6c 2e 4d 6f 64 61 6c 43 6c 6f 73 65 42 75 74 74 6f 6e 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 6f 2e 63 6c 6f 73 65 42 75 74 74 6f 6e 2c 6f 6e 43 6c 69 63 6b 3a 73 7d 29 5d 7d 29 7d 7d 7d 2c 34 34 37 30 39 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 73 29 7b 73 2e 64 28 74 2c 7b 5a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 64 7d 7d 29 2c 73 28 37 35 37 31 34 33 29 2c 73 28 34 37 31 32 30 29 2c 73 28 37 37 33 36 30 33 29 3b 76 61 72 20 6e 3d 73 28 32 30 30 36 35 31 29 2c 6c 3d 73 28 31 39 32 33 37 39 29 2c 69 3d 73 28 36 35 38 35 35 30 29 2c 72 3d 73 28 34 38 31 30 36 30 29 2c 6f 3d 73 28 35 30 37 34 35 33 29 2c 61 Data Ascii: className:o.subtitle,children:t}),(0,n.jsx)(l.ModalCloseButton,{className:o.closeButton,onClick:s})]})}}},447097:function(e,t,s){s.d(t,{Z:function(){return d}}),s(757143),s(47120),s(773603);var n=s(200651),l=s(192379),i=s(658550),r=s(481060),o=s(507453),a
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 69 3d 73 28 34 38 31 30 36 30 29 2c 72 3d 73 28 35 30 37 34 35 33 29 2c 6f 3d 73 28 36 38 39 39 33 38 29 3b 66 75 6e 63 74 69 6f 6e 20 61 28 65 29 7b 6c 65 74 7b 6d 66 61 43 68 61 6c 6c 65 6e 67 65 3a 74 2c 66 69 6e 69 73 68 3a 73 2c 73 65 74 53 6c 69 64 65 3a 61 2c 6f 6e 43 6c 6f 73 65 3a 64 2c 69 73 53 6c 69 64 65 52 65 61 64 79 3a 75 7d 3d 65 2c 5b 63 2c 68 5d 3d 6c 2e 75 73 65 53 74 61 74 65 28 21 31 29 2c 5b 66 2c 6d 5d 3d 6c 2e 75 73 65 53 74 61 74 65 28 6e 75 6c 6c 29 2c 5b 53 2c 5f 5d 3d 6c 2e 75 73 65 53 74 61 74 65 28 22 22 29 2c 67 3d 6c 2e 75 73 65 52 65 66 28 6e 75 6c 6c 29 3b 72 65 74 75 72 6e 20 6c 2e 75 73 65 45 66 66 65 63 74 28 28 29 3d 3e 7b 69 66 28 75 29 7b 76 61 72 20 65 3b 6e 75 6c 6c 3d 3d 3d 28 65 3d 67 2e 63 75 72 72 65 6e 74 29 Data Ascii: i=s(481060),r=s(507453),o=s(689938);function a(e){let{mfaChallenge:t,finish:s,setSlide:a,onClose:d,isSlideReady:u}=e,[c,h]=l.useState(!1),[f,m]=l.useState(null),[S,_]=l.useState(""),g=l.useRef(null);return l.useEffect(()=>{if(u){var e;null===(e=g.current)
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 63 6b 3a 28 29 3d 3e 7b 73 28 65 2e 74 79 70 65 29 7d 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 6e 2e 6a 73 78 29 28 6c 2e 54 65 78 74 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 61 2e 6c 69 73 74 49 74 65 6d 54 65 78 74 2c 76 61 72 69 61 6e 74 3a 22 74 65 78 74 2d 6d 64 2f 73 65 6d 69 62 6f 6c 64 22 2c 63 68 69 6c 64 72 65 6e 3a 72 2e 50 5b 65 2e 74 79 70 65 5d 7d 29 2c 28 30 2c 6e 2e 6a 73 78 29 28 6c 2e 43 68 65 76 72 6f 6e 53 6d 61 6c 6c 52 69 67 68 74 49 63 6f 6e 2c 7b 73 69 7a 65 3a 22 63 75 73 74 6f 6d 22 2c 63 6f 6c 6f 72 3a 22 63 75 72 72 65 6e 74 43 6f 6c 6f 72 22 2c 77 69 64 74 68 3a 32 30 2c 68 65 69 67 68 74 3a 32 30 2c 63 6c 61 73 73 4e 61 6d 65 3a 61 2e 6c 69 73 74 49 74 65 6d 41 72 72 6f 77 7d 29 5d 7d 2c 65 2e 74 79 70 65 29 29 7d 29 5d 7d 29 7d Data Ascii: ck:()=>{s(e.type)},children:[(0,n.jsx)(l.Text,{className:a.listItemText,variant:"text-md/semibold",children:r.P[e.type]}),(0,n.jsx)(l.ChevronSmallRightIcon,{size:"custom",color:"currentColor",width:20,height:20,className:a.listItemArrow})]},e.type))})]})}
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 29 2c 28 30 2c 6e 2e 6a 73 78 29 28 61 2e 5a 2e 53 6c 69 64 65 43 6f 6e 74 65 6e 74 2c 7b 63 68 69 6c 64 72 65 6e 3a 28 30 2c 6e 2e 6a 73 78 73 29 28 6f 2e 46 6f 72 6d 49 74 65 6d 2c 7b 74 69 74 6c 65 3a 75 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 54 57 4f 5f 46 41 5f 45 4e 54 45 52 5f 54 4f 4b 45 4e 5f 4e 4f 5f 42 41 43 4b 55 50 5f 4c 41 42 45 4c 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 6e 2e 6a 73 78 73 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 63 2e 73 6d 73 49 6e 70 75 74 43 6f 6e 74 61 69 6e 65 72 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 6e 2e 6a 73 78 29 28 6f 2e 54 65 78 74 49 6e 70 75 74 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 63 2e 73 6d 73 49 6e 70 75 74 2c 69 6e 70 75 74 52 65 66 3a 4d 2c 6f 6e 43 68 61 6e 67 65 3a 5a 2c 70 6c 61 63 65 Data Ascii: ),(0,n.jsx)(a.Z.SlideContent,{children:(0,n.jsxs)(o.FormItem,{title:u.Z.Messages.TWO_FA_ENTER_TOKEN_NO_BACKUP_LABEL,children:[(0,n.jsxs)("div",{className:c.smsInputContainer,children:[(0,n.jsx)(o.TextInput,{className:c.smsInput,inputRef:M,onChange:Z,place
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 20 30 21 3d 3d 73 3f 73 3a 6e 75 6c 6c 3d 3d 3d 28 74 3d 65 2e 62 6f 64 79 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 6d 65 73 73 61 67 65 29 7d 29 2e 66 69 6e 61 6c 6c 79 28 28 29 3d 3e 7b 66 28 21 31 29 7d 29 7d 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 6e 2e 6a 73 78 29 28 6f 2e 5a 2e 53 6c 69 64 65 48 65 61 64 65 72 2c 7b 6f 6e 43 6c 6f 73 65 3a 75 7d 29 2c 28 30 2c 6e 2e 6a 73 78 29 28 6f 2e 5a 2e 53 6c 69 64 65 43 6f 6e 74 65 6e 74 2c 7b 63 68 69 6c 64 72 65 6e 3a 28 30 2c 6e 2e 6a 73 78 73 29 28 72 2e 46 6f 72 6d 49 74 65 6d 2c 7b 74 69 74 6c 65 3a 61 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 54 57 4f 5f 46 41 5f 45 4e 54 45 52 5f 54 4f 4b 45 4e 5f 4e 4f 5f 42 41 43 4b 55 50 5f 4c 41 42 45 4c 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 Data Ascii: 0!==s?s:null===(t=e.body)\|\|void 0===t?void 0:t.message)}).finally(()=>{f(!1)})},children:[(0,n.jsx)(o.Z.SlideHeader,{onClose:u}),(0,n.jsx)(o.Z.SlideContent,{children:(0,n.jsxs)(r.FormItem,{title:a.Z.Messages.TWO_FA_ENTER_TOKEN_NO_BACKUP_LABEL,children:[(
2024-10-24 07:15:47 UTC	1175	IN	Data Raw: 45 52 49 43 5f 45 52 52 4f 52 29 7d 66 69 6e 61 6c 6c 79 7b 5f 28 21 31 29 7d 7d 3b 72 65 74 75 72 6e 28 30 2c 6e 2e 6a 73 78 73 29 28 6e 2e 46 72 61 67 6d 65 6e 74 2c 7b 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 6e 2e 6a 73 78 29 28 75 2e 5a 2e 53 6c 69 64 65 48 65 61 64 65 72 2c 7b 6f 6e 43 6c 6f 73 65 3a 6d 7d 29 2c 28 30 2c 6e 2e 6a 73 78 73 29 28 75 2e 5a 2e 53 6c 69 64 65 43 6f 6e 74 65 6e 74 2c 7b 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 6e 2e 6a 73 78 29 28 72 2e 42 75 74 74 6f 6e 2c 7b 73 75 62 6d 69 74 74 69 6e 67 3a 53 2c 6f 6e 43 6c 69 63 6b 3a 43 2c 63 68 69 6c 64 72 65 6e 3a 68 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 4d 46 41 5f 56 32 5f 57 45 42 41 55 54 48 4e 5f 43 54 41 7d 29 2c 28 30 2c 6e 2e 6a 73 78 29 28 75 2e 5a 2e 53 6c 69 64 65 45 72 72 6f Data Ascii: ERIC_ERROR)}finally{_(!1)}};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(u.Z.SlideHeader,{onClose:m}),(0,n.jsxs)(u.Z.SlideContent,{children:[(0,n.jsx)(r.Button,{submitting:S,onClick:C,children:h.Z.Messages.MFA_V2_WEBAUTHN_CTA}),(0,n.jsx)(u.Z.SlideErro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.7	49874	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:47 UTC	868	OUT	GET /assets/fdc71c23d09e18e94ce2.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:47 UTC	962	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:47 GMT Content-Type: text/javascript Content-Length: 11547 Connection: close CF-Ray: 8d782d7d6c1b476c-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "ac6ce4e7ff5f746693ab549f03be7ade" Last-Modified: Tue, 15 Oct 2024 21:50:02 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2uDdxUSi%2BtmanXFK481MdTMOWswqYWkcPIqt8wfO5HoDeEDv3IG3WRXE%2BNXnP886YcF01OzVAgG6kZQ0e7fVUf4Wq0uU%2Fw9HAugGTSlag2yFo4qUIJqLLayetHDS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:47 UTC	407	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 39 30 36 32 38 22 5d 2c 7b 32 33 31 34 34 33 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 65 30 34 62 63 62 37 33 31 36 66 37 32 30 35 65 38 35 66 62 2e 73 76 67 22 7d 2c 37 34 38 33 30 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 32 33 61 37 61 33 66 64 36 36 32 34 33 34 32 31 31 37 62 66 2e 73 76 67 22 7d 2c 32 30 36 38 31 38 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["90628"],{231443:function(e){e.exports="/assets/e04bcb7316f7205e85fb.svg"},74830:function(e){e.exports="/assets/23a7a3fd6624342117bf.svg"},206818:function(e){e.exports="/a
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 32 33 62 2e 6d 70 34 22 7d 2c 35 35 34 33 35 35 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 66 62 37 30 63 36 33 32 35 61 37 64 37 32 38 63 62 36 64 30 2e 70 6e 67 22 7d 2c 39 39 31 39 38 39 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 73 2c 6e 29 7b 65 2e 65 78 70 6f 72 74 73 3d 6e 2e 70 2b 22 34 38 61 64 31 39 65 38 30 30 38 33 62 65 65 36 38 32 64 32 2e 77 65 62 6d 22 7d 2c 37 38 37 34 36 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 73 2c 6e 29 7b 65 2e 65 78 70 6f 72 74 73 3d 6e 2e 70 2b 22 61 34 37 36 38 36 33 64 34 66 34 34 31 36 31 38 38 34 30 66 2e 6d 6f 76 22 7d 2c 36 33 35 35 30 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 73 2c 6e 29 7b 65 2e 65 78 70 6f 72 74 73 3d 6e 2e 70 2b 22 38 37 63 33 61 62 64 39 30 65 32 Data Ascii: 23b.mp4"},554355:function(e){e.exports="/assets/fb70c6325a7d728cb6d0.png"},991989:function(e,s,n){e.exports=n.p+"48ad19e80083bee682d2.webm"},787462:function(e,s,n){e.exports=n.p+"a476863d4f441618840f.mov"},635507:function(e,s,n){e.exports=n.p+"87c3abd90e2
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 6d 65 3a 68 2e 67 75 69 6c 64 49 63 6f 6e 2c 63 68 69 6c 64 72 65 6e 3a 28 30 2c 74 2e 6a 73 78 29 28 69 2e 56 6a 2c 7b 67 75 69 6c 64 3a 73 2c 73 69 7a 65 3a 69 2e 56 6a 2e 53 69 7a 65 73 2e 4c 41 52 47 45 52 2c 61 6e 69 6d 61 74 65 3a 21 30 7d 29 7d 29 3b 65 6c 73 65 20 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 3b 73 2e 5a 3d 65 3d 3e 7b 76 61 72 20 73 3b 6c 65 74 20 6e 2c 61 2c 75 2c 7b 69 6e 76 69 74 65 3a 6f 2c 64 69 73 61 62 6c 65 55 73 65 72 3a 66 3d 21 31 2c 65 72 72 6f 72 3a 53 2c 66 6c 61 74 41 63 74 69 76 69 74 79 43 6f 75 6e 74 3a 76 3d 21 31 2c 69 73 52 65 67 69 73 74 65 72 3a 4d 3d 21 31 7d 3d 65 2c 7b 63 75 72 72 65 6e 74 55 73 65 72 3a 52 2c 6d 75 6c 74 69 41 63 63 6f 75 6e 74 73 3a 4f 7d 3d 28 30 2c 6c 2e 63 6a 29 28 5b 6d 2e 5a 2c 45 2e 64 65 Data Ascii: me:h.guildIcon,children:(0,t.jsx)(i.Vj,{guild:s,size:i.Vj.Sizes.LARGER,animate:!0})});else return null};s.Z=e=>{var s;let n,a,u,{invite:o,disableUser:f=!1,error:S,flatActivityCount:v=!1,isRegister:M=!1}=e,{currentUser:R,multiAccounts:O}=(0,l.cj)([m.Z,E.de
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 29 28 69 2e 44 4b 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 68 2e 61 70 70 49 6e 2c 63 68 69 6c 64 72 65 6e 3a 6a 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 45 4d 42 45 44 44 45 44 5f 41 43 54 49 56 49 54 49 45 53 5f 49 4e 56 49 54 45 5f 49 4e 7d 29 2c 28 30 2c 74 2e 6a 73 78 73 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 68 2e 67 75 69 6c 64 43 6f 6e 74 61 69 6e 65 72 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 74 2e 6a 73 78 29 28 69 2e 56 6a 2c 7b 67 75 69 6c 64 3a 44 2c 73 69 7a 65 3a 69 2e 56 6a 2e 53 69 7a 65 73 2e 53 4d 41 4c 4c 7d 29 2c 28 30 2c 74 2e 6a 73 78 29 28 72 2e 54 65 78 74 2c 7b 74 61 67 3a 22 73 70 61 6e 22 2c 76 61 72 69 61 6e 74 3a 22 74 65 78 74 2d 6c 67 2f 6e 6f 72 6d 61 6c 22 2c 63 6f 6c 6f 72 3a 22 68 65 61 64 65 72 2d 70 72 69 6d Data Ascii: )(i.DK,{className:h.appIn,children:j.Z.Messages.EMBEDDED_ACTIVITIES_INVITE_IN}),(0,t.jsxs)("div",{className:h.guildContainer,children:[(0,t.jsx)(i.Vj,{guild:D,size:i.Vj.Sizes.SMALL}),(0,t.jsx)(r.Text,{tag:"span",variant:"text-lg/normal",color:"header-prim
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 73 73 4e 61 6d 65 3a 68 2e 74 69 74 6c 65 2c 63 68 69 6c 64 72 65 6e 3a 5b 6e 75 6c 6c 21 3d 44 3f 28 30 2c 74 2e 6a 73 78 29 28 63 2e 5a 2c 7b 67 75 69 6c 64 3a 44 2c 63 6c 61 73 73 4e 61 6d 65 3a 68 2e 67 75 69 6c 64 42 61 64 67 65 2c 74 6f 6f 6c 74 69 70 50 6f 73 69 74 69 6f 6e 3a 22 6c 65 66 74 22 7d 29 3a 6e 75 6c 6c 2c 6e 2c 61 5d 7d 29 5d 7d 29 2c 75 2c 6e 75 6c 6c 21 3d 5a 7c 7c 42 7c 7c 28 6e 75 6c 6c 3d 3d 6f 3f 76 6f 69 64 20 30 3a 6e 75 6c 6c 3d 3d 3d 28 73 3d 6f 2e 67 75 69 6c 64 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 73 3f 76 6f 69 64 20 30 3a 73 2e 69 64 29 3d 3d 3d 54 2e 66 51 3f 6e 75 6c 6c 3a 28 30 2c 74 2e 6a 73 78 29 28 69 2e 45 4a 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 68 2e 61 63 74 69 76 69 74 79 43 6f 75 6e 74 2c 6f 6e 6c 69 6e 65 3a 6f Data Ascii: ssName:h.title,children:[null!=D?(0,t.jsx)(c.Z,{guild:D,className:h.guildBadge,tooltipPosition:"left"}):null,n,a]})]}),u,null!=Z\|\|B\|\|(null==o?void 0:null===(s=o.guild)\|\|void 0===s?void 0:s.id)===T.fQ?null:(0,t.jsx)(i.EJ,{className:h.activityCount,online:o
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 65 3d 3e 7b 6c 65 74 7b 63 6c 61 73 73 4e 61 6d 65 3a 73 2c 2e 2e 2e 6e 7d 3d 65 2c 61 3d 6e 2e 6c 6f 6f 6b 3d 3d 3d 72 2e 42 75 74 74 6f 6e 2e 4c 6f 6f 6b 73 2e 4c 49 4e 4b 3b 72 65 74 75 72 6e 28 30 2c 74 2e 6a 73 78 29 28 72 2e 42 75 74 74 6f 6e 2c 7b 73 69 7a 65 3a 61 3f 72 2e 42 75 74 74 6f 6e 2e 53 69 7a 65 73 2e 4d 49 4e 3a 72 2e 42 75 74 74 6f 6e 2e 53 69 7a 65 73 2e 4c 41 52 47 45 2c 66 75 6c 6c 57 69 64 74 68 3a 21 61 2c 63 6c 61 73 73 4e 61 6d 65 3a 6c 28 29 28 73 2c 7b 5b 45 2e 62 75 74 74 6f 6e 5d 3a 21 61 2c 5b 45 2e 6c 69 6e 6b 42 75 74 74 6f 6e 5d 3a 61 7d 29 2c 2e 2e 2e 6e 7d 29 7d 3b 6a 2e 4c 6f 6f 6b 73 3d 72 2e 42 75 74 74 6f 6e 2e 4c 6f 6f 6b 73 2c 6a 2e 43 6f 6c 6f 72 73 3d 72 2e 42 75 74 74 6f 6e 2e 43 6f 6c 6f 72 73 2c 6a 2e 53 69 Data Ascii: e=>{let{className:s,...n}=e,a=n.look===r.Button.Looks.LINK;return(0,t.jsx)(r.Button,{size:a?r.Button.Sizes.MIN:r.Button.Sizes.LARGE,fullWidth:!a,className:l()(s,{[E.button]:!a,[E.linkButton]:a}),...n})};j.Looks=r.Button.Looks,j.Colors=r.Button.Colors,j.Si
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 76 3d 65 3d 3e 7b 6c 65 74 7b 63 6c 61 73 73 4e 61 6d 65 3a 73 2c 63 68 69 6c 64 72 65 6e 3a 6e 7d 3d 65 3b 72 65 74 75 72 6e 28 30 2c 74 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 6c 28 29 28 45 2e 62 6c 6f 63 6b 2c 73 29 2c 63 68 69 6c 64 72 65 6e 3a 6e 7d 29 7d 2c 4d 3d 65 3d 3e 7b 6c 65 74 7b 63 6c 61 73 73 4e 61 6d 65 3a 73 2c 63 68 69 6c 64 72 65 6e 3a 6e 2c 69 73 50 72 6f 6d 69 6e 65 6e 74 3a 61 7d 3d 65 3b 72 65 74 75 72 6e 28 30 2c 74 2e 6a 73 78 29 28 72 2e 54 65 78 74 2c 7b 76 61 72 69 61 6e 74 3a 61 3f 22 74 65 78 74 2d 73 6d 2f 6e 6f 72 6d 61 6c 22 3a 22 74 65 78 74 2d 78 73 2f 6e 6f 72 6d 61 6c 22 2c 63 6c 61 73 73 4e 61 6d 65 3a 6c 28 29 28 45 2e 73 75 62 54 65 78 74 2c 73 29 2c 63 68 69 6c 64 72 65 6e 3a 6e 7d 29 Data Ascii: v=e=>{let{className:s,children:n}=e;return(0,t.jsx)("div",{className:l()(E.block,s),children:n})},M=e=>{let{className:s,children:n,isProminent:a}=e;return(0,t.jsx)(r.Text,{variant:a?"text-sm/normal":"text-xs/normal",className:l()(E.subText,s),children:n})
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 43 43 4f 55 4e 54 5f 53 45 52 56 45 52 5f 49 4e 56 49 54 45 5f 4a 4f 49 4e 49 4e 47 5f 41 53 7d 29 2c 28 30 2c 74 2e 6a 73 78 29 28 68 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 45 2e 6a 6f 69 6e 69 6e 67 41 73 41 76 61 74 61 72 2c 73 72 63 3a 73 2e 67 65 74 41 76 61 74 61 72 55 52 4c 28 76 6f 69 64 20 30 2c 32 34 29 2c 73 69 7a 65 3a 72 2e 41 76 61 74 61 72 53 69 7a 65 73 2e 53 49 5a 45 5f 32 34 2c 22 61 72 69 61 2d 6c 61 62 65 6c 22 3a 73 2e 75 73 65 72 6e 61 6d 65 7d 29 2c 28 30 2c 74 2e 6a 73 78 29 28 72 2e 54 65 78 74 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 45 2e 6a 6f 69 6e 69 6e 67 41 73 55 73 65 72 6e 61 6d 65 2c 74 61 67 3a 22 73 70 61 6e 22 2c 76 61 72 69 61 6e 74 3a 22 74 65 78 74 2d 6d 64 2f 73 65 6d 69 62 6f 6c 64 22 2c 63 6f 6c 6f 72 3a 22 68 65 61 64 Data Ascii: CCOUNT_SERVER_INVITE_JOINING_AS}),(0,t.jsx)(h,{className:E.joiningAsAvatar,src:s.getAvatarURL(void 0,24),size:r.AvatarSizes.SIZE_24,"aria-label":s.username}),(0,t.jsx)(r.Text,{className:E.joiningAsUsername,tag:"span",variant:"text-md/semibold",color:"head
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 5f 2c 6d 70 34 44 61 72 6b 3a 61 3d 64 2c 6d 70 34 4c 69 67 68 74 3a 6c 3d 45 2c 70 6e 67 44 61 72 6b 3a 72 3d 49 2c 70 6e 67 4c 69 67 68 74 3a 69 3d 78 2c 77 65 62 6d 44 61 72 6b 3a 6f 3d 4e 2c 77 65 62 6d 4c 69 67 68 74 3a 54 3d 70 7d 3d 65 2c 67 3d 28 30 2c 75 2e 76 75 29 28 29 2c 6a 3d 5b 28 30 2c 74 2e 6a 73 78 29 28 22 73 6f 75 72 63 65 22 2c 7b 73 72 63 3a 61 2c 74 79 70 65 3a 22 76 69 64 65 6f 2f 6d 70 34 22 7d 2c 22 6d 70 34 22 29 2c 28 30 2c 74 2e 6a 73 78 29 28 22 69 6d 67 22 2c 7b 61 6c 74 3a 22 22 2c 73 72 63 3a 72 7d 2c 22 70 6e 67 22 29 5d 2c 68 3d 5b 28 30 2c 74 2e 6a 73 78 29 28 22 73 6f 75 72 63 65 22 2c 7b 73 72 63 3a 6c 2c 74 79 70 65 3a 22 76 69 64 65 6f 2f 6d 70 34 22 7d 2c 22 6d 70 34 22 29 2c 28 30 2c 74 2e 6a 73 78 29 28 22 69 6d Data Ascii: _,mp4Dark:a=d,mp4Light:l=E,pngDark:r=I,pngLight:i=x,webmDark:o=N,webmLight:T=p}=e,g=(0,u.vu)(),j=[(0,t.jsx)("source",{src:a,type:"video/mp4"},"mp4"),(0,t.jsx)("img",{alt:"",src:r},"png")],h=[(0,t.jsx)("source",{src:l,type:"video/mp4"},"mp4"),(0,t.jsx)("im
2024-10-24 07:15:47 UTC	188	IN	Data Raw: 61 2e 53 55 42 4d 49 54 5f 53 43 48 4f 4f 4c 3d 22 53 55 42 4d 49 54 5f 53 43 48 4f 4f 4c 22 2c 61 2e 45 4d 41 49 4c 5f 43 4f 4e 46 49 52 4d 41 54 49 4f 4e 3d 22 45 4d 41 49 4c 5f 43 4f 4e 46 49 52 4d 41 54 49 4f 4e 22 2c 61 2e 45 4d 41 49 4c 5f 57 41 49 54 4c 49 53 54 3d 22 45 4d 41 49 4c 5f 57 41 49 54 4c 49 53 54 22 3b 6c 65 74 20 6c 3d 22 38 38 34 39 32 34 38 37 33 30 31 35 36 38 39 32 32 36 22 7d 7d 5d 29 3b 0a 2f 2f 23 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 3d 66 64 63 37 31 63 32 33 64 30 39 65 31 38 65 39 34 63 65 32 2e 6a 73 2e 6d 61 70 Data Ascii: a.SUBMIT_SCHOOL="SUBMIT_SCHOOL",a.EMAIL_CONFIRMATION="EMAIL_CONFIRMATION",a.EMAIL_WAITLIST="EMAIL_WAITLIST";let l="884924873015689226"}}]);//# sourceMappingURL=fdc71c23d09e18e94ce2.js.map

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.7	49875	162.159.136.232	443	400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:15:47 UTC	868	OUT	GET /assets/89b7ddebcacbe8dfbd3a.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=c35d912091d711efba864df74efafa8a; __sdcfduid=c35d912191d711efba864df74efafa8aa7e61a8f1d4774fd803054edbb1b845ec7fb9e33d8fe5396b0f297bc5350cc52; __cfruid=8c1b2f9e8941f7d8e6121103fbea0c38e3d318b6-1729754135; _cfuvid=ktJ6cnTQxA._bP.POJOBScmXLS89Y4ZFyoByOiM24Bo-1729754135354-0.0.1.1-604800000
2024-10-24 07:15:47 UTC	964	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:15:47 GMT Content-Type: text/javascript Content-Length: 18462 Connection: close CF-Ray: 8d782d7daa606b73-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "dc15d17d50a8a78e8c593e27fa1eaf57" Last-Modified: Tue, 15 Oct 2024 21:50:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ikg7rnhGggW4L1HD4lsmj8xDi2RatgZfFT7b%2BPaxzZ4TGjNyDFQpIDMy8azAq2%2BY7F7wKK1PGxOWCEEBo%2FOfequ%2BBVHjrJSUKxY6YijKo3q5loxTb177F24pCM5D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 32 30 30 31 31 22 5d 2c 7b 34 38 32 36 38 32 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 65 62 62 35 62 34 31 64 65 38 32 33 66 62 63 31 39 64 31 32 2e 70 6e 67 22 7d 2c 34 35 30 31 32 35 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 31 65 34 39 33 32 61 37 61 66 62 62 31 66 63 64 62 61 32 64 2e 70 6e 67 22 7d 2c 37 33 33 39 34 39 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 22 2f Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["20011"],{482682:function(t){t.exports="/assets/ebb5b41de823fbc19d12.png"},450125:function(t){t.exports="/assets/1e4932a7afbb1fcdba2d.png"},733949:function(t){t.exports="/
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 7b 5a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 70 7d 7d 29 2c 65 28 34 37 31 32 30 29 3b 76 61 72 20 73 2c 6e 3d 65 28 32 30 30 36 35 31 29 2c 68 3d 65 28 31 39 32 33 37 39 29 2c 61 3d 65 28 31 32 30 33 35 36 29 2c 72 3d 65 2e 6e 28 61 29 2c 6c 3d 65 28 37 34 38 37 38 30 29 2c 6f 3d 65 28 34 38 31 30 36 30 29 2c 64 3d 65 28 39 38 31 36 33 31 29 2c 75 3d 65 28 35 35 39 37 33 37 29 3b 66 75 6e 63 74 69 6f 6e 20 63 28 74 2c 69 2c 65 29 7b 72 65 74 75 72 6e 20 69 20 69 6e 20 74 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 69 2c 7b 76 61 6c 75 65 3a 65 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 74 5b 69 5d 3d 65 2c 74 7d 63 Data Ascii: {Z:function(){return p}}),e(47120);var s,n=e(200651),h=e(192379),a=e(120356),r=e.n(a),l=e(748780),o=e(481060),d=e(981631),u=e(559737);function c(t,i,e){return i in t?Object.defineProperty(t,i,{value:e,enumerable:!0,configurable:!0,writable:!0}):t[i]=e,t}c
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 3d 31 2f 31 32 30 3b 63 6c 61 73 73 20 79 20 65 78 74 65 6e 64 73 28 73 3d 68 2e 43 6f 6d 70 6f 6e 65 6e 74 29 7b 63 6f 6d 70 6f 6e 65 6e 74 44 69 64 4d 6f 75 6e 74 28 29 7b 74 68 69 73 2e 69 6e 69 74 69 61 6c 69 7a 65 28 29 7d 63 6f 6d 70 6f 6e 65 6e 74 44 69 64 55 70 64 61 74 65 28 74 29 7b 6c 65 74 7b 77 61 76 65 53 74 61 74 65 3a 69 7d 3d 74 68 69 73 2e 70 72 6f 70 73 3b 69 3d 3d 3d 76 2e 68 4f 2e 46 49 4c 4c 49 4e 47 26 26 69 21 3d 3d 74 2e 77 61 76 65 53 74 61 74 65 26 26 74 68 69 73 2e 77 61 76 65 46 69 6c 6c 28 29 7d 63 6f 6d 70 6f 6e 65 6e 74 57 69 6c 6c 55 6e 6d 6f 75 6e 74 28 29 7b 74 68 69 73 2e 74 65 72 6d 69 6e 61 74 65 28 29 7d 69 6e 69 74 69 61 6c 69 7a 65 28 29 7b 74 68 69 73 2e 63 68 69 6c 64 72 65 6e 2e 66 6f 72 45 61 63 68 28 74 3d 3e Data Ascii: =1/120;class y extends(s=h.Component){componentDidMount(){this.initialize()}componentDidUpdate(t){let{waveState:i}=this.props;i===v.hO.FILLING&&i!==t.waveState&&this.waveFill()}componentWillUnmount(){this.terminate()}initialize(){this.children.forEach(t=>
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 3d 74 68 69 73 2e 70 72 6f 70 73 2c 7b 63 61 6e 76 61 73 43 6f 6e 74 65 78 74 3a 69 7d 3d 74 68 69 73 3b 69 66 28 6e 75 6c 6c 21 3d 69 29 69 2e 66 69 6c 6c 53 74 79 6c 65 3d 74 2c 69 2e 66 69 6c 6c 52 65 63 74 28 30 2c 30 2c 74 68 69 73 2e 77 69 64 74 68 2c 74 68 69 73 2e 68 65 69 67 68 74 29 2c 74 68 69 73 2e 63 68 69 6c 64 72 65 6e 2e 66 6f 72 45 61 63 68 28 74 3d 3e 74 2e 72 65 6e 64 65 72 28 69 29 29 7d 72 65 6e 64 65 72 28 29 7b 6c 65 74 7b 77 61 76 65 53 74 61 74 65 3a 74 2c 68 69 64 65 46 61 6c 6c 62 61 63 6b 3a 69 2c 65 6d 62 65 64 64 65 64 3a 65 7d 3d 74 68 69 73 2e 70 72 6f 70 73 3b 72 65 74 75 72 6e 28 30 2c 6e 2e 6a 73 78 29 28 64 2e 41 63 63 65 73 73 69 62 69 6c 69 74 79 50 72 65 66 65 72 65 6e 63 65 73 43 6f 6e 74 65 78 74 2e 43 6f 6e 73 75 Data Ascii: =this.props,{canvasContext:i}=this;if(null!=i)i.fillStyle=t,i.fillRect(0,0,this.width,this.height),this.children.forEach(t=>t.render(i))}render(){let{waveState:t,hideFallback:i,embedded:e}=this.props;return(0,n.jsx)(d.AccessibilityPreferencesContext.Consu
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 75 6c 6c 21 3d 69 26 26 28 74 2e 77 69 64 74 68 3d 65 2a 6e 2c 74 2e 68 65 69 67 68 74 3d 73 2a 6e 2c 74 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 65 2b 22 70 78 22 2c 74 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 73 2b 22 70 78 22 2c 69 2e 73 63 61 6c 65 28 6e 2c 6e 29 29 2c 65 3c 3d 78 3f 74 68 69 73 2e 70 61 75 73 65 28 29 3a 74 68 69 73 2e 70 6c 61 79 28 29 2c 74 68 69 73 2e 77 61 76 65 2e 72 65 73 69 7a 65 57 61 76 65 28 29 2c 74 68 69 73 2e 72 65 6e 64 65 72 41 6e 69 6d 61 74 69 6f 6e 28 29 7d 29 2c 62 28 74 68 69 73 2c 22 68 61 6e 64 6c 65 56 69 73 69 62 69 6c 69 74 79 43 68 61 6e 67 65 22 2c 28 29 3d 3e 7b 64 6f 63 75 6d 65 6e 74 2e 68 69 64 64 65 6e 3f 74 68 69 73 2e 64 65 6c 61 79 65 64 50 61 75 73 65 28 29 3a 74 68 69 73 2e 70 6c 61 79 28 29 7d 29 Data Ascii: ull!=i&&(t.width=en,t.height=sn,t.style.width=e+"px",t.style.height=s+"px",i.scale(n,n)),e<=x?this.pause():this.play(),this.wave.resizeWave(),this.renderAnimation()}),b(this,"handleVisibilityChange",()=>{document.hidden?this.delayedPause():this.play()})
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 7d 7d 2c 35 36 38 31 35 34 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 69 2c 65 29 7b 65 2e 64 28 69 2c 7b 68 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 77 7d 7d 29 2c 65 28 34 37 31 32 30 29 3b 76 61 72 20 73 2c 6e 3d 65 28 32 30 30 36 35 31 29 2c 68 3d 65 28 31 39 32 33 37 39 29 2c 61 3d 65 28 31 32 30 33 35 36 29 2c 72 3d 65 2e 6e 28 61 29 2c 6c 3d 65 28 34 37 37 36 39 30 29 2c 6f 3d 65 28 38 37 37 36 30 34 29 2c 64 3d 65 28 36 32 34 31 33 38 29 2c 75 3d 65 28 31 33 33 38 35 33 29 2c 63 3d 65 28 36 38 36 36 39 34 29 2c 70 3d 65 28 38 39 38 36 32 35 29 2c 6d 3d 65 28 32 30 31 36 38 30 29 3b 66 75 6e 63 74 69 6f 6e 20 66 28 74 2c 69 2c 65 29 7b 72 65 74 75 72 6e 20 69 20 69 6e 20 74 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 Data Ascii: }},568154:function(t,i,e){e.d(i,{h:function(){return w}}),e(47120);var s,n=e(200651),h=e(192379),a=e(120356),r=e.n(a),l=e(477690),o=e(877604),d=e(624138),u=e(133853),c=e(686694),p=e(898625),m=e(201680);function f(t,i,e){return i in t?Object.defineProperty
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 64 74 68 3e 76 7d 72 65 6e 64 65 72 53 70 6c 61 73 68 41 72 74 28 29 7b 6c 65 74 7b 73 70 6c 61 73 68 3a 74 2c 65 6d 62 65 64 64 65 64 3a 69 7d 3d 74 68 69 73 2e 70 72 6f 70 73 2c 7b 77 69 64 74 68 3a 65 2c 68 65 69 67 68 74 3a 73 7d 3d 74 68 69 73 2e 73 74 61 74 65 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 74 3f 28 30 2c 6e 2e 6a 73 78 29 28 6f 2e 5a 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 72 28 29 28 6d 2e 72 69 67 68 74 53 70 6c 69 74 2c 7b 5b 6d 2e 65 6d 62 65 64 64 65 64 5d 3a 69 7d 29 2c 73 72 63 3a 74 2c 77 69 64 74 68 3a 65 2c 68 65 69 67 68 74 3a 73 2c 6f 6e 4c 6f 61 64 3a 74 68 69 73 2e 68 61 6e 64 6c 65 4c 6f 61 64 7d 29 3a 6e 75 6c 6c 7d 72 65 6e 64 65 72 57 61 76 65 28 29 7b 6c 65 74 7b 77 61 76 65 53 74 61 74 65 3a 74 2c 75 70 64 61 74 65 57 61 Data Ascii: dth>v}renderSplashArt(){let{splash:t,embedded:i}=this.props,{width:e,height:s}=this.state;return null!=t?(0,n.jsx)(o.Z,{className:r()(m.rightSplit,{[m.embedded]:i}),src:t,width:e,height:s,onLoad:this.handleLoad}):null}renderWave(){let{waveState:t,updateWa
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 6c 65 74 7b 63 75 72 72 65 6e 74 54 61 72 67 65 74 3a 69 7d 3d 74 2c 7b 6e 61 74 75 72 61 6c 57 69 64 74 68 3a 65 2c 6e 61 74 75 72 61 6c 48 65 69 67 68 74 3a 73 7d 3d 69 2c 6e 3d 67 28 65 2c 73 29 3b 6e 75 6c 6c 21 3d 6e 26 26 74 68 69 73 2e 73 65 74 53 74 61 74 65 28 6e 29 2c 74 68 69 73 2e 73 65 74 53 74 61 74 65 28 7b 73 70 6c 61 73 68 4c 6f 61 64 65 64 3a 21 30 7d 29 2c 77 69 6e 64 6f 77 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 72 65 73 69 7a 65 22 2c 74 68 69 73 2e 68 61 6e 64 6c 65 52 65 73 69 7a 65 29 2c 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 72 65 73 69 7a 65 22 2c 74 68 69 73 2e 68 61 6e 64 6c 65 52 65 73 69 7a 65 29 7d 29 7d 7d 66 28 62 2c 22 64 65 66 61 75 6c 74 50 72 6f 70 73 22 2c Data Ascii: let{currentTarget:i}=t,{naturalWidth:e,naturalHeight:s}=i,n=g(e,s);null!=n&&this.setState(n),this.setState({splashLoaded:!0}),window.removeEventListener("resize",this.handleResize),window.addEventListener("resize",this.handleResize)})}}f(b,"defaultProps",
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 64 65 64 22 2c 21 31 29 2c 68 28 74 68 69 73 2c 22 69 73 46 69 6c 6c 65 64 22 2c 21 31 29 2c 68 28 74 68 69 73 2c 22 61 6c 70 68 61 22 2c 30 29 2c 68 28 74 68 69 73 2c 22 6d 78 22 2c 30 29 2c 68 28 74 68 69 73 2c 22 6d 79 22 2c 30 29 2c 68 28 74 68 69 73 2c 22 78 22 2c 30 29 2c 68 28 74 68 69 73 2c 22 79 22 2c 30 29 2c 68 28 74 68 69 73 2c 22 76 65 6c 58 22 2c 30 29 2c 68 28 74 68 69 73 2c 22 76 65 6c 59 22 2c 30 29 2c 68 28 74 68 69 73 2c 22 74 61 72 67 65 74 58 22 2c 34 30 29 2c 68 28 74 68 69 73 2c 22 74 61 72 67 65 74 59 22 2c 34 30 29 2c 68 28 74 68 69 73 2c 22 73 70 72 69 6e 67 22 2c 7b 66 72 69 63 74 69 6f 6e 3a 36 30 2c 74 65 6e 73 69 6f 6e 3a 31 30 30 7d 29 2c 68 28 74 68 69 73 2c 22 68 61 6e 64 6c 65 4d 6f 75 73 65 4d 6f 76 65 22 2c 74 3d 3e 7b Data Ascii: ded",!1),h(this,"isFilled",!1),h(this,"alpha",0),h(this,"mx",0),h(this,"my",0),h(this,"x",0),h(this,"y",0),h(this,"velX",0),h(this,"velY",0),h(this,"targetX",40),h(this,"targetY",40),h(this,"spring",{friction:60,tension:100}),h(this,"handleMouseMove",t=>{
2024-10-24 07:15:47 UTC	1369	IN	Data Raw: 76 61 72 20 73 3d 65 28 39 35 36 38 34 33 29 2c 6e 3d 65 28 37 32 32 37 33 34 29 3b 66 75 6e 63 74 69 6f 6e 20 68 28 74 2c 69 2c 65 29 7b 72 65 74 75 72 6e 20 69 20 69 6e 20 74 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 69 2c 7b 76 61 6c 75 65 3a 65 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 74 5b 69 5d 3d 65 2c 74 7d 69 2e 5a 3d 63 6c 61 73 73 20 74 7b 69 6e 69 74 69 61 6c 69 7a 65 28 29 7b 74 68 69 73 2e 70 61 72 74 69 63 6c 65 73 3d 5b 5d 2c 74 68 69 73 2e 77 69 6e 64 2e 69 6e 69 74 69 61 6c 69 7a 65 28 29 2c 74 68 69 73 2e 6c 6f 61 64 49 6e 54 69 6d 65 72 3d 73 65 74 54 69 6d 65 6f 75 74 28 28 29 3d 3e 7b 66 6f 72 28 6c 65 74 20 Data Ascii: var s=e(956843),n=e(722734);function h(t,i,e){return i in t?Object.defineProperty(t,i,{value:e,enumerable:!0,configurable:!0,writable:!0}):t[i]=e,t}i.Z=class t{initialize(){this.particles=[],this.wind.initialize(),this.loadInTimer=setTimeout(()=>{for(let

Target ID:	0
Start time:	03:15:24
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\xxImTScxAq.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\xxImTScxAq.exe"
Imagebase:	0x7ff672970000
File size:	506'368 bytes
MD5 hash:	C6938E6C34B9124099C93DEC5F9487C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:15:24
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:15:24
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a9580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:15:24
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff6a0b90000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:15:25
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a9580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:15:25
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff6a0b90000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:15:25
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a9580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:15:25
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff6a0b90000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:15:25
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff6a9580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:15:25
Start date:	24/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff7afe00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:15:25
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff6a9580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:15:25
Start date:	24/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff7afe00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:15:25
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff6a9580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:15:25
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a9580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 7788, Parent PID: 7772

General

Target ID:	15
Start time:	03:15:25
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff6a0b90000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:15:25
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a9580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 7832, Parent PID: 7816

General

Target ID:	17
Start time:	03:15:26
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff6a0b90000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:15:26
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a9580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 7904, Parent PID: 7884

General

Target ID:	19
Start time:	03:15:26
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff6a0b90000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:15:26
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff6a9580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 7948, Parent PID: 7932

General

Target ID:	21
Start time:	03:15:26
Start date:	24/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff7afe00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:15:27
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff6a9580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 7980, Parent PID: 7964

General

Target ID:	23
Start time:	03:15:27
Start date:	24/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff7afe00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:15:27
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff6a9580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 8028, Parent PID: 7456

General

Target ID:	25
Start time:	03:15:28
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a9580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 8044, Parent PID: 8028

General

Target ID:	26
Start time:	03:15:28
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff6a0b90000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	03:15:28
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a9580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 8088, Parent PID: 8072

General

Target ID:	28
Start time:	03:15:28
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff6a0b90000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	03:15:28
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a9580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	03:15:28
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff6a0b90000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	03:15:28
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff6a9580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	03:15:29
Start date:	24/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff7afe00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	03:15:29
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff6a9580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 1660, Parent PID: 7244

General

Target ID:	34
Start time:	03:15:29
Start date:	24/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff7afe00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	03:15:29
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff6a9580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: chrome.exePID: 6388, Parent PID: 7456

General

Target ID:	37
Start time:	03:15:30
Start date:	24/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://discord.gg/privatecommunity
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	03:15:31
Start date:	24/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1976,i,17008637015188082442,6516935950602150034,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7b4ee0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	03:15:42
Start date:	24/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4968 --field-trial-handle=1976,i,17008637015188082442,6516935950602150034,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	03:15:42
Start date:	24/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 --field-trial-handle=1976,i,17008637015188082442,6516935950602150034,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	96

Executed Functions

Function 00007FF67299F5C0 Relevance: 178.5, APIs: 31, Strings: 70, Instructions: 1702stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299F698
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67299F6A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299F778
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299F7FC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299F8A3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299F93A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299FA05
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299FA3D
strchr.VCRUNTIME140 ref: 00007FF67299FBB7
strchr.VCRUNTIME140 ref: 00007FF67299FBCA
strchr.VCRUNTIME140 ref: 00007FF67299FBDC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299FCE3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299FD53
memcpy.VCRUNTIME140 ref: 00007FF67299FD7A
strchr.VCRUNTIME140 ref: 00007FF67299FD8E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299FDA2
strstr.VCRUNTIME140 ref: 00007FF67299FFD8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A0111
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A0289

Part of subcall function 00007FF672998DE0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF672998E53

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A033C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A03C1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A061A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A0630
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A063F

Part of subcall function 00007FF6729A1990: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A19EA

strchr.VCRUNTIME140 ref: 00007FF6729A0BF7
strchr.VCRUNTIME140 ref: 00007FF6729A0C0A
strchr.VCRUNTIME140 ref: 00007FF6729A0C1C

Part of subcall function 00007FF6729A1990: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A1A0A
Part of subcall function 00007FF6729A1990: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A1A13

strchr.VCRUNTIME140 ref: 00007FF6729A0E6F
strchr.VCRUNTIME140 ref: 00007FF6729A0E82
strchr.VCRUNTIME140 ref: 00007FF6729A0E94

Part of subcall function 00007FF6729A3FC0: strchr.VCRUNTIME140 ref: 00007FF6729A40A6
Part of subcall function 00007FF6729A3FC0: strchr.VCRUNTIME140 ref: 00007FF6729A40B9
Part of subcall function 00007FF6729A3FC0: strchr.VCRUNTIME140 ref: 00007FF6729A40CB

Strings

Failed sending PUT request, xrefs: 00007FF6729A0A69
POST, xrefs: 00007FF67299F745
ftp, xrefs: 00007FF67299FFA9
Host:, xrefs: 00007FF67299FDB1
Expect, xrefs: 00007FF6729A0B94, 00007FF6729A0E09
User-Agent, xrefs: 00007FF67299F75D
Accept, xrefs: 00007FF6729A0093
Content-Range: bytes %s%I64d/%I64d, xrefs: 00007FF6729A02C8
%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF6729A05FB
Accept: */*, xrefs: 00007FF6729A00A5
%s , xrefs: 00007FF6729A0353
%s%s, xrefs: 00007FF6729A07D0
Content-Type, xrefs: 00007FF67299FAA7, 00007FF6729A0DDD
Chunky upload is not supported by HTTP 1.0, xrefs: 00007FF67299FCBC
Content-Range: bytes 0-%I64d/%I64d, xrefs: 00007FF6729A02A4
File already completely uploaded, xrefs: 00007FF6729A0229
Proxy-Connection: Keep-Alive, xrefs: 00007FF6729A04BF, 00007FF6729A04D4
ftp://%s:%s@%s, xrefs: 00007FF6729A03EB
1.0, xrefs: 00007FF6729A0320
If-Unmodified-Since, xrefs: 00007FF6729A0884
0, xrefs: 00007FF6729A0FE6, 00007FF6729A10E5
GET, xrefs: 00007FF67299F752
Referer, xrefs: 00007FF67299F953
Host: %s%s%s, xrefs: 00007FF67299FE5D
Last-Modified, xrefs: 00007FF6729A087B
;type=%c, xrefs: 00007FF6729A0041
%s, xrefs: 00007FF6729A0B73
Failed sending HTTP request, xrefs: 00007FF6729A0D66
Cookie, xrefs: 00007FF67299F9C2
Content-Range: bytes %s/%I64d, xrefs: 00007FF6729A02D6
Transfer-Encoding:, xrefs: 00007FF67299FB6E
Range: bytes=%s, xrefs: 00007FF6729A011E
Could not seek stream, xrefs: 00007FF6729A0188
Invalid TIMEVALUE, xrefs: 00007FF6729A0843
Content-Range, xrefs: 00007FF6729A026E
Content-Type: application/x-www-form-urlencoded, xrefs: 00007FF6729A0DF1
Failed sending POST request, xrefs: 00007FF6729A0AC9, 00007FF6729A0D0D
%x, xrefs: 00007FF6729A0F95
Transfer-Encoding, xrefs: 00007FF67299FB4D
HEAD, xrefs: 00007FF67299F701
upload completely sent off: %I64d out of %I64d bytes, xrefs: 00007FF6729A119E
%s%s=%s, xrefs: 00007FF6729A0749
Content-Length, xrefs: 00007FF6729A09D4, 00007FF6729A0B29, 00007FF6729A0DAE
Accept-Encoding: %s, xrefs: 00007FF67299FA12
OPTIONS, xrefs: 00007FF67299F72B
;type=, xrefs: 00007FF67299FFCE
Accept-Encoding, xrefs: 00007FF67299F9E1
Proxy-Connection, xrefs: 00007FF6729A0493
100-continue, xrefs: 00007FF6729A0C36, 00007FF6729A0EB6
multipart/form-data, xrefs: 00007FF67299FAEA
Referer: %s, xrefs: 00007FF67299F96E
Cookie: , xrefs: 00007FF6729A072E, 00007FF6729A07A4
If-Modified-Since, xrefs: 00007FF6729A088D
%s: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 00007FF6729A0914
Range, xrefs: 00007FF6729A00F2
chunked, xrefs: 00007FF67299FBF6
%s?%s, xrefs: 00007FF67299F795
Could only read %I64d bytes from the input, xrefs: 00007FF6729A0245
Host:%s, xrefs: 00007FF67299FDE6
?%s, xrefs: 00007FF6729A042B
Expect:, xrefs: 00007FF6729A0BB5, 00007FF6729A0E2A
1.1, xrefs: 00007FF6729A032E
Failed sending HTTP POST request, xrefs: 00007FF6729A109B
PUT, xrefs: 00007FF67299F738
Host, xrefs: 00007FF67299FCE9
Content-Length: 0, xrefs: 00007FF6729A0A90
http, xrefs: 00007FF67299FF3B
Transfer-Encoding: chunked, xrefs: 00007FF67299FCAF
Content-Length: %I64d, xrefs: 00007FF6729A09EB, 00007FF6729A0B40, 00007FF6729A0DC5
Host: %s%s%s:%d, xrefs: 00007FF67299FEA2

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$strchr$_strdup$callocmemcpystrstr
String ID: %s$%s $%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s$%s%s$%s%s=%s$%s: %s, %02d %s %4d %02d:%02d:%02d GMT$%s?%s$%x$0$1.0$1.1$100-continue$;type=$;type=%c$?%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: */*$Chunky upload is not supported by HTTP 1.0$Content-Length$Content-Length: %I64d$Content-Length: 0$Content-Range$Content-Range: bytes %s%I64d/%I64d$Content-Range: bytes %s/%I64d$Content-Range: bytes 0-%I64d/%I64d$Content-Type$Content-Type: application/x-www-form-urlencoded$Cookie$Cookie: $Could not seek stream$Could only read %I64d bytes from the input$Expect$Expect:$Failed sending HTTP POST request$Failed sending HTTP request$Failed sending POST request$Failed sending PUT request$File already completely uploaded$GET$HEAD$Host$Host:$Host: %s%s%s$Host: %s%s%s:%d$Host:%s$If-Modified-Since$If-Unmodified-Since$Invalid TIMEVALUE$Last-Modified$OPTIONS$POST$PUT$Proxy-Connection$Proxy-Connection: Keep-Alive$Range$Range: bytes=%s$Referer$Referer: %s$Transfer-Encoding$Transfer-Encoding:$Transfer-Encoding: chunked$User-Agent$chunked$ftp$ftp://%s:%s@%s$http$multipart/form-data$upload completely sent off: %I64d out of %I64d bytes
API String ID: 2045874074-4264080130
Opcode ID: aeffc584b0598f0c0bb393ceb33e62c09cc694d64bcfff0cd2588b74ff30af3a
Instruction ID: d786aa06f2df5bbc35187451cd10a471361087b6bf68da8592979b0a6d5d9d0f
Opcode Fuzzy Hash: aeffc584b0598f0c0bb393ceb33e62c09cc694d64bcfff0cd2588b74ff30af3a
Instruction Fuzzy Hash: F5038C23E28B8299FB548B2794403B967A0EB85B9CF4C4035CE4D97697EFBDE455CB00

Function 00007FF6729A9F6D Relevance: 116.1, APIs: 43, Strings: 23, Instructions: 552stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6729AA0C8
strchr.VCRUNTIME140 ref: 00007FF6729AA0F4
strchr.VCRUNTIME140 ref: 00007FF6729AA12E
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729AA152
strchr.VCRUNTIME140 ref: 00007FF6729AA262
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729AA27A

Strings

CurrentUser, xrefs: 00007FF6729AA142
schannel: Failed to get certificate from file %s, last error is 0x%x, xrefs: 00007FF6729AA57F
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF6729AA509
schannel: Failed to import cert file %s, last error is 0x%x, xrefs: 00007FF6729AA534
schannel: Failed to read cert file %s, xrefs: 00007FF6729AA629
schannel: Failed to get certificate location or file for %s, xrefs: 00007FF6729AA652
http/1.1, xrefs: 00007FF6729AA797
LocalMachineGroupPolicy, xrefs: 00007FF6729AA21C
Services, xrefs: 00007FF6729AA1C7
Microsoft Unified Security Protocol Provider, xrefs: 00007FF6729AA66F
schannel: ALPN, offering %s, xrefs: 00007FF6729AA7A5
schannel: AcquireCredentialsHandle failed: %s, xrefs: 00007FF6729AA6E5
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF6729AA763
Unable to set ciphers to passed via SSL_CONN_CONFIG, xrefs: 00007FF6729AA167
schannel: unable to allocate memory, xrefs: 00007FF6729AA5EC, 00007FF6729AA877
schannel: Failed to open cert store %x %s, last error is 0x%x, xrefs: 00007FF6729AA2E0
CurrentUserGroupPolicy, xrefs: 00007FF6729AA1FD
LocalMachine, xrefs: 00007FF6729AA183
http/1.1, xrefs: 00007FF6729AA783
LocalMachineEnterprise, xrefs: 00007FF6729AA23B
Users, xrefs: 00007FF6729AA1E6
schannel: TLS 1.3 is not yet supported, xrefs: 00007FF6729A9FFB
CurrentService, xrefs: 00007FF6729AA1A5

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: strchr$_strdupstrncmpstrtol
String ID: CurrentService$CurrentUser$CurrentUserGroupPolicy$LocalMachine$LocalMachineEnterprise$LocalMachineGroupPolicy$Microsoft Unified Security Protocol Provider$Services$Unable to set ciphers to passed via SSL_CONN_CONFIG$Users$http/1.1$http/1.1$schannel: ALPN, offering %s$schannel: AcquireCredentialsHandle failed: %s$schannel: Failed to get certificate from file %s, last error is 0x%x$schannel: Failed to get certificate location or file for %s$schannel: Failed to import cert file %s, last error is 0x%x$schannel: Failed to import cert file %s, password is bad$schannel: Failed to open cert store %x %s, last error is 0x%x$schannel: Failed to read cert file %s$schannel: TLS 1.3 is not yet supported$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.
API String ID: 707411602-3372543188
Opcode ID: 40906413e4bc340d0b0f0e1346a096e734ff7e897bf7bda59f765beb742903bd
Instruction ID: 1167e3c1892319bcc3d864534b724c30661e0254605154f82953c9c3b83486de
Opcode Fuzzy Hash: 40906413e4bc340d0b0f0e1346a096e734ff7e897bf7bda59f765beb742903bd
Instruction Fuzzy Hash: 34429E33A28B4286EB648B27E8502B933B0FF45798F585135CA5E87792DFBCE544DB40

Function 00007FF672981560 Relevance: 114.1, APIs: 51, Strings: 14, Instructions: 304
processsleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF67298158A
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF6729815C6
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF6729815F2
SetConsoleTitleA.KERNEL32 ref: 00007FF672981670
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729816A9
GetConsoleWindow.KERNEL32 ref: 00007FF6729816B5
GetWindowLongPtrA.USER32 ref: 00007FF6729816C6
SetWindowLongPtrA.USER32 ref: 00007FF6729816DC
SetLayeredWindowAttributes.USER32 ref: 00007FF6729816F0
GetStdHandle.KERNEL32 ref: 00007FF672981700
SetConsoleTextAttribute.KERNEL32 ref: 00007FF67298170C
GetStdHandle.KERNEL32 ref: 00007FF672981717
SetConsoleTextAttribute.KERNEL32 ref: 00007FF672981723
GetStdHandle.KERNEL32 ref: 00007FF67298173A
SetConsoleTextAttribute.KERNEL32 ref: 00007FF672981746

Part of subcall function 00007FF6729806B0: memcpy.VCRUNTIME140(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF6729711FC), ref: 00007FF67298078F

Part of subcall function 00007FF672981AA0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,0000000B,00007FF672981758), ref: 00007FF672981AC4
Part of subcall function 00007FF672981AA0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,0000000B,00007FF672981758), ref: 00007FF672981AE5

GetStdHandle.KERNEL32 ref: 00007FF672981769
SetConsoleTextAttribute.KERNEL32 ref: 00007FF672981775
GetStdHandle.KERNEL32 ref: 00007FF67298178C
SetConsoleTextAttribute.KERNEL32 ref: 00007FF672981798
GetStdHandle.KERNEL32 ref: 00007FF6729817AF
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6729817BB
GetStdHandle.KERNEL32 ref: 00007FF6729817D2
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6729817DE
GetStdHandle.KERNEL32 ref: 00007FF6729817F5
SetConsoleTextAttribute.KERNEL32 ref: 00007FF672981801
GetStdHandle.KERNEL32 ref: 00007FF672981818
SetConsoleTextAttribute.KERNEL32 ref: 00007FF672981824
GetStdHandle.KERNEL32 ref: 00007FF672981847
SetConsoleTextAttribute.KERNEL32 ref: 00007FF672981853
GetStdHandle.KERNEL32 ref: 00007FF67298186A
SetConsoleTextAttribute.KERNEL32 ref: 00007FF672981876
GetStdHandle.KERNEL32 ref: 00007FF67298188D
SetConsoleTextAttribute.KERNEL32 ref: 00007FF672981899
GetStdHandle.KERNEL32 ref: 00007FF6729818BC
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6729818C8
GetStdHandle.KERNEL32 ref: 00007FF6729818DF
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6729818EB
GetStdHandle.KERNEL32 ref: 00007FF672981902
SetConsoleTextAttribute.KERNEL32 ref: 00007FF67298190E
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z.MSVCP140 ref: 00007FF67298192B
URLDownloadToFileA.URLMON ref: 00007FF67298197F
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67298198B
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672981998
Sleep.KERNEL32 ref: 00007FF6729819A3
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729819AB
URLDownloadToFileA.URLMON ref: 00007FF6729819FD
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672981A09
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672981A16
Sleep.KERNEL32 ref: 00007FF672981A21
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672981A29
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672981A62

Strings

http://185.101.104.122/aimsemhvibronkz.exe, xrefs: 00007FF672981939
cd C:\, xrefs: 00007FF672981984, 00007FF672981A02
[ Selecione uma opcao: ], xrefs: 00007FF67298177B
Iniciar Valorant Aim (HVCI DESLIGADO): , xrefs: 00007FF67298182A
C:\Windows\System32\SeiebingsHosDialog.exe, xrefs: 00007FF6729819C8
##########################################################, xrefs: 00007FF672981758
Iniciar Valorant Aim (HVCI HABILITADO): , xrefs: 00007FF67298189F
##########################################################, xrefs: 00007FF67298179E
C:\Windows\System32\SerceubetisHostDialog.exe, xrefs: 00007FF67298194A
.exe, xrefs: 00007FF672981593
http://185.101.104.122/aimhvibronkz.exe, xrefs: 00007FF6729819B7
start C:\Windows\System32\SeiebingsHosDialog.exe, xrefs: 00007FF672981A0F
Selecione a opcao: , xrefs: 00007FF672981914
start C:\Windows\System32\SerceubetisHostDialog.exe, xrefs: 00007FF672981991

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: Console$AttributeHandleText$Windowsystem$rand$DownloadFileLongSleep_invalid_parameter_noinfo_noreturnexit$??5?$basic_istream@AttributesD@std@@@std@@LayeredTitleU?$char_traits@V01@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: Iniciar Valorant Aim (HVCI DESLIGADO): $ Iniciar Valorant Aim (HVCI HABILITADO): $ Selecione a opcao: $##########################################################$##########################################################$.exe$C:\Windows\System32\SeiebingsHosDialog.exe$C:\Windows\System32\SerceubetisHostDialog.exe$[ Selecione uma opcao: ]$cd C:\$http://185.101.104.122/aimhvibronkz.exe$http://185.101.104.122/aimsemhvibronkz.exe$start C:\Windows\System32\SeiebingsHosDialog.exe$start C:\Windows\System32\SerceubetisHostDialog.exe
API String ID: 2233566951-799683856
Opcode ID: 41bacca139d07f3eca55aefecd2356775774a2e192d86a0af3bec098620f30b7
Instruction ID: d7a02567ca9d7509fa63b0443fbff1bc02433fe9f77ae33e5a222413c275e368
Opcode Fuzzy Hash: 41bacca139d07f3eca55aefecd2356775774a2e192d86a0af3bec098620f30b7
Instruction Fuzzy Hash: FDE17223F28A43C6EB009B72D8545B83361AF84B9CF5C5235D61EC66F6DFBCA4499B10

Function 00007FF6729989B0 Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 191
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00007FF6729989D8
WSACleanup.WS2_32 ref: 00007FF6729989F3
GetModuleHandleA.KERNEL32 ref: 00007FF672998A44
GetProcAddress.KERNEL32 ref: 00007FF672998A70
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF672998A8A
LoadLibraryA.KERNEL32 ref: 00007FF672998AAD
GetProcAddress.KERNEL32 ref: 00007FF672998ACA
LoadLibraryExA.KERNEL32 ref: 00007FF672998AE0
GetSystemDirectoryA.KERNEL32 ref: 00007FF672998AF6
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672998B0E
GetSystemDirectoryA.KERNEL32 ref: 00007FF672998B22
LoadLibraryA.KERNEL32 ref: 00007FF672998B90
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672998B9C
GetProcAddress.KERNEL32 ref: 00007FF672998BC8
VerSetConditionMask.KERNEL32 ref: 00007FF672998C51
VerSetConditionMask.KERNEL32 ref: 00007FF672998C64
VerSetConditionMask.KERNEL32 ref: 00007FF672998C73
VerSetConditionMask.KERNEL32 ref: 00007FF672998C82
VerSetConditionMask.KERNEL32 ref: 00007FF672998C92
VerifyVersionInfoA.KERNEL32 ref: 00007FF672998CA3
QueryPerformanceFrequency.KERNEL32 ref: 00007FF672998CBF

Strings

kernel32, xrefs: 00007FF672998A2B
iphlpapi.dll, xrefs: 00007FF672998A76
if_nametoindex, xrefs: 00007FF672998BBE
LoadLibraryExA, xrefs: 00007FF672998A5E
AddDllDirectory, xrefs: 00007FF672998AC0

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: ConditionMask$AddressLibraryLoadProc$DirectorySystem$CleanupFrequencyHandleInfoModulePerformanceQueryStartupVerifyVersionfreemallocstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$if_nametoindex$iphlpapi.dll$kernel32
API String ID: 2612373469-2794540096
Opcode ID: c083cb4f390fc3a8bddec676e2e6bfd66656802584a0cca774c61b149c7a6288
Instruction ID: 112fe5d5db5223ef5cb4baa5c5e3bac65498d02e4e62bb7618738af7d7811989
Opcode Fuzzy Hash: c083cb4f390fc3a8bddec676e2e6bfd66656802584a0cca774c61b149c7a6288
Instruction Fuzzy Hash: 6F918563E2D78285E7608B62E4143B9B391FF98B98F4C5139C98D87756EFBCE0558B00

Function 00007FF672997CF0 Relevance: 38.9, APIs: 15, Strings: 7, Instructions: 357
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF672997D8C
socket.WS2_32 ref: 00007FF672997DD5
htons.WS2_32 ref: 00007FF672997E61
setsockopt.WS2_32 ref: 00007FF672997EC3
WSAGetLastError.WS2_32 ref: 00007FF672997ECD
getsockopt.WS2_32 ref: 00007FF672997F6F
setsockopt.WS2_32 ref: 00007FF672997F9E
setsockopt.WS2_32 ref: 00007FF672997FDD
WSAIoctl.WS2_32 ref: 00007FF67299806A
WSAGetLastError.WS2_32 ref: 00007FF672998074

Part of subcall function 00007FF6729A4CC0: ioctlsocket.WS2_32 ref: 00007FF6729A4CD9

Part of subcall function 00007FF67299D7E0: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF67298585F), ref: 00007FF67299D7F7

connect.WS2_32 ref: 00007FF67299819B
WSAGetLastError.WS2_32 ref: 00007FF6729981B8

Part of subcall function 00007FF672982530: GetLastError.KERNEL32 ref: 00007FF672982552
Part of subcall function 00007FF672982530: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67298255A

Part of subcall function 00007FF672995B20: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF672995C45
Part of subcall function 00007FF672995B20: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF672995C60

Part of subcall function 00007FF672996600: closesocket.WS2_32 ref: 00007FF672996643

Strings

Could not set TCP_NODELAY: %s, xrefs: 00007FF672997EEA
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 00007FF67299825E
@, xrefs: 00007FF672997F07
Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 00007FF67299807D
Trying %s:%ld..., xrefs: 00007FF672997E6F
Immediate connect fail for %s: %s, xrefs: 00007FF6729981E8
Failed to set SO_KEEPALIVE on fd %d, xrefs: 00007FF672997FEA

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: ErrorLast$setsockopt$fwrite$CounterIoctlPerformanceQuery_errnoclosesocketconnectgetsockopthtonsioctlsocketmemcpysocket
String ID: Trying %s:%ld...$ @$Could not set TCP_NODELAY: %s$Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d$Immediate connect fail for %s: %s$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 3453287622-3868455274
Opcode ID: 2b0da99dab420aae0de35c482b701566da2d049f4720ba2efb966cda41760235
Instruction ID: 7043b0962291da0d3186d611bb1b7bdae446ecd9f415e5267fcd73cd172c1fbf
Opcode Fuzzy Hash: 2b0da99dab420aae0de35c482b701566da2d049f4720ba2efb966cda41760235
Instruction Fuzzy Hash: 7AF1D5B3A282428AEB508B66D4442BD7390FB84B9CF584139DA8DC7796DFBCE555CF00

Function 00007FF672998690 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 128
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?,00007FF6729C24EA,?,?,?,?,00007FF672998A1B), ref: 00007FF6729986A4
GetProcAddress.KERNEL32(?,?,00007FF6729C24EA,?,?,?,?,00007FF672998A1B), ref: 00007FF6729986C9
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00007FF6729C24EA,?,?,?,?,00007FF672998A1B), ref: 00007FF6729986DC

Strings

kernel32, xrefs: 00007FF67299869D
LoadLibraryExA, xrefs: 00007FF6729986BA
AddDllDirectory, xrefs: 00007FF672998723

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: AddressHandleModuleProcstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$kernel32
API String ID: 27745253-3327535076
Opcode ID: 8388aba21a8c0aa0f9473d001361012775d927e5fc05d01427c1925a7149228a
Instruction ID: d5d0ddfeeec127c3fddc9ca3c7ada657167a66f9449e97d193aa29a565b246cd
Opcode Fuzzy Hash: 8388aba21a8c0aa0f9473d001361012775d927e5fc05d01427c1925a7149228a
Instruction Fuzzy Hash: 2741F353B2964286EB058F63A800178A7A1FF86FE9F0C4134CE4D83792DE7DE496CB00

Function 00007FF6729A4A90 Relevance: 24.1, APIs: 16, Instructions: 127
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 00007FF6729A4AD1
htonl.WS2_32 ref: 00007FF6729A4AFE
setsockopt.WS2_32 ref: 00007FF6729A4B35
bind.WS2_32 ref: 00007FF6729A4B50
getsockname.WS2_32 ref: 00007FF6729A4B6C
listen.WS2_32 ref: 00007FF6729A4B81
socket.WS2_32 ref: 00007FF6729A4B98
connect.WS2_32 ref: 00007FF6729A4BB7
accept.WS2_32 ref: 00007FF6729A4BCE
send.WS2_32 ref: 00007FF6729A4C1C
recv.WS2_32 ref: 00007FF6729A4C3A
memcmp.VCRUNTIME140 ref: 00007FF6729A4C55
closesocket.WS2_32 ref: 00007FF6729A4C61

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: socket$acceptbindclosesocketconnectgetsocknamehtonllistenmemcmprecvsendsetsockopt
String ID:
API String ID: 3699910901-0
Opcode ID: 1765dba4a34ad8a3c5df6ea34613a525f22cd2e98c38cee1cc4f40bf1b2ef312
Instruction ID: ee785b911ebd34beb363dc4a46178e16d3b737c9a82214fb326eedee951485c0
Opcode Fuzzy Hash: 1765dba4a34ad8a3c5df6ea34613a525f22cd2e98c38cee1cc4f40bf1b2ef312
Instruction Fuzzy Hash: DB517533A28A4281D7509F26E4441697371FB84BB8F586331E67E876E6DF7CE445CB00

Function 00007FF6729969B0 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

After %I64dms connect time, move on!, xrefs: 00007FF672996B75
Failed to connect to %s port %ld: %s, xrefs: 00007FF672996EDE
connect to %s port %ld failed: %s, xrefs: 00007FF672996C2D
Connection failed, xrefs: 00007FF672996D96
Connection time-out, xrefs: 00007FF672996A99

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID:
String ID: After %I64dms connect time, move on!$Connection failed$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 0-3307081561
Opcode ID: 2cbe8c97cd0c9d1a4e1d269ed8391c786f5ef7d33c65387367d08f2020238ebf
Instruction ID: 7db2679304df8085473aab53b790dc4e5c2c74b026b0faa2823062bce0158296
Opcode Fuzzy Hash: 2cbe8c97cd0c9d1a4e1d269ed8391c786f5ef7d33c65387367d08f2020238ebf
Instruction Fuzzy Hash: 0AE1D963B2C6828AE7548B26D5443BD6760FB857A8F084239DA9D877C6DF7CE461CB00

Function 00007FF672972AD0 Relevance: 40.7, APIs: 16, Strings: 7, Instructions: 402
sleepwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF672972870: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729728D7
Part of subcall function 00007FF672972870: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672972947
Part of subcall function 00007FF672972870: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729729A7
Part of subcall function 00007FF672972870: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729729F7
Part of subcall function 00007FF672972870: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672972A47

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672972C78

Part of subcall function 00007FF6729748F0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729749B0

Part of subcall function 00007FF6729CF220: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF67297441E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF672971B79), ref: 00007FF6729CF23A

Part of subcall function 00007FF672974340: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF672971B79), ref: 00007FF672974371

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672972CC8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672972D07
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672972D55
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672972D94
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672972E48
memcpy.VCRUNTIME140 ref: 00007FF672972E6D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672972F43
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672972F8A
ShellExecuteA.SHELL32 ref: 00007FF672973082
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297308A
MessageBoxA.USER32 ref: 00007FF6729730C0
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729730D1
Sleep.KERNEL32 ref: 00007FF672973139
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672973141
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF672973148

Part of subcall function 00007FF672973190: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297329F
Part of subcall function 00007FF672973190: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729732E0

Part of subcall function 00007FF672973C60: memcpy.VCRUNTIME140 ref: 00007FF672973CB3

Part of subcall function 00007FF672973300: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729733E0

Part of subcall function 00007FF672973400: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729734E0

Strings

invalidver, xrefs: 00007FF672973009
Failure, xrefs: 00007FF6729730B7
download, xrefs: 00007FF672973045
open, xrefs: 00007FF672973079
sessionid, xrefs: 00007FF672972ECE
message, xrefs: 00007FF672972FD3, 00007FF672973091
success, xrefs: 00007FF672972EA6

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$system$exitmemcpy$Concurrency::cancel_current_taskExecuteMessageShellSleepmalloc
String ID: Failure$download$invalidver$message$open$sessionid$success
API String ID: 3283070336-3881042241
Opcode ID: 00f0b7fe6491a3b1014bb6d8cba8a22ff91c0f8e45571c8f2324f7224dd58072
Instruction ID: 7040ef2f67a7f1cc115d01d7ea54c86d77a2d5f25eb743592177ab6e35e5c0bd
Opcode Fuzzy Hash: 00f0b7fe6491a3b1014bb6d8cba8a22ff91c0f8e45571c8f2324f7224dd58072
Instruction Fuzzy Hash: 5C02C163E28B8285EB008B66D4443AD3761FF45798F585235DAAD86BDBDFBCD084C740

Function 00007FF6729AB5F0 Relevance: 38.9, APIs: 6, Strings: 16, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF6729ABC31
memcpy.VCRUNTIME140 ref: 00007FF6729ABC4D

Strings

schannel: failed to decrypt data, need more data, xrefs: 00007FF6729ABB5A
schannel: remote party requests renegotiation, xrefs: 00007FF6729ABA12
schannel: failed to read data from server: %s, xrefs: 00007FF6729ABB82
schannel: renegotiating SSL/TLS connection, xrefs: 00007FF6729ABA48
schannel: unable to re-allocate memory, xrefs: 00007FF6729AB72D, 00007FF6729ABB96
schannel: can't renogotiate, encrypted data available, xrefs: 00007FF6729ABBD2
schannel: Curl_read_plain returned error %d, xrefs: 00007FF6729AB991
schannel: enough decrypted data is already available, xrefs: 00007FF6729AB675
schannel: SSL/TLS connection renegotiated, xrefs: 00007FF6729ABA8F
schannel: server closed the connection, xrefs: 00007FF6729ABAC4
schannel: can't renogotiate, an error is pending, xrefs: 00007FF6729ABBB2
schannel: server closed abruptly (missing close_notify), xrefs: 00007FF6729ABBDE
schannel: server indicated shutdown in a prior call, xrefs: 00007FF6729AB6B8
schannel: an unrecoverable error occurred in a prior call, xrefs: 00007FF6729AB695
schannel: renegotiation failed, xrefs: 00007FF6729ABBBE
schannel: Curl_read_plain returned CURLE_RECV_ERROR, xrefs: 00007FF6729AB7BD

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: memcpy
String ID: schannel: Curl_read_plain returned CURLE_RECV_ERROR$schannel: Curl_read_plain returned error %d$schannel: SSL/TLS connection renegotiated$schannel: an unrecoverable error occurred in a prior call$schannel: can't renogotiate, an error is pending$schannel: can't renogotiate, encrypted data available$schannel: enough decrypted data is already available$schannel: failed to decrypt data, need more data$schannel: failed to read data from server: %s$schannel: remote party requests renegotiation$schannel: renegotiating SSL/TLS connection$schannel: renegotiation failed$schannel: server closed abruptly (missing close_notify)$schannel: server closed the connection$schannel: server indicated shutdown in a prior call$schannel: unable to re-allocate memory
API String ID: 3510742995-857957974
Opcode ID: 823f2b89f3a0ca34d09281e9128758b96ff7335744995e82c474d72e09e14fd7
Instruction ID: fa6e197bfcdab472cb1fb2e5a9345fd2e7ad262531acfb274ba442016beedf48
Opcode Fuzzy Hash: 823f2b89f3a0ca34d09281e9128758b96ff7335744995e82c474d72e09e14fd7
Instruction Fuzzy Hash: FF02E133A28B8585EB50CB1BD46476A37B4FB50B98F281536CA4DC77A2DFB8D441CB00

Function 00007FF6729AAA80 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 415
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729AAB70
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729AABC1
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729AAC04
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729AACE7
memcpy.VCRUNTIME140 ref: 00007FF6729AAD89
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729AADF2
memcpy.VCRUNTIME140 ref: 00007FF6729AAECA
memset.VCRUNTIME140 ref: 00007FF6729AB097
CertFreeCertificateContext.CRYPT32 ref: 00007FF6729AB0FA

Strings

schannel: failed to send next handshake data: sent %zd of %lu bytes, xrefs: 00007FF6729AAFA4
schannel: unable to allocate memory, xrefs: 00007FF6729AB1EF
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF6729AB13A
schannel: unable to re-allocate memory, xrefs: 00007FF6729AAC12
schannel: next InitializeSecurityContext failed: %s, xrefs: 00007FF6729AAF8E, 00007FF6729AB1A2
SSL: public key does not match pinned public key!, xrefs: 00007FF6729AB0DC, 00007FF6729AB104
schannel: SNI or certificate check failed: %s, xrefs: 00007FF6729AAF5B
SSL: failed retrieving public key from server certificate, xrefs: 00007FF6729AB11A
schannel: failed to receive handshake, SSL/TLS connection failed, xrefs: 00007FF6729AAEF6

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: malloc$memcpy$CertCertificateContextFreefreememsetrealloc
String ID: SSL: failed retrieving public key from server certificate$SSL: public key does not match pinned public key!$schannel: Failed to read remote certificate context: %s$schannel: SNI or certificate check failed: %s$schannel: failed to receive handshake, SSL/TLS connection failed$schannel: failed to send next handshake data: sent %zd of %lu bytes$schannel: next InitializeSecurityContext failed: %s$schannel: unable to allocate memory$schannel: unable to re-allocate memory
API String ID: 860210379-3059304359
Opcode ID: 0aed80bd8a77ee6b09e008c9ebb4abda7328df7097bab9f1d16a3804739c3666
Instruction ID: 46970032d490d860d407e2a11b79a93f4dc6d739e45e2dbeae54a0cb449d7492
Opcode Fuzzy Hash: 0aed80bd8a77ee6b09e008c9ebb4abda7328df7097bab9f1d16a3804739c3666
Instruction Fuzzy Hash: 12128173A18B8186EB60CB2AD8543BE77B0FB84B98F580135CA5D87796DFB8D545CB00

Function 00007FF6729A9CA0 Relevance: 30.1, APIs: 4, Strings: 13, Instructions: 348
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF6729A9D71
GetProcAddress.KERNEL32 ref: 00007FF6729A9D81

Strings

schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc., xrefs: 00007FF6729A9D52
ntdll, xrefs: 00007FF6729A9D6A
Unrecognized parameter passed via CURLOPT_SSLVERSION, xrefs: 00007FF6729AA71F
schannel: SNI or certificate check failed: %s, xrefs: 00007FF6729AA95D
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF6729A9E12
http/1.1, xrefs: 00007FF6729AA797
schannel: ALPN, offering %s, xrefs: 00007FF6729AA7A5
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF6729AA763
schannel: unable to allocate memory, xrefs: 00007FF6729AA877
schannel: failed to send initial handshake data: sent %zd of %lu bytes, xrefs: 00007FF6729AAA19
schannel: initial InitializeSecurityContext failed: %s, xrefs: 00007FF6729AA93C, 00007FF6729AA983
http/1.1, xrefs: 00007FF6729AA783
wine_get_version, xrefs: 00007FF6729A9D7A

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Unrecognized parameter passed via CURLOPT_SSLVERSION$http/1.1$http/1.1$ntdll$schannel: ALPN, offering %s$schannel: SNI or certificate check failed: %s$schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc.$schannel: failed to send initial handshake data: sent %zd of %lu bytes$schannel: initial InitializeSecurityContext failed: %s$schannel: this version of Windows is too old to support certificate verification via CA bundle file.$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.$wine_get_version
API String ID: 1646373207-2477831187
Opcode ID: c73f3b5613b7dbecff2ba36672db2e215797824970f7e8fc44fc602f72984ec7
Instruction ID: 322225d7ec930bf32b700992c6376127f94bc30856ef316d8bc7cb7ee0911f09
Opcode Fuzzy Hash: c73f3b5613b7dbecff2ba36672db2e215797824970f7e8fc44fc602f72984ec7
Instruction Fuzzy Hash: B202BE33A28B818AEB508B26D9403EE37B4FB44798F584136DA5D87792DFBCE545CB40

Function 00007FF67298B2E0 Relevance: 28.7, APIs: 19, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298B312
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298B3AD
InitializeCriticalSectionEx.KERNEL32 ref: 00007FF67298B3C6

Part of subcall function 00007FF6729A4A90: socket.WS2_32 ref: 00007FF6729A4AD1

DeleteCriticalSection.KERNEL32 ref: 00007FF67298B400
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298B40A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298B414
closesocket.WS2_32 ref: 00007FF67298B432
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298B468
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67298B46E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67298B49D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298B4B7
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67298B4C0
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67298B4F5
EnterCriticalSection.KERNEL32 ref: 00007FF67298B516
LeaveCriticalSection.KERNEL32 ref: 00007FF67298B52A
CloseHandle.KERNEL32 ref: 00007FF67298B537
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298B562
closesocket.WS2_32 ref: 00007FF67298B57B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298B58F

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$CriticalSection$_errno_strdupclosesocket$CloseDeleteEnterHandleInitializeLeavecallocmallocsocket
String ID:
API String ID: 259767416-0
Opcode ID: 639c0ce8cfcaa784f68b0aeb4e2a44ab164eec32c4905c52a3981301a87acadf
Instruction ID: f7a55b9179805eee04b3c7ea7426d151525f4152a48bb4804e4c075eb3b4aa2c
Opcode Fuzzy Hash: 639c0ce8cfcaa784f68b0aeb4e2a44ab164eec32c4905c52a3981301a87acadf
Instruction Fuzzy Hash: 17812E23E25B8182E724DF22E4502697360FB99B58F095235DB9E827A2DFB8E4D4C700

Function 00007FF672992950 Relevance: 28.6, APIs: 6, Strings: 10, Instructions: 557COMMON

Download Yara Rule

Strings

No connections available., xrefs: 00007FF6729930F1
anonymous, xrefs: 00007FF672992B08
NTLM-proxy picked AND auth done set, clear picked!, xrefs: 00007FF6729931D0
host, xrefs: 00007FF672993020
No connections available in cache, xrefs: 00007FF67299334B
No more connections allowed to host %s: %zu, xrefs: 00007FF6729930E2
NTLM picked AND auth done set, clear picked!, xrefs: 00007FF6729931A2
ftp@example.com, xrefs: 00007FF672992B0F
Re-using existing connection! (#%ld) with %s %s, xrefs: 00007FF672993033
proxy, xrefs: 00007FF672993012

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID:
String ID: NTLM picked AND auth done set, clear picked!$NTLM-proxy picked AND auth done set, clear picked!$No connections available in cache$No connections available.$No more connections allowed to host %s: %zu$Re-using existing connection! (#%ld) with %s %s$anonymous$ftp@example.com$host$proxy
API String ID: 0-760484938
Opcode ID: 9493bcac43b726915b619078e729d4aa179a65afe48960cca5701b600efb16ef
Instruction ID: 50f16f234a13f7544bf3f5563f19eff094242a12856a77c54fdc4fd402c69d47
Opcode Fuzzy Hash: 9493bcac43b726915b619078e729d4aa179a65afe48960cca5701b600efb16ef
Instruction Fuzzy Hash: 6742A523A19BC25AEB598F2695403F96390FB85B98F0C0135DE9D87796DF78E470CB10

Function 00007FF6729918E0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672981B91,?,?,?,?,00007FF6729735C1), ref: 00007FF6729918F8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672991941

Strings

<, xrefs: 00007FF672991A57
<, xrefs: 00007FF672991B88
`, xrefs: 00007FF672991BDA
<, xrefs: 00007FF672991B7E
v, xrefs: 00007FF672991BEF

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: callocfree
String ID: <$<$<$`$v
API String ID: 306872129-2056843887
Opcode ID: d5865803d173832087f16c44c88db72d39735fe1916e991f553bb21f94318156
Instruction ID: 668b9cf7cd935aa416f4176dd078b8d81ed814a384d9e06f4b429faef816f40f
Opcode Fuzzy Hash: d5865803d173832087f16c44c88db72d39735fe1916e991f553bb21f94318156
Instruction Fuzzy Hash: D9911A33918BC1C6E3008F25D4043E837A4FB99B5CF1C5239DE995A796DFBA9195CB20

Function 00007FF672997330 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 161
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getpeername.WS2_32 ref: 00007FF67299739C
WSAGetLastError.WS2_32 ref: 00007FF6729973A6

Part of subcall function 00007FF672982530: GetLastError.KERNEL32 ref: 00007FF672982552
Part of subcall function 00007FF672982530: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67298255A

getsockname.WS2_32 ref: 00007FF672997426
WSAGetLastError.WS2_32 ref: 00007FF672997430

Strings

ssrem inet_ntop() failed with errno %d: %s, xrefs: 00007FF6729974B6
ssloc inet_ntop() failed with errno %d: %s, xrefs: 00007FF67299754C
getpeername() failed with errno %d: %s, xrefs: 00007FF6729973C6
getsockname() failed with errno %d: %s, xrefs: 00007FF672997450

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: ErrorLast$_errnogetpeernamegetsockname
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 2911674258-670633250
Opcode ID: 51f96e58cadd65381bcb06b8f99b80a698e5425f8219381625492b60fe4c4e3f
Instruction ID: 60eec6659a911706927979797a0cab1c4a6c3276bc76818884f4bbaf44726315
Opcode Fuzzy Hash: 51f96e58cadd65381bcb06b8f99b80a698e5425f8219381625492b60fe4c4e3f
Instruction Fuzzy Hash: 0E91A167A28BC586D710CF26D4502E933A0FB89B8CF485235DE8C87656EF79E195CB10

Function 00007FF6729A8700 Relevance: 19.6, APIs: 13, Instructions: 128
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32 ref: 00007FF6729A8722
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF67298B225), ref: 00007FF6729A878E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF67298B225), ref: 00007FF6729A87C8
memcpy.VCRUNTIME140(?,?,?,00007FF67298B225), ref: 00007FF6729A87E1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF67298B225), ref: 00007FF6729A87EF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF67298B225), ref: 00007FF6729A882A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF67298B225), ref: 00007FF6729A8833
freeaddrinfo.WS2_32(?,?,?,00007FF67298B225), ref: 00007FF6729A8861
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF67298B225), ref: 00007FF6729A8875
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF67298B225), ref: 00007FF6729A887F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF67298B225), ref: 00007FF6729A888C
WSASetLastError.WS2_32(?,?,?,00007FF67298B225), ref: 00007FF6729A88AD

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$malloc$ErrorLast_strdupfreeaddrinfogetaddrinfomemcpy
String ID:
API String ID: 2364279375-0
Opcode ID: 42d7141a613dc9572e64f13324ecbd4a7e0aee728688f79990fc275f81ffd6e6
Instruction ID: e798e8a15a6cc815fa386d23e82fd78bd2278ab41997957bd46564716f482b0b
Opcode Fuzzy Hash: 42d7141a613dc9572e64f13324ecbd4a7e0aee728688f79990fc275f81ffd6e6
Instruction Fuzzy Hash: 51511A37E29B4286EB699F56A540139B7B0FB44B98F084535CE9E93751DFBCE444CB00

Function 00007FF6729A6010 Relevance: 16.7, APIs: 11, Instructions: 241
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32 ref: 00007FF6729A606D
Sleep.KERNEL32 ref: 00007FF6729A607E
WSASetLastError.WS2_32 ref: 00007FF6729A61E8
Sleep.KERNEL32 ref: 00007FF6729A61F9
__WSAFDIsSet.WS2_32 ref: 00007FF6729A62AC
__WSAFDIsSet.WS2_32 ref: 00007FF6729A62C3
__WSAFDIsSet.WS2_32 ref: 00007FF6729A62DE
__WSAFDIsSet.WS2_32 ref: 00007FF6729A62F2
__WSAFDIsSet.WS2_32 ref: 00007FF6729A630D
__WSAFDIsSet.WS2_32 ref: 00007FF6729A6321

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 7c5aa9f4e4614d3925a22558fcb9daf37743cbcc01d227aca2766e4b0f08baea
Instruction ID: 91eb6013e2ae1bf217d56e1235c1ba531672d21bf4250324588ffbfbef0eb959
Opcode Fuzzy Hash: 7c5aa9f4e4614d3925a22558fcb9daf37743cbcc01d227aca2766e4b0f08baea
Instruction Fuzzy Hash: A591DA23F2C78286EF694E2698442B976A1FB4479CF58413CDD19C6BC6DEBDD941CA00

Function 00007FF672994F20 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672994F6F

Strings

Couldn't resolve host '%s', xrefs: 00007FF6729950A1
Unix socket path too long: '%s', xrefs: 00007FF672994FC6
Couldn't resolve proxy '%s', xrefs: 00007FF67299514C

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: calloc
String ID: Couldn't resolve host '%s'$Couldn't resolve proxy '%s'$Unix socket path too long: '%s'
API String ID: 2635317215-3812100122
Opcode ID: fd19d17db812f4bf012133141792e6f66e6bcf495c643ccd7d642772eb752ad4
Instruction ID: f4e45059b853a3a551437bbb91d57332da208c9f180af2cb63f33678fc4d2484
Opcode Fuzzy Hash: fd19d17db812f4bf012133141792e6f66e6bcf495c643ccd7d642772eb752ad4
Instruction Fuzzy Hash: 6151C823A1C7829BF6298B26945037A6794FBC47A8F180035DB8D837A6DF7DE5618F10

Function 00007FF672972870 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 121processCOMMON

Download Yara Rule

APIs

system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729728D7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672972947
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729729A7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729729F7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672972A47
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672972AB8

Strings

h%49, xrefs: 00007FF672972A8E
.8, xrefs: 00007FF672972A95

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: system
String ID: .8$h%49
API String ID: 3377271179-4206735779
Opcode ID: ecd13e68c054c8f3db57a01fade3224a6bf2861f800a39c9e4475a5decc833c4
Instruction ID: b2b85e72b3f93c0bf31dcdaccd7d03ed8fd6be1618575367e1057131ae98e5c4
Opcode Fuzzy Hash: ecd13e68c054c8f3db57a01fade3224a6bf2861f800a39c9e4475a5decc833c4
Instruction Fuzzy Hash: 26615E23E287D689F301CBB9E8061BC7770FB9974CF585268CEC965A1AEFA81108C754

Function 00007FF67298B1D0 Relevance: 12.1, APIs: 8, Instructions: 67networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6729A8700: getaddrinfo.WS2_32 ref: 00007FF6729A8722
Part of subcall function 00007FF6729A8700: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF67298B225), ref: 00007FF6729A878E
Part of subcall function 00007FF6729A8700: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF67298B225), ref: 00007FF6729A87C8
Part of subcall function 00007FF6729A8700: memcpy.VCRUNTIME140(?,?,?,00007FF67298B225), ref: 00007FF6729A87E1
Part of subcall function 00007FF6729A8700: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF67298B225), ref: 00007FF6729A87EF
Part of subcall function 00007FF6729A8700: freeaddrinfo.WS2_32(?,?,?,00007FF67298B225), ref: 00007FF6729A8861
Part of subcall function 00007FF6729A8700: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF67298B225), ref: 00007FF6729A8875
Part of subcall function 00007FF6729A8700: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF67298B225), ref: 00007FF6729A887F
Part of subcall function 00007FF6729A8700: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF67298B225), ref: 00007FF6729A888C

WSAGetLastError.WS2_32 ref: 00007FF67298B22B
WSAGetLastError.WS2_32 ref: 00007FF67298B235
EnterCriticalSection.KERNEL32 ref: 00007FF67298B250
LeaveCriticalSection.KERNEL32 ref: 00007FF67298B25F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298B270
send.WS2_32 ref: 00007FF67298B293
WSAGetLastError.WS2_32 ref: 00007FF67298B29D
LeaveCriticalSection.KERNEL32 ref: 00007FF67298B2B0

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$CriticalErrorLastSection$Leavemalloc$Enter_strdupfreeaddrinfogetaddrinfomemcpysend
String ID:
API String ID: 506363382-0
Opcode ID: 5a0b2f67d15b088cb6858a7459148a06bd34dc47417179f7c744050e65e63934
Instruction ID: 76f2dcaffc58cb49a2add826ffbf64781cb7d46d1f648b570e47da9d8f1b4cfa
Opcode Fuzzy Hash: 5a0b2f67d15b088cb6858a7459148a06bd34dc47417179f7c744050e65e63934
Instruction Fuzzy Hash: D0315E33A28642C6EB508F66E45026973A0FB84B9CF1C1231DA0EC36A6DFBCD845CB41

Function 00007FF6729A5C70 Relevance: 10.7, APIs: 7, Instructions: 242sleepnetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32 ref: 00007FF6729A5CD6
WSASetLastError.WS2_32 ref: 00007FF6729A5E96
Sleep.KERNEL32 ref: 00007FF6729A5EA6
__WSAFDIsSet.WS2_32 ref: 00007FF6729A5FBA
__WSAFDIsSet.WS2_32 ref: 00007FF6729A5FD2
Sleep.KERNEL32 ref: 00007FF6729A5FFD

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 4116f599514ff819491a0c6321ec9d98ae0476f0d776607fa3851598fe814462
Instruction ID: 80a46255b589e486545521937bae2c3c8f009841ac928f33a7d6b357224bdc1f
Opcode Fuzzy Hash: 4116f599514ff819491a0c6321ec9d98ae0476f0d776607fa3851598fe814462
Instruction Fuzzy Hash: 47A1F733F3979296EB694A26940437972B5FF44B98F184234EA5EC6BC5DEBDD900CB00

Function 00007FF6729A8EE0 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A910A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A914F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A9177
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A91B9

Strings

schannel: failed to send close msg: %s (bytes written: %zd), xrefs: 00007FF6729A90D3
schannel: ApplyControlToken failure: %s, xrefs: 00007FF6729A8FE8
schannel: shutting down SSL/TLS connection with %s port %hu, xrefs: 00007FF6729A8F5E

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: schannel: ApplyControlToken failure: %s$schannel: failed to send close msg: %s (bytes written: %zd)$schannel: shutting down SSL/TLS connection with %s port %hu
API String ID: 1294909896-116363806
Opcode ID: 77e25993ce042bc8ed5b665b6c34436106678af3c644aa00da7646edca485891
Instruction ID: 225fd5d54ec875fbbffac3447bf9c1a80caac0524597bf542c14caf71deaf784
Opcode Fuzzy Hash: 77e25993ce042bc8ed5b665b6c34436106678af3c644aa00da7646edca485891
Instruction Fuzzy Hash: 3D915637A18B8186EB108F26E8506AE77B4FB84B99F080535CE8D877A5DF78D555CB00

Function 00007FF6729ABCC0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729ABD5E
memcpy.VCRUNTIME140 ref: 00007FF6729ABDF6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729ABF2C

Strings

select/poll on SSL socket, errno: %d, xrefs: 00007FF6729ABED4
schannel: timed out sending data (bytes sent: %zd), xrefs: 00007FF6729ABEF4

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: freemallocmemcpy
String ID: schannel: timed out sending data (bytes sent: %zd)$select/poll on SSL socket, errno: %d
API String ID: 3056473165-3891197721
Opcode ID: 65a4543bdd2e8b0614cca18b8733319a292161540132c9e3e18012d245d8b3ca
Instruction ID: 9ba61014dd08248bff75463279ab8acb11f5d5a256cf9f9678a85ebaefe604ef
Opcode Fuzzy Hash: 65a4543bdd2e8b0614cca18b8733319a292161540132c9e3e18012d245d8b3ca
Instruction Fuzzy Hash: 01718A73B18B418AEB10CB66D4506AD33B1BB48BACF584235DE2D877D5EE78D406CB40

Function 00007FF6729CF88C Relevance: 10.6, APIs: 7, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_release_startup_lock.LIBCMT ref: 00007FF6729CF923
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729CF971
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729CF976
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729CF97E
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729CF986
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729CF9A8
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729CFA02

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1328870896-0
Opcode ID: 8681d64b6f63a8cf741ba538a4bfbd02181691d6bd283dc0c8483ad5752d088a
Instruction ID: 40d25c9b4090bf8c0016d48aaf962f9e4a4daa66afd2f8b1ac74119086f7fce4
Opcode Fuzzy Hash: 8681d64b6f63a8cf741ba538a4bfbd02181691d6bd283dc0c8483ad5752d088a
Instruction Fuzzy Hash: 46316123A2D24382FE44AB77D0213B92390EF45B8CF6C5136D64DC72D7EEACA4849A00

Function 00007FF672986D30 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672986D7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672986D95
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672986EC2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672986EEE

Strings

Connection #%ld to host %s left intact, xrefs: 00007FF672986FAB
%s, xrefs: 00007FF672986FF7

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: %s$Connection #%ld to host %s left intact
API String ID: 1294909896-118628944
Opcode ID: 7e9b18b4bcb142742850a51466c7a4cb3d02a2423a92d4c9a77e0d831a897216
Instruction ID: 892604d4e707c8c8e20e0aa788cb7a674547279d303347ca44a2318c4ba81925
Opcode Fuzzy Hash: 7e9b18b4bcb142742850a51466c7a4cb3d02a2423a92d4c9a77e0d831a897216
Instruction Fuzzy Hash: CC916233A2968196EB589F2695503F96391FF85B88F0C4435DE4E8B257DFB8E4608B40

Function 00007FF6729911C0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729911EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672991201

Part of subcall function 00007FF672990FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672991625), ref: 00007FF67299101D
Part of subcall function 00007FF672990FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672991625), ref: 00007FF67299103A
Part of subcall function 00007FF672990FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672991625), ref: 00007FF67299104E
Part of subcall function 00007FF672990FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672991625), ref: 00007FF67299106A
Part of subcall function 00007FF672990FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672991625), ref: 00007FF672991087
Part of subcall function 00007FF672990FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672991625), ref: 00007FF6729910AA
Part of subcall function 00007FF672990FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672991625), ref: 00007FF6729910BE
Part of subcall function 00007FF672990FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672991625), ref: 00007FF6729910D2
Part of subcall function 00007FF672990FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672991625), ref: 00007FF6729910F8
Part of subcall function 00007FF672990FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672991625), ref: 00007FF67299110C
Part of subcall function 00007FF672990FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672991625), ref: 00007FF672991120
Part of subcall function 00007FF672990FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672991625), ref: 00007FF67299116F
Part of subcall function 00007FF672990FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672991625), ref: 00007FF67299117C

Part of subcall function 00007FF672990FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672991625), ref: 00007FF6729911A5

memset.VCRUNTIME140 ref: 00007FF672991235

Strings

User-Agent: %s, xrefs: 00007FF6729912CF
Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF672991411

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$memset
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 2717317152-3248832348
Opcode ID: 627d9fe0f4e3587de03cfdd36717ee8bf0a900e1616e35e97a8a1d97e885c7a3
Instruction ID: daf805cda24a300a7653b90df5e8a2dc72d94331a27d19496fd840a0f5ba741d
Opcode Fuzzy Hash: 627d9fe0f4e3587de03cfdd36717ee8bf0a900e1616e35e97a8a1d97e885c7a3
Instruction Fuzzy Hash: 2971906391CBC2C9EB51DF2694103BD2760FB85BA8F4C0131DB9D8B696DFB8E5618B10

Function 00007FF6729A1740 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A17D8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A17E1
memcpy.VCRUNTIME140 ref: 00007FF6729A17FC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A195C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A1965

Strings

1.1, xrefs: 00007FF6729A174F

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$memcpy
String ID: 1.1
API String ID: 4107583993-2150719395
Opcode ID: bb9a4a286311b79879c11090a50217305a453a35136b00152bbd92c0348052f2
Instruction ID: 8e80dfa3a2ff51bdbffeeb4359b2d22e8a4c354597512ff69ecb3fb7d9acfb61
Opcode Fuzzy Hash: bb9a4a286311b79879c11090a50217305a453a35136b00152bbd92c0348052f2
Instruction Fuzzy Hash: DD513C73A19B85C6D7658B26E9403AA73A0FB85B88F084035DF9E97756DF7CE064CB00

Function 00007FF672995F00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672995FC6
recv.WS2_32 ref: 00007FF672995FF0
send.WS2_32 ref: 00007FF672996013
WSAGetLastError.WS2_32 ref: 00007FF672996025

Strings

Send failure: %s, xrefs: 00007FF672996055

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: ErrorLastmallocrecvsend
String ID: Send failure: %s
API String ID: 25851408-857917747
Opcode ID: 4fbd2f417569e3cf4f9c8d09d144bdb8d1a47429c19bc156cf15c4e59b328f8b
Instruction ID: e8aa5219113417fc3ebc9961a805f116882d08f0ab05f53515e6f81837808ae7
Opcode Fuzzy Hash: 4fbd2f417569e3cf4f9c8d09d144bdb8d1a47429c19bc156cf15c4e59b328f8b
Instruction Fuzzy Hash: 6F418273B1578189EB648F27E8507796690BB48BECF584239CE9D87395DE7CD450CB00

Function 00007FF672987E28 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 297COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672987F78
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672987FBF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672987FEA

Part of subcall function 00007FF672986D30: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672986D7E
Part of subcall function 00007FF672986D30: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672986D95

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298801F

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF672987366

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: Resolving timed out after %I64d milliseconds
API String ID: 1294909896-3343404259
Opcode ID: 48f23a2fb74b2e2576a5473d0aed7042234bb651df30e3f13d841b32dd00d5a5
Instruction ID: 86cfe723ae679239ebc9d3106803c132eaf2376b5dd08a50b12128ddd962d4b4
Opcode Fuzzy Hash: 48f23a2fb74b2e2576a5473d0aed7042234bb651df30e3f13d841b32dd00d5a5
Instruction Fuzzy Hash: 16D1A123A2864685FB249F6794403F963A1FF44B8CF0C4531CE4D9769BDFB8E8858B50

Function 00007FF672973580 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 157windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF672972870: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729728D7
Part of subcall function 00007FF672972870: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672972947
Part of subcall function 00007FF672972870: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729729A7
Part of subcall function 00007FF672972870: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729729F7
Part of subcall function 00007FF672972870: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672972A47

MessageBoxA.USER32 ref: 00007FF672973757

Part of subcall function 00007FF672974340: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF672971B79), ref: 00007FF672974371

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729737BA

Strings

keyauth.win, xrefs: 00007FF6729736E3
null, xrefs: 00007FF6729735E2

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: system$Message_invalid_parameter_noinfo_noreturnmemcpy
String ID: keyauth.win$null
API String ID: 3545939226-2841560827
Opcode ID: 80291fb979cfb34a0b66c9f53889f1ce0ee783c3901616f3409542e9c9a8363f
Instruction ID: 2734237ad3e6c9076b6fce5215c74ed19000efdca392f20a4634e35cdbbb6895
Opcode Fuzzy Hash: 80291fb979cfb34a0b66c9f53889f1ce0ee783c3901616f3409542e9c9a8363f
Instruction Fuzzy Hash: 2151FC23B2879186FB04DF76D4053AC2361AB44B88F584135CE4C97B8BDFBCA082CB84

Function 00007FF6729C24B0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF672998690: GetModuleHandleA.KERNEL32(?,?,?,00007FF6729C24EA,?,?,?,?,00007FF672998A1B), ref: 00007FF6729986A4

GetProcAddressForCaller.KERNELBASE(?,?,?,?,00007FF672998A1B), ref: 00007FF6729C2500

Strings

secur32.dll, xrefs: 00007FF6729C24D3
InitSecurityInterfaceA, xrefs: 00007FF6729C24F6
security.dll, xrefs: 00007FF6729C24DA

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: AddressCallerHandleModuleProc
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 2084706301-3788156360
Opcode ID: 3bf31c805acc559dc49ac7b5e87483edb1d19d70d23192d047d6c0271842c165
Instruction ID: 1045db2183864a879c33caa5a1a7e980fd2a1941496ea3d8498722eaeb5be66a
Opcode Fuzzy Hash: 3bf31c805acc559dc49ac7b5e87483edb1d19d70d23192d047d6c0271842c165
Instruction Fuzzy Hash: E8F019A3E29A4281FF19D723A8A27756390BF5474CF8C5538C40CC66A3EEBCA1958B00

Function 00007FF67298795B Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF672987366

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID:
String ID: Resolving timed out after %I64d milliseconds
API String ID: 0-3343404259
Opcode ID: 24514709cd755a32c0a91f06036f8caa12c4e1402cea8f2f008788363a7546c4
Instruction ID: b88f9c4595e7586d351ccf3e7db78463361eef4a8aa9936d50008b72498dfd23
Opcode Fuzzy Hash: 24514709cd755a32c0a91f06036f8caa12c4e1402cea8f2f008788363a7546c4
Instruction Fuzzy Hash: 90B19327A2864285FB249B27D4547B963A1FF81B8CF1C0535CA1EC7287DFB9E880CB51

Function 00007FF6729A1300 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A1400

Part of subcall function 00007FF6729A1990: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A19EA

Part of subcall function 00007FF6729A1740: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A17D8
Part of subcall function 00007FF6729A1740: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A17E1

Strings

PROXY %s %s %s %li %li, xrefs: 00007FF6729A13D4
TCP6, xrefs: 00007FF6729A1387
TCP4, xrefs: 00007FF6729A139A

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$calloc
String ID: PROXY %s %s %s %li %li$TCP4$TCP6
API String ID: 3095843317-1242256665
Opcode ID: 8bb7d415bfb4b4196f6fe204410591ad758c938ac9939ad60ce325467482847b
Instruction ID: 9bcf6e8a3598aec726ff99f86adbe3a6ca32a7ce4abe40d1e68df6e24c9b903f
Opcode Fuzzy Hash: 8bb7d415bfb4b4196f6fe204410591ad758c938ac9939ad60ce325467482847b
Instruction Fuzzy Hash: A8417533E2C78286EB50DB66A4013B977A1AB8578CF1C5036DA8CC7697DEADE544CF00

Function 00007FF672985BF0 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000,00007FF672981C26,?,?,?,?,00000000,?,00007FF67297373E), ref: 00007FF672985C0D
closesocket.WS2_32 ref: 00007FF672985D19
closesocket.WS2_32 ref: 00007FF672985D26

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: closesocket$calloc
String ID:
API String ID: 2958813939-0
Opcode ID: 1fd1cc2b84455d45fc16b971b2d39453aadee48b806abdc44c5da520827323a4
Instruction ID: 5c1b815417f7f496520da6c366123482a17a908fcf150c034d930d45b77dd177
Opcode Fuzzy Hash: 1fd1cc2b84455d45fc16b971b2d39453aadee48b806abdc44c5da520827323a4
Instruction Fuzzy Hash: 01413E33A2868295E740AF32D4542E92361EF8872CF4C4235DE5DCA2D7EFBCD5458B60

Function 00007FF6729A9AB0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

SSL/TLS connection timeout, xrefs: 00007FF6729A9C0C
select/poll on SSL/TLS socket, errno: %d, xrefs: 00007FF6729A9BF3

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID:
String ID: SSL/TLS connection timeout$select/poll on SSL/TLS socket, errno: %d
API String ID: 0-3791222319
Opcode ID: 339ea6f411791d35c97dde0a0660a273b5148f7f330456d77f52104acfb532bc
Instruction ID: 2a9074c4f9cc3bffd037782cd38ec53f48c5e84e2446cc9273f6ea01d9a51506
Opcode Fuzzy Hash: 339ea6f411791d35c97dde0a0660a273b5148f7f330456d77f52104acfb532bc
Instruction Fuzzy Hash: BF519223E29B4695FB549F23994027963B1FB847ACF5C4235DA5E872E2DEBCE141CB00

Function 00007FF672985DF0 Relevance: 4.8, APIs: 3, Instructions: 309networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF6729861E6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672986207

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: freerecv
String ID:
API String ID: 2032557106-0
Opcode ID: 81f4947644d7e6db7ba1a0ba613955ad08392ab83e8f1e0e04aa399c574340be
Instruction ID: 438e1315008c362cbecbb838553e1b6df2ca97b3335c707ed6ea0d905fe5318b
Opcode Fuzzy Hash: 81f4947644d7e6db7ba1a0ba613955ad08392ab83e8f1e0e04aa399c574340be
Instruction Fuzzy Hash: E0C1E933A2968245EB658B27D4503B963A0FB447ACF5C4239DE6E877C6DF7CE4458B00

Function 00007FF672991EC0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672991F25

Strings

User-Agent: %s, xrefs: 00007FF672991F36
Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF672992064

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 1294909896-3248832348
Opcode ID: 903e5b50dd60052362953ccc950071ac10165d33b59422dd094f9f716ccbc097
Instruction ID: 1ba9e7d07a5c0be50ae5ba364f38cc98b9688cf3fd29e436d586dc584944f095
Opcode Fuzzy Hash: 903e5b50dd60052362953ccc950071ac10165d33b59422dd094f9f716ccbc097
Instruction Fuzzy Hash: 50517D63A18AC185E7518F26D4403ED6760FB85BACF0C4135DE8C8B79ADFB9D4A1CB10

Function 00007FF672995D20 Relevance: 3.0, APIs: 2, Instructions: 23networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF672995D2C
WSAGetLastError.WS2_32 ref: 00007FF672995D3B

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: 6d4567ff3aa502f88ada590c756d0eb288cb95ffc4202f14a5fdaaef775206c0
Instruction ID: 0cdd11b93e6c0c7442392c9371257bdb230bde0f52e77da159173dbb1104fa3b
Opcode Fuzzy Hash: 6d4567ff3aa502f88ada590c756d0eb288cb95ffc4202f14a5fdaaef775206c0
Instruction Fuzzy Hash: 98E0DF22F1450582FF2947B2A85433921909B84776F585734CA3BC63C0DEAC44D24B00

Function 00007FF672996600 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FF672996643

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 2b5c975b708db0323598e77894310fd802802d33fc7982a2593b17f64747decf
Instruction ID: 837d081e818a3ca84ed6eb9058e6582e0fb300866645106d7f00e75f579def2f
Opcode Fuzzy Hash: 2b5c975b708db0323598e77894310fd802802d33fc7982a2593b17f64747decf
Instruction Fuzzy Hash: 51019223B2554181EB54DB6BE1983BD23A0EF88B98F0C4039DB4DCB293CE69D4A58B00

Function 00007FF67299E120 Relevance: 1.5, APIs: 1, Instructions: 23networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF67299E149

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: aaec3a60d29b4767767ff1b14d2229d1bb68c28951c72620487210b9425309de
Instruction ID: 0b86023ffccac800e7d84cfc0bc9f384a9efafb194470f174bbd16b753f0b384
Opcode Fuzzy Hash: aaec3a60d29b4767767ff1b14d2229d1bb68c28951c72620487210b9425309de
Instruction Fuzzy Hash: 6FE09B37F1654185DE5C5B3784512B523506B85778FD84375C57D433D1CD6CA1669F00

Function 00007FF6729A8D80 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729A8D9B

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: 80df5e46377be0dfdc9ade07f9fde7078ec2923909fe9ee7aacebf4f60ad1458
Instruction ID: 823d43181d3d2a361d2c1a41dddfa291dabb4e95ab0e4c5a59a11714a0efd2c9
Opcode Fuzzy Hash: 80df5e46377be0dfdc9ade07f9fde7078ec2923909fe9ee7aacebf4f60ad1458
Instruction Fuzzy Hash: D1D0C263B18A00829B10CF72A840029E251A788774B884338AE7D827E4DF38D1454A00

Function 00007FF6729A4CC0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF6729A4CD9

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: d496c00e39af1d0d70f2dffec5ba97bf9070f7f7a4cf54263a3064c61f677488
Instruction ID: e7e456c3b92eddd06b7b29e5ad6a192937f767a445ec9a3d5c2e809e43956d27
Opcode Fuzzy Hash: d496c00e39af1d0d70f2dffec5ba97bf9070f7f7a4cf54263a3064c61f677488
Instruction Fuzzy Hash: 37C08027F24581C3D3445F7254851877772ABC4209FA56435D24B82124DD3CD2E5DF40

Non-executed Functions

Function 00007FF6729A28C0 Relevance: 127.2, APIs: 25, Strings: 47, Instructions: 1229stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729A3A83

Part of subcall function 00007FF672995B20: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF672995C45
Part of subcall function 00007FF672995B20: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF672995C60

memchr.VCRUNTIME140 ref: 00007FF6729A3B76
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729A3C8E
strchr.VCRUNTIME140 ref: 00007FF6729A3CA2
strchr.VCRUNTIME140 ref: 00007FF6729A3CCA
strchr.VCRUNTIME140 ref: 00007FF6729A3CE0

Strings

Negotiate: noauthpersist -> %d, header part: %s, xrefs: 00007FF6729A364C
Got 417 while waiting for a 100, xrefs: 00007FF6729A3A63
HTTP/%1d.%1d%c%3d, xrefs: 00007FF6729A2A59
Connection:, xrefs: 00007FF6729A308B, 00007FF6729A3140
Content-Range:, xrefs: 00007FF6729A338E
HTTP error before end of send, stop sending, xrefs: 00007FF6729A3ACD
RTSP/, xrefs: 00007FF6729A29B4
Content-Length:, xrefs: 00007FF6729A2DCF
Received 101, xrefs: 00007FF6729A3D5B
HTTP/1.1 proxy connection set close!, xrefs: 00007FF6729A326D
HTTP, xrefs: 00007FF6729A3C7E
, xrefs: 00007FF6729A2C62
Received HTTP/0.9 when not allowed, xrefs: 00007FF6729A3BEB
Content-Type:, xrefs: 00007FF6729A2E76
Proxy-authenticate:, xrefs: 00007FF6729A3581
HTTP %3d, xrefs: 00007FF6729A2B28
HTTP error before end of send, keep sending, xrefs: 00007FF6729A3AA9
close, xrefs: 00007FF6729A3053, 00007FF6729A31D3
Content-Encoding:, xrefs: 00007FF6729A32C1
HTTP/1.0 proxy connection set to keep alive!, xrefs: 00007FF6729A324C
HTTP/%1[23] %d, xrefs: 00007FF6729A2A84
Proxy-Connection:, xrefs: 00007FF6729A2EF3, 00007FF6729A2FCC
false, xrefs: 00007FF6729A3630
HTTP/1.0 connection set to keep alive!, xrefs: 00007FF6729A328B
Overflow Content-Length: value!, xrefs: 00007FF6729A2E5B
Last-Modified:, xrefs: 00007FF6729A34F7
HTTP 1.0, assume close after body, xrefs: 00007FF6729A2D27
Mark bundle as not supporting multiuse, xrefs: 00007FF6729A2AFF
RTSP/%1d.%1d%c%3d, xrefs: 00007FF6729A2C4D
Lying server, not serving HTTP/2, xrefs: 00007FF6729A2ADC
Unsupported HTTP version in response, xrefs: 00007FF6729A3C61
Keep sending data to get tossed away!, xrefs: 00007FF6729A3B1C
The requested URL returned error: %s, xrefs: 00007FF6729A3CF7
keep-alive, xrefs: 00007FF6729A2F86, 00007FF6729A3116
WWW-Authenticate:, xrefs: 00007FF6729A3556
The requested URL returned error: %d, xrefs: 00007FF6729A3E53
Location:, xrefs: 00007FF6729A368E
Retry-After:, xrefs: 00007FF6729A3303
Invalid Content-Length: value, xrefs: 00007FF6729A3D38
Connection closure while negotiating auth (HTTP 1.0?), xrefs: 00007FF6729A38CC, 00007FF6729A3918
Transfer-Encoding:, xrefs: 00007FF6729A320A
, xrefs: 00007FF6729A2AAC
HTTP/, xrefs: 00007FF6729A2BC9
Persistent-Auth, xrefs: 00007FF6729A35F2
no chunk, no close, no size. Assume close to signal end, xrefs: 00007FF6729A3876
Set-Cookie:, xrefs: 00007FF6729A3453
Maximum file size exceeded, xrefs: 00007FF6729A3D1F

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: strchr$fwrite$_strdupmemchrstrncmp
String ID: $ $ HTTP %3d$ HTTP/%1[23] %d$ HTTP/%1d.%1d%c%3d$ RTSP/%1d.%1d%c%3d$Connection closure while negotiating auth (HTTP 1.0?)$Connection:$Content-Encoding:$Content-Length:$Content-Range:$Content-Type:$Got 417 while waiting for a 100$HTTP$HTTP 1.0, assume close after body$HTTP error before end of send, keep sending$HTTP error before end of send, stop sending$HTTP/$HTTP/1.0 connection set to keep alive!$HTTP/1.0 proxy connection set to keep alive!$HTTP/1.1 proxy connection set close!$Invalid Content-Length: value$Keep sending data to get tossed away!$Last-Modified:$Location:$Lying server, not serving HTTP/2$Mark bundle as not supporting multiuse$Maximum file size exceeded$Negotiate: noauthpersist -> %d, header part: %s$Overflow Content-Length: value!$Persistent-Auth$Proxy-Connection:$Proxy-authenticate:$RTSP/$Received 101$Received HTTP/0.9 when not allowed$Retry-After:$Set-Cookie:$The requested URL returned error: %d$The requested URL returned error: %s$Transfer-Encoding:$Unsupported HTTP version in response$WWW-Authenticate:$close$false$keep-alive$no chunk, no close, no size. Assume close to signal end
API String ID: 3939785054-690044944
Opcode ID: 021c0f00433960713f3211fcc78b43ceb2da0d4dbe34107fa80a45c66839aa04
Instruction ID: 06344d65ab80798dc5b3f2cd0bf678ed7c493ac8fa977ae45d2dfb82fbeee7d1
Opcode Fuzzy Hash: 021c0f00433960713f3211fcc78b43ceb2da0d4dbe34107fa80a45c66839aa04
Instruction Fuzzy Hash: C9C28A73E2878285EB609B2794443F927A1EB81B9CF5C4135CE4D8B697DEBCE480CB14

Function 00007FF6729889C0 Relevance: 105.7, APIs: 41, Strings: 19, Instructions: 745stringCOMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,?,00000000,?,00000000,?,?,00007FF67298A217), ref: 00007FF672988A30
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672988A4B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672988A84
strchr.VCRUNTIME140 ref: 00007FF672988A97
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF672988C17
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF672988C38
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF672988C5B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF672988C68
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672988D01
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF672988D0A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672988D22
strchr.VCRUNTIME140 ref: 00007FF672988F0F
strchr.VCRUNTIME140 ref: 00007FF672988F29
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67298901C
strchr.VCRUNTIME140 ref: 00007FF672989048
strrchr.VCRUNTIME140 ref: 00007FF67298905A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298907B
memcpy.VCRUNTIME140 ref: 00007FF672989094
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF672989108
strchr.VCRUNTIME140 ref: 00007FF67298912B
strchr.VCRUNTIME140 ref: 00007FF672989140

Strings

skipped cookie with bad tailmatch domain: %s, xrefs: 00007FF672988E2E
domain, xrefs: 00007FF672988D41
httponly, xrefs: 00007FF672988CC6
Replaced, xrefs: 00007FF672989631
max-age, xrefs: 00007FF672988E78
oversized cookie dropped, name/val %zu + %zu bytes, xrefs: 00007FF672988F9F
secure, xrefs: 00007FF672988C8E
expires, xrefs: 00007FF672988EA5
TRUE, xrefs: 00007FF672989177
FALSE, xrefs: 00007FF67298917E, 00007FF67298937B
%4095[^;=] =%4095[^;], xrefs: 00007FF672988AD6
path, xrefs: 00007FF672988CED
__Host-, xrefs: 00007FF672988C31
Added, xrefs: 00007FF67298963D
#HttpOnly_, xrefs: 00007FF6729890FE
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF672989647
__Secure-, xrefs: 00007FF672988C10
localhost, xrefs: 00007FF672988D6F
version, xrefs: 00007FF672988E4B

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: strchr$_strdup$freestrncmp$_time64callocmallocmemcpystrrchr
String ID: #HttpOnly_$%4095[^;=] =%4095[^;]$%s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced$TRUE$__Host-$__Secure-$domain$expires$httponly$localhost$max-age$oversized cookie dropped, name/val %zu + %zu bytes$path$secure$skipped cookie with bad tailmatch domain: %s$version
API String ID: 2059720140-3844637060
Opcode ID: a39a1d12dcc9c93c66c3671037a2bc0d1fa26e728b26729c8da1ea353f85cb4f
Instruction ID: 9f1a3310d81eab41a7d7ead2de8c893aed6aa227438147328274a526354f0532
Opcode Fuzzy Hash: a39a1d12dcc9c93c66c3671037a2bc0d1fa26e728b26729c8da1ea353f85cb4f
Instruction Fuzzy Hash: 37727C23A2968686FB619B26D4403B967A0FF4579CF0C4135CA8E82797DFBCF585CB10

Function 00007FF6729BD250 Relevance: 102.1, APIs: 45, Strings: 13, Instructions: 581COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF672995B20: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF672995C45
Part of subcall function 00007FF672995B20: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF672995C60

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BD2DE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BD312
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BD31C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BD339
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BD34C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BD355
#22.WLDAP32 ref: 00007FF6729BD366
#211.WLDAP32 ref: 00007FF6729BD400
#217.WLDAP32 ref: 00007FF6729BD41C
#211.WLDAP32 ref: 00007FF6729BD435
#211.WLDAP32 ref: 00007FF6729BD447
#60.WLDAP32 ref: 00007FF6729BD477
#211.WLDAP32 ref: 00007FF6729BD592
#60.WLDAP32 ref: 00007FF6729BD5B7
#22.WLDAP32 ref: 00007FF6729BD65A
#41.WLDAP32 ref: 00007FF6729BDA76
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BDA9E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BDAA8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BDAC8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BDADB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BDAE4
#46.WLDAP32 ref: 00007FF6729BDAF6

Strings

LDAP local: %s, xrefs: 00007FF6729BD36C
There are more than %d entries, xrefs: 00007FF6729BDA86
LDAP remote: %s, xrefs: 00007FF6729BD6D7
Microsoft Corporation., xrefs: 00007FF6729BD270
;binary, xrefs: 00007FF6729BD8E0
LDAP local: bind via ldap_win_bind %s, xrefs: 00007FF6729BD664
LDAP local: Cannot connect to %s:%ld, xrefs: 00007FF6729BD49B
cleartext, xrefs: 00007FF6729BD38F
LDAP local: trying to establish %s connection, xrefs: 00007FF6729BD399
encrypted, xrefs: 00007FF6729BD3AE
LDAP local: %s, xrefs: 00007FF6729BD2C7
LDAP local: LDAP Vendor = %s ; LDAP Version = %d, xrefs: 00007FF6729BD284
DN: , xrefs: 00007FF6729BD752

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$#211$fwrite$#217calloc
String ID: ;binary$DN: $LDAP local: %s$LDAP local: %s$LDAP local: Cannot connect to %s:%ld$LDAP local: LDAP Vendor = %s ; LDAP Version = %d$LDAP local: bind via ldap_win_bind %s$LDAP local: trying to establish %s connection$LDAP remote: %s$Microsoft Corporation.$There are more than %d entries$cleartext$encrypted
API String ID: 2742731861-78870445
Opcode ID: bd8d48a0d1dfa1f71496df7c0f5e953d3818920dfe553d9e1caf54011fe120e0
Instruction ID: e9e8744d9512db3d6b5185bdfa04a8c6a4cc7f466c918520b333652ca6d5c2f6
Opcode Fuzzy Hash: bd8d48a0d1dfa1f71496df7c0f5e953d3818920dfe553d9e1caf54011fe120e0
Instruction Fuzzy Hash: 13427C23B28A42C6EB148BA3D4502B933A1FB49B9CF484135CE0E97796DEBCE445CB50

Function 00007FF67297958D Relevance: 78.0, APIs: 39, Strings: 5, Instructions: 975COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF672979F8D
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF672979F94
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297A074
__std_exception_destroy.VCRUNTIME140 ref: 00007FF67297A0A2
__std_exception_destroy.VCRUNTIME140 ref: 00007FF67297A0B0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297A0EB

Strings

object, xrefs: 00007FF67297A339
number overflow parsing ', xrefs: 00007FF672979FB0
array, xrefs: 00007FF67297A1AA
object separator, xrefs: 00007FF672979C93, 00007FF67297A4CA
object key, xrefs: 00007FF672979E1F, 00007FF67297A659

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: Xbad_function_call@std@@__std_exception_destroy_invalid_parameter_noinfo_noreturn
String ID: array$number overflow parsing '$object$object key$object separator
API String ID: 1664669839-85532522
Opcode ID: de567e8d4393edb68e056ac8202e6e6a4dc0e7253e2b4b5c4c1601e3528e7b81
Instruction ID: a04a12989c6a1d565ab6d1263f82aea3fc66a290a1e617987797ee8be5c5a908
Opcode Fuzzy Hash: de567e8d4393edb68e056ac8202e6e6a4dc0e7253e2b4b5c4c1601e3528e7b81
Instruction Fuzzy Hash: EDA2C323A28B8686FB108B7AD4443AD3361FB417A8F545231DA5D87BDADFBCD181DB00

Function 00007FF6729B9550 Relevance: 77.4, APIs: 26, Strings: 18, Instructions: 435networkfilepipeCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B959F
WSAStartup.WS2_32 ref: 00007FF6729B9640
FreeLibrary.KERNEL32 ref: 00007FF6729B982D
GetStdHandle.KERNEL32 ref: 00007FF6729B983C
GetFileType.KERNEL32 ref: 00007FF6729B985D
WaitForMultipleObjects.KERNEL32 ref: 00007FF6729B98A7
PeekNamedPipe.KERNEL32 ref: 00007FF6729B992C
ReadFile.KERNEL32 ref: 00007FF6729B9953
ReadFile.KERNEL32 ref: 00007FF6729B9A0D
WSAGetLastError.WS2_32 ref: 00007FF6729B9A6E
WSAGetLastError.WS2_32 ref: 00007FF6729B9C6A
FreeLibrary.KERNEL32 ref: 00007FF6729B9C8A
GetLastError.KERNEL32 ref: 00007FF6729B9C94

Part of subcall function 00007FF6729BA4C0: send.WS2_32 ref: 00007FF6729BA4FD
Part of subcall function 00007FF6729BA4C0: WSAGetLastError.WS2_32 ref: 00007FF6729BA507

Strings

WSACloseEvent, xrefs: 00007FF6729B96FC
WSACloseEvent failed (%d), xrefs: 00007FF6729B9C70
, xrefs: 00007FF6729B9C32
failed to find WSACreateEvent function (%u), xrefs: 00007FF6729B96F3
WS2_32.DLL, xrefs: 00007FF6729B968E
failed to find WSAEventSelect function (%u), xrefs: 00007FF6729B9767
FreeLibrary(wsock2) failed (%u), xrefs: 00007FF6729B9C9A
WSACreateEvent failed (%d), xrefs: 00007FF6729B97AE
WSAEnumNetworkEvents failed (%d), xrefs: 00007FF6729B9A82
failed to load WS2_32.DLL (%u), xrefs: 00007FF6729B96BB
failed to find WSACloseEvent function (%u), xrefs: 00007FF6729B971C
WSAEnumNetworkEvents, xrefs: 00007FF6729B9770
failed to find WSAEnumNetworkEvents function (%u), xrefs: 00007FF6729B9790
Time-out, xrefs: 00007FF6729B9C47
WSACreateEvent, xrefs: 00007FF6729B96D5
insufficient winsock version to support telnet, xrefs: 00007FF6729B9CCF
WSAStartup failed (%d), xrefs: 00007FF6729B964D
WSAEventSelect, xrefs: 00007FF6729B9741

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: ErrorLast$File$FreeLibraryRead$HandleMultipleNamedObjectsPeekPipeStartupTypeWaitcallocsend
String ID: $FreeLibrary(wsock2) failed (%u)$Time-out$WS2_32.DLL$WSACloseEvent$WSACloseEvent failed (%d)$WSACreateEvent$WSACreateEvent failed (%d)$WSAEnumNetworkEvents$WSAEnumNetworkEvents failed (%d)$WSAEventSelect$WSAStartup failed (%d)$failed to find WSACloseEvent function (%u)$failed to find WSACreateEvent function (%u)$failed to find WSAEnumNetworkEvents function (%u)$failed to find WSAEventSelect function (%u)$failed to load WS2_32.DLL (%u)$insufficient winsock version to support telnet
API String ID: 1025660337-777782649
Opcode ID: 4ca822b0263ecb5ada10b5990cbbd122198784b4d2e011384f9ca85ff5bf276f
Instruction ID: 80332be3389eb8ef304a965455b0e9426002ced46721db3cf71b0bb00addaccb
Opcode Fuzzy Hash: 4ca822b0263ecb5ada10b5990cbbd122198784b4d2e011384f9ca85ff5bf276f
Instruction Fuzzy Hash: 96126D33A28682C5FB648F26D4543B973A0FB85B98F585135DA4E87696DFBCE640CF00

Function 00007FF67297AC2D Relevance: 74.4, APIs: 37, Strings: 5, Instructions: 925COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297B5C4
__std_exception_destroy.VCRUNTIME140 ref: 00007FF67297B5F2
__std_exception_destroy.VCRUNTIME140 ref: 00007FF67297B600
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297B63A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297B697
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297B750
__std_exception_destroy.VCRUNTIME140 ref: 00007FF67297B77E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF67297B78C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297B7C6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297B823

Part of subcall function 00007FF67297EFE0: memcmp.VCRUNTIME140 ref: 00007FF67297F06D
Part of subcall function 00007FF67297EFE0: memcmp.VCRUNTIME140 ref: 00007FF67297F0F1

Strings

object, xrefs: 00007FF67297BBC8
number overflow parsing ', xrefs: 00007FF67297B83F
array, xrefs: 00007FF67297BA39
object separator, xrefs: 00007FF67297B530, 00007FF67297BD59
object key, xrefs: 00007FF67297B6BC, 00007FF67297BEE8

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcmp
String ID: array$number overflow parsing '$object$object key$object separator
API String ID: 969624648-85532522
Opcode ID: bad08cb25ec3196b32b4661dd409be8e70787c7c87d3b4a0135f3fd6d6332e9d
Instruction ID: c178a0027913d3089a6781ee4111d79af865ef804d992438fa1a57618d8a09bc
Opcode Fuzzy Hash: bad08cb25ec3196b32b4661dd409be8e70787c7c87d3b4a0135f3fd6d6332e9d
Instruction Fuzzy Hash: EC92C663A28B8682EB10CB7AD4543AD3361FB557A8F545231DA6D87BDADFBCD080D700

Function 00007FF6729C5B00 Relevance: 72.3, APIs: 17, Strings: 24, Instructions: 549encryptionCOMMON

Download Yara Rule

APIs

CertOpenStore.CRYPT32 ref: 00007FF6729C5C6F
GetLastError.KERNEL32 ref: 00007FF6729C5C82
CertCreateCertificateChainEngine.CRYPT32 ref: 00007FF6729C5D34
GetLastError.KERNEL32 ref: 00007FF6729C5D3E
CertGetCertificateChain.CRYPT32 ref: 00007FF6729C5DCB
GetLastError.KERNEL32 ref: 00007FF6729C5DD5
CertGetNameStringA.CRYPT32 ref: 00007FF6729C5F43
CertFreeCertificateChainEngine.CRYPT32 ref: 00007FF6729C63BB
CertCloseStore.CRYPT32 ref: 00007FF6729C63D0
CertFreeCertificateChain.CRYPT32 ref: 00007FF6729C63E0
CertFreeCertificateContext.CRYPT32 ref: 00007FF6729C63F0

Strings

schannel: failed to create certificate store: %s, xrefs: 00007FF6729C5C9C
schannel: Null certificate info., xrefs: 00007FF6729C5F93, 00007FF6729C6124
schannel: CertGetCertificateChain error mask: 0x%08x, xrefs: 00007FF6729C5EAA
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT, xrefs: 00007FF6729C5E6C
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF6729C636D
schannel: server certificate name verification failed, xrefs: 00007FF6729C632E
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF6729C5C41
schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN, xrefs: 00007FF6729C5E99
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED, xrefs: 00007FF6729C5E3D
schannel: connection hostname (%s) did not match against certificate name (%s), xrefs: 00007FF6729C62F9
schannel: CryptDecodeObjectEx() returned no alternate name information., xrefs: 00007FF6729C600E, 00007FF6729C61B5
2.5.29.17, xrefs: 00007FF6729C5FA3, 00007FF6729C5FD4, 00007FF6729C613F, 00007FF6729C617B
schannel: CertGetNameString() returned certificate name information of unexpected size, xrefs: 00007FF6729C6283
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN, xrefs: 00007FF6729C5E55
schannel: failed to create certificate chain engine: %s, xrefs: 00007FF6729C5D58
schannel: Not enough memory to list all host names., xrefs: 00007FF6729C626C
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID, xrefs: 00007FF6729C5E82
schannel: Null certificate context., xrefs: 00007FF6729C5F58, 00007FF6729C6107
schannel: CertGetCertificateChain failed: %s, xrefs: 00007FF6729C5DEF
schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names, xrefs: 00007FF6729C6346
schannel: Empty DNS name., xrefs: 00007FF6729C604A, 00007FF6729C61F8
schannel: connection hostname (%s) validated against certificate name (%s), xrefs: 00007FF6729C62E9
schannel: CertGetNameString() returned no certificate name information, xrefs: 00007FF6729C608D
schannel: CertFindExtension() returned no extension., xrefs: 00007FF6729C5FBB, 00007FF6729C6157

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: Cert$Certificate$Chain$ErrorFreeLast$EngineStore$CloseContextCreateNameOpenString
String ID: 2.5.29.17$schannel: CertFindExtension() returned no extension.$schannel: CertGetCertificateChain error mask: 0x%08x$schannel: CertGetCertificateChain failed: %s$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT$schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN$schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names$schannel: CertGetNameString() returned certificate name information of unexpected size$schannel: CertGetNameString() returned no certificate name information$schannel: CryptDecodeObjectEx() returned no alternate name information.$schannel: Empty DNS name.$schannel: Failed to read remote certificate context: %s$schannel: Not enough memory to list all host names.$schannel: Null certificate context.$schannel: Null certificate info.$schannel: connection hostname (%s) did not match against certificate name (%s)$schannel: connection hostname (%s) validated against certificate name (%s)$schannel: failed to create certificate chain engine: %s$schannel: failed to create certificate store: %s$schannel: server certificate name verification failed$schannel: this version of Windows is too old to support certificate verification via CA bundle file.
API String ID: 561913010-2037819326
Opcode ID: 9722a1f074abd136a4ef9731bedc300fc8aa5692ab0fb8b499a6287a7c43805e
Instruction ID: 00c1630acde96b94685d44a96dbbef4f94f0c7b38fa16549f19f6d44c08843d0
Opcode Fuzzy Hash: 9722a1f074abd136a4ef9731bedc300fc8aa5692ab0fb8b499a6287a7c43805e
Instruction Fuzzy Hash: E942D477A28B4296EB109B26D4402BD37A0FB84B9CF984235CD5D97796DFBCE484DB00

Function 00007FF6729B4A20 Relevance: 67.0, APIs: 25, Strings: 13, Instructions: 515networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B4B01
getsockname.WS2_32 ref: 00007FF6729B4CFA
WSAGetLastError.WS2_32 ref: 00007FF6729B4D04
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B523B

Strings

getsockname() failed: %s, xrefs: 00007FF6729B4D1E, 00007FF6729B4F2E
%s %s, xrefs: 00007FF6729B5149
,%d,%d, xrefs: 00007FF6729B5119
%s |%d|%s|%hu|, xrefs: 00007FF6729B51C9
Failure sending PORT command: %s, xrefs: 00007FF6729B516C
EPRT, xrefs: 00007FF6729B51B2
socket failure: %s, xrefs: 00007FF6729B4DFF, 00007FF6729B5006
PORT, xrefs: 00007FF6729B5142
bind(port=%hu) on non-local address failed: %s, xrefs: 00007FF6729B4E94
Failure sending EPRT command: %s, xrefs: 00007FF6729B51EF
bind() failed, we ran out of ports!, xrefs: 00007FF6729B4EF6
bind(port=%hu) failed: %s, xrefs: 00007FF6729B4F65
failed to resolve the address provided to PORT: %s, xrefs: 00007FF6729B5229

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: ErrorLastcallocfreegetsockname
String ID: %s %s$%s |%d|%s|%hu|$,%d,%d$EPRT$Failure sending EPRT command: %s$Failure sending PORT command: %s$PORT$bind() failed, we ran out of ports!$bind(port=%hu) failed: %s$bind(port=%hu) on non-local address failed: %s$failed to resolve the address provided to PORT: %s$getsockname() failed: %s$socket failure: %s
API String ID: 2454324209-2383553807
Opcode ID: acccd8661a4fdf893f9870841c3917f0f944a44968aeb0973c1b6dc12d9d4836
Instruction ID: 61d953cc36b1a8764eac7fc9123ee6d649df1c6e158ca47f12a3ffc6c9dcccfa
Opcode Fuzzy Hash: acccd8661a4fdf893f9870841c3917f0f944a44968aeb0973c1b6dc12d9d4836
Instruction Fuzzy Hash: 4122C763A2C78285EB509B63D4503BA6361FB85B8CF485035EA4EC7787DEBCE545DB00

Function 00007FF6729C6420 Relevance: 52.8, APIs: 17, Strings: 13, Instructions: 253fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6729C6466

Part of subcall function 00007FF672982670: GetLastError.KERNEL32 ref: 00007FF67298268C
Part of subcall function 00007FF672982670: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672982694

CreateFileA.KERNEL32 ref: 00007FF6729C64C0
GetLastError.KERNEL32 ref: 00007FF6729C64D1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C680D

Strings

schannel: invalid path name for CA file '%s': %s, xrefs: 00007FF6729C6480
schannel: failed to add certificate from CA file '%s' to certificate store: %s, xrefs: 00007FF6729C6746
-----BEGIN CERTIFICATE-----, xrefs: 00007FF6729C660E
schannel: failed to read from CA file '%s': %s, xrefs: 00007FF6729C6710
-----END CERTIFICATE-----, xrefs: 00007FF6729C6639
schannel: added %d certificate(s) from CA file '%s', xrefs: 00007FF6729C67E3
schannel: failed to extract certificate from CA file '%s': %s, xrefs: 00007FF6729C6795
schannel: CA file exceeds max size of %u bytes, xrefs: 00007FF6729C6569
schannel: unexpected content type '%d' when extracting certificate from CA file '%s', xrefs: 00007FF6729C6765
schannel: CA file '%s' is not correctly formatted, xrefs: 00007FF6729C67B1
schannel: did not add any certificates from CA file '%s', xrefs: 00007FF6729C67D2
schannel: failed to determine size of CA file '%s': %s, xrefs: 00007FF6729C6532
schannel: failed to open CA file '%s': %s, xrefs: 00007FF6729C64EB

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: ErrorLast$CreateFile_errnofree
String ID: -----END CERTIFICATE-----$-----BEGIN CERTIFICATE-----$schannel: CA file '%s' is not correctly formatted$schannel: CA file exceeds max size of %u bytes$schannel: added %d certificate(s) from CA file '%s'$schannel: did not add any certificates from CA file '%s'$schannel: failed to add certificate from CA file '%s' to certificate store: %s$schannel: failed to determine size of CA file '%s': %s$schannel: failed to extract certificate from CA file '%s': %s$schannel: failed to open CA file '%s': %s$schannel: failed to read from CA file '%s': %s$schannel: invalid path name for CA file '%s': %s$schannel: unexpected content type '%d' when extracting certificate from CA file '%s'
API String ID: 1377488173-902404565
Opcode ID: b4c3ea5e23d49ba01af2b9596e1b99eba66ff92d36cc034f59815fbef0d57977
Instruction ID: 18ba9550813cc0e5feebaf73663abc18ed8cf4fc88dda5aa8024b7b7e54302f7
Opcode Fuzzy Hash: b4c3ea5e23d49ba01af2b9596e1b99eba66ff92d36cc034f59815fbef0d57977
Instruction Fuzzy Hash: 08B19537B2874186E7109B67E4006A97791BF84B9CF98023ADE8D87796DEBCE545CF00

Function 00007FF672993360 Relevance: 51.2, APIs: 21, Strings: 8, Instructions: 401stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6729933BA
memset.VCRUNTIME140 ref: 00007FF6729933CF
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729933EB
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF672993412
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF672993489
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729934BC
strchr.VCRUNTIME140 ref: 00007FF6729935A6
strchr.VCRUNTIME140 ref: 00007FF6729935EB
strchr.VCRUNTIME140 ref: 00007FF67299361B
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729936C3

Part of subcall function 00007FF6729ABF70: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729904E9,?,?,?,?,00007FF67298F88B), ref: 00007FF6729ABF98
Part of subcall function 00007FF6729ABF70: GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF6729904E9,?,?,?,?,00007FF67298F88B), ref: 00007FF6729ABFBE
Part of subcall function 00007FF6729ABF70: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729904E9,?,?,?,?,00007FF67298F88B), ref: 00007FF6729ABFDF
Part of subcall function 00007FF6729ABF70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729904E9,?,?,?,?,00007FF67298F88B), ref: 00007FF6729ABFF0

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672993796
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729937C5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729937EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672993817
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672993825
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672993837
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729939DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729939E3

Strings

_proxy, xrefs: 00007FF6729936D9
memory shortage, xrefs: 00007FF672993497
http_proxy, xrefs: 00007FF67299370D
no_proxy, xrefs: 00007FF6729934E1
Uses proxy env variable %s == '%s', xrefs: 00007FF67299351C, 00007FF67299377A
NO_PROXY, xrefs: 00007FF6729934FD
all_proxy, xrefs: 00007FF672993749
ALL_PROXY, xrefs: 00007FF672993760

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$strchr$_strdupmemsetreallocstrncpy$EnvironmentVariabletolower
String ID: ALL_PROXY$NO_PROXY$Uses proxy env variable %s == '%s'$_proxy$all_proxy$http_proxy$memory shortage$no_proxy
API String ID: 1339443121-1021110354
Opcode ID: 967818f1c0348c1b89c0ae2d15e897365cf2d8b25b54bc4880cd3cbcfbeaac3f
Instruction ID: 16f5c94c93095a51a9bf62dd70b7156e96f953f2f58b94da5e74ba8581038164
Opcode Fuzzy Hash: 967818f1c0348c1b89c0ae2d15e897365cf2d8b25b54bc4880cd3cbcfbeaac3f
Instruction Fuzzy Hash: 76029F63A2978289EB51CF12A4543AA67A4FF85B9CF0C0035DE8D87796DFBCE454CB04

Function 00007FF6729C15E0 Relevance: 42.4, APIs: 21, Strings: 3, Instructions: 425COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C1696
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C1751
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C175F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C1771

Strings

digest_sspi: MakeSignature failed, error 0x%08lx, xrefs: 00007FF6729C198B
WDigest, xrefs: 00007FF6729C1621, 00007FF6729C1A55
realm, xrefs: 00007FF6729C18F7

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$malloc
String ID: WDigest$digest_sspi: MakeSignature failed, error 0x%08lx$realm
API String ID: 2190258309-2223379150
Opcode ID: d2e112f8afa5f83c03b049142655cbada903e276aab9495dc79dfd4b2435d6f8
Instruction ID: 7aa4447f81e84a033c1ab612fa3959dea062e9633723a728c6cdbb7dbbac7589
Opcode Fuzzy Hash: d2e112f8afa5f83c03b049142655cbada903e276aab9495dc79dfd4b2435d6f8
Instruction Fuzzy Hash: C7126033A18B81C6EB10CF62E8542A977A4FB44B88F581235DE8D83B96DF7CD545CB44

Function 00007FF672997660 Relevance: 38.8, APIs: 14, Strings: 8, Instructions: 317stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF672997732
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67299774D
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67299778C

Strings

Name '%s' family %i resolved to '%s' family %i, xrefs: 00007FF672997958
Local Interface %s is ip %s using address family %i, xrefs: 00007FF672997847
Couldn't bind to interface '%s', xrefs: 00007FF6729978D0
Couldn't bind to '%s', xrefs: 00007FF672997822
bind failed with errno %d: %s, xrefs: 00007FF672997B18
Local port: %hu, xrefs: 00007FF672997B35
Bind to local port %hu failed, trying next, xrefs: 00007FF672997A40
getsockname() failed with errno %d: %s, xrefs: 00007FF672997ADC

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: strncmp$memset
String ID: Bind to local port %hu failed, trying next$Couldn't bind to '%s'$Couldn't bind to interface '%s'$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$getsockname() failed with errno %d: %s
API String ID: 3268688168-2769131373
Opcode ID: 7c857386eaf4862ff66fef692eb3c5e3a374c9c47a9d02c7ae782c4bf6282098
Instruction ID: 50e693fd395dc7255e190d8df0ed01c6e3271444617959b7f2a6bc91c6d1c1a9
Opcode Fuzzy Hash: 7c857386eaf4862ff66fef692eb3c5e3a374c9c47a9d02c7ae782c4bf6282098
Instruction Fuzzy Hash: 21E1B263E286828AEB10CB66E4502F96360FBD979CF485136DE8E83756DFBCD554CB00

Function 00007FF67297976B Relevance: 37.3, APIs: 18, Strings: 3, Instructions: 509COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF672979F94
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297A074
__std_exception_destroy.VCRUNTIME140 ref: 00007FF67297A0A2
__std_exception_destroy.VCRUNTIME140 ref: 00007FF67297A0B0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297A0EB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297A12A

Strings

object, xrefs: 00007FF67297A339
number overflow parsing ', xrefs: 00007FF672979FB0
array, xrefs: 00007FF67297A1AA

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$Xbad_function_call@std@@
String ID: array$number overflow parsing '$object
API String ID: 958247072-579821726
Opcode ID: 2dcf334649ba90baea7ff72d602ac338f610d32871fa4644820f0d0b244a8878
Instruction ID: fbb7d576d7e6e439e3e3b3130f632b805d697e3c2544fbe6ad686b5b86c4b4db
Opcode Fuzzy Hash: 2dcf334649ba90baea7ff72d602ac338f610d32871fa4644820f0d0b244a8878
Instruction Fuzzy Hash: 0932D263A28B8686FB108B7AD4443ED2361FB457A8F545231DA5D87BDADFBCD180C700

Function 00007FF6729C05B0 Relevance: 28.3, APIs: 11, Strings: 5, Instructions: 252fileCOMMON

Download Yara Rule

APIs

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000468,00000470,00000000,?), ref: 00007FF6729C0643
fgets.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6729C066D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C0732
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C073E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C07A2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C07AE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C08B1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C08BF
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6729C08CA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C091F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C093E

Strings

, xrefs: 00007FF6729C0681, 00007FF6729C0882
machine, xrefs: 00007FF6729C0801, 00007FF6729C0842
default, xrefs: 00007FF6729C085D
password, xrefs: 00007FF6729C07E9
login, xrefs: 00007FF6729C07CE

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$_strdup$fclosefgetsfopen
String ID: $default$login$machine$password
API String ID: 431015889-155862542
Opcode ID: 1a66d6918135140a9283c1155815eb12b0feb72cef10ce17e96bbb8b874f5662
Instruction ID: 61627e0da6045ffa8001bef43344e7fd147a07670da9e47d4f8ed7d4daf29fe2
Opcode Fuzzy Hash: 1a66d6918135140a9283c1155815eb12b0feb72cef10ce17e96bbb8b874f5662
Instruction Fuzzy Hash: EEA18623A2D68285FAA59F37955037A6690FF84F8CF0C4231DD8D86696DEBDE484CE40

Function 00007FF6729A7CF0 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 422stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729A7F6E
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729A7F76
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6729A7F8C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729A7F95
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729A7F9D
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729A7FA7

Strings

GMT, xrefs: 00007FF6729A7E67
%02d:%02d%n, xrefs: 00007FF6729A7F4D
%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz], xrefs: 00007FF6729A7DAE
%02d:%02d:%02d%n, xrefs: 00007FF6729A7F19

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _errno$strtol
String ID: %02d:%02d%n$%02d:%02d:%02d%n$%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]$GMT
API String ID: 3596500743-988243589
Opcode ID: a802c962f3b7d1a36dc1295f7a047be4a67b4968c2aa0acb31b0a18409b51fb2
Instruction ID: d8d128900b1be8dfa3dfc419f13199dbe9f93f418a8b5e6d6fa0b5227d37e54e
Opcode Fuzzy Hash: a802c962f3b7d1a36dc1295f7a047be4a67b4968c2aa0acb31b0a18409b51fb2
Instruction Fuzzy Hash: D1F1B573F286118AEB248B6A94011FC77B1BB4475CF684235DE1E977E6DEB8E805CB40

Function 00007FF6729A9330 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 78encryptionCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6729A9370
CryptAcquireContextA.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6729A92F9), ref: 00007FF6729A938F
CryptCreateHash.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6729A92F9), ref: 00007FF6729A93B9
CryptHashData.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6729A92F9), ref: 00007FF6729A93D1
CryptGetHashParam.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6729A92F9), ref: 00007FF6729A93F6
CryptGetHashParam.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6729A92F9), ref: 00007FF6729A9422
CryptDestroyHash.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6729A92F9), ref: 00007FF6729A9432
CryptReleaseContext.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6729A92F9), ref: 00007FF6729A9444

Strings

@, xrefs: 00007FF6729A9385

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyReleasememset
String ID: @
API String ID: 2041421932-2766056989
Opcode ID: 035e510839b57ee73c6c2cba4a4435af7923e6ab64538681f40ec1597c466301
Instruction ID: eb8518ac6072a915f3d66f1d6066770df4c5eebd030a10458117300253575849
Opcode Fuzzy Hash: 035e510839b57ee73c6c2cba4a4435af7923e6ab64538681f40ec1597c466301
Instruction Fuzzy Hash: 13316D33A2978186E760DF22E844A6A77A0FBC4B84F489035DA8DA7B19CF7CD545CF00

Function 00007FF672982670 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF67298268C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672982694
FormatMessageA.KERNEL32 ref: 00007FF6729826CE
strchr.VCRUNTIME140 ref: 00007FF6729826E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67298272C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672982736
GetLastError.KERNEL32 ref: 00007FF67298273E
SetLastError.KERNEL32 ref: 00007FF67298274A

Strings

Unknown error %u (0x%08X), xrefs: 00007FF67298271A

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchr
String ID: Unknown error %u (0x%08X)
API String ID: 1897771742-1058733786
Opcode ID: 193a177aa2713736a1338d97de9647baf4f4b35b4644f55da922f389523db870
Instruction ID: 4b03c21045a72b0f0f5d68df59b78c93dc5c562d56084653b5919a36fdcde931
Opcode Fuzzy Hash: 193a177aa2713736a1338d97de9647baf4f4b35b4644f55da922f389523db870
Instruction Fuzzy Hash: 61216F27E18782C7EB215F33A40426A7A90BF88BD8F5C5034DE4A93756CFBCE8418B10

Function 00007FF672990630 Relevance: 14.3, Strings: 11, Instructions: 540COMMON

Download Yara Rule

Strings

Server doesn't support multiplex (yet), xrefs: 00007FF67299079F
Can not multiplex, even if we wanted to!, xrefs: 00007FF6729907EA
Found pending candidate for reuse and CURLOPT_PIPEWAIT is set, xrefs: 00007FF672990EFA
Could multiplex, but not asked to!, xrefs: 00007FF6729907CC
Found bundle for host %s: %p [%s], xrefs: 00007FF672990749
can multiplex, xrefs: 00007FF672990732
Connection #%ld is still name resolving, can't reuse, xrefs: 00007FF672990871
serially, xrefs: 00007FF67299073E
Multiplexed connection found!, xrefs: 00007FF672990EA1
Connection #%ld isn't open enough, can't reuse, xrefs: 00007FF672990896
Server doesn't support multiplex yet, wait, xrefs: 00007FF67299077B

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID:
String ID: Can not multiplex, even if we wanted to!$Connection #%ld is still name resolving, can't reuse$Connection #%ld isn't open enough, can't reuse$Could multiplex, but not asked to!$Found bundle for host %s: %p [%s]$Found pending candidate for reuse and CURLOPT_PIPEWAIT is set$Multiplexed connection found!$Server doesn't support multiplex (yet)$Server doesn't support multiplex yet, wait$can multiplex$serially
API String ID: 0-2774518510
Opcode ID: de05d58fb7f1eafb274b9627ff077b26a90027ae7330fc98772b36cb75fe464e
Instruction ID: 9362c2c2523b06cb5deee69e37381308e2c80d94c855009be035848e40a15a68
Opcode Fuzzy Hash: de05d58fb7f1eafb274b9627ff077b26a90027ae7330fc98772b36cb75fe464e
Instruction Fuzzy Hash: 8F429763A2C7C24DEBD58A6681503B93799EFD175CF0C4039CAED87297DFA9A460CB10

Function 00007FF6729AC600 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 223COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000021C,-00000008,00000000,?,?,00007FF6729AC5F8,?,?,?,?,?,?,00007FF6729C383E), ref: 00007FF6729AC676
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000021C,-00000008,00000000,?,?,00007FF6729AC5F8,?,?,?,?,?,?,00007FF6729C383E), ref: 00007FF6729AC7DD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729AC93C

Strings

%c%c%c=, xrefs: 00007FF6729AC771
%c%c%c%c, xrefs: 00007FF6729AC733
%c%c==, xrefs: 00007FF6729AC7A3

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: %c%c%c%c$%c%c%c=$%c%c==
API String ID: 3985033223-3943651191
Opcode ID: 9e70eafaa152611099d7e928322534170d092b842527632a71a9247aeb68654c
Instruction ID: fc4976964040df810f9a6118eae13c9ea198fb2bbcb18825d4dbc3531c95348e
Opcode Fuzzy Hash: 9e70eafaa152611099d7e928322534170d092b842527632a71a9247aeb68654c
Instruction Fuzzy Hash: E691C473A287D185E765DB26A4143BA7BA0AB85798F4C4231DAAD8B7D7CF7CD401CB00

Function 00007FF6729BB520 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BB59E
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BB5FB
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BB623
bind.WS2_32 ref: 00007FF6729BB6A2
WSAGetLastError.WS2_32 ref: 00007FF6729BB6AC

Strings

bind() failed; %s, xrefs: 00007FF6729BB6C7

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: calloc$ErrorLastbind
String ID: bind() failed; %s
API String ID: 2604820300-1141498939
Opcode ID: c48a5a6005835ebf874713ac26343a5ff0df3897b03ea6a86dc329f15921594a
Instruction ID: 555bda976d199b65cc8e807f0e572d6535fe5788ecba53e6527083997ba345b5
Opcode Fuzzy Hash: c48a5a6005835ebf874713ac26343a5ff0df3897b03ea6a86dc329f15921594a
Instruction Fuzzy Hash: 8D518F73A18785DAE7158B26D4603A927A0FB48B98F084135CF4D877C6DFBCE866CB05

Function 00007FF6729BB780 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 127networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BB7CF
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BB82C
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BB850
bind.WS2_32 ref: 00007FF6729BB8CB
WSAGetLastError.WS2_32 ref: 00007FF6729BB8D5

Strings

bind() failed; %s, xrefs: 00007FF6729BB8F0

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: calloc$ErrorLastbind
String ID: bind() failed; %s
API String ID: 2604820300-1141498939
Opcode ID: 4b6287ae4cb4af9c9e548b4a67196c2868dcc1649a043f94356b779a4c2df234
Instruction ID: 7714edd13427c8284fe034fa6e3d742014758758d1528ff94b99ad2594d44b1a
Opcode Fuzzy Hash: 4b6287ae4cb4af9c9e548b4a67196c2868dcc1649a043f94356b779a4c2df234
Instruction Fuzzy Hash: 8B514F33A18B86C6EB159B27D5643B962A0FB48B88F084035CE4D877D6DFBCE451CB44

Function 00007FF6729A5410 Relevance: 10.1, Strings: 8, Instructions: 72COMMON

Download Yara Rule

Strings

%4I64dP, xrefs: 00007FF6729A552D
%4I64dM, xrefs: 00007FF6729A54AC
%4I64dG, xrefs: 00007FF6729A5504
%2I64d.%0I64dG, xrefs: 00007FF6729A54CA
%2I64d.%0I64dM, xrefs: 00007FF6729A5459
%4I64dk, xrefs: 00007FF6729A543E
%4I64dT, xrefs: 00007FF6729A5520
%5I64d, xrefs: 00007FF6729A5425

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID:
String ID: %2I64d.%0I64dG$%2I64d.%0I64dM$%4I64dG$%4I64dM$%4I64dP$%4I64dT$%4I64dk$%5I64d
API String ID: 0-2102732564
Opcode ID: 5736770411d30fc4259e5b77ec8d0af740295d1fc19f284a2064cfa43a9a0e9d
Instruction ID: d6db556c04946954554d150a0c2fe7dd4399f4397ad292987a07384ea307f4b2
Opcode Fuzzy Hash: 5736770411d30fc4259e5b77ec8d0af740295d1fc19f284a2064cfa43a9a0e9d
Instruction Fuzzy Hash: 4521A193F2AA4A93FF04C7A7B4107F412725B44798EDC1436E80E86393DEFCA551D940

Function 00007FF6729A9260 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF6729A9291
CryptGenRandom.ADVAPI32 ref: 00007FF6729A92A5
CryptReleaseContext.ADVAPI32 ref: 00007FF6729A92B6
CryptReleaseContext.ADVAPI32 ref: 00007FF6729A92CC

Strings

@, xrefs: 00007FF6729A9279

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireRandom
String ID: @
API String ID: 2916321625-2766056989
Opcode ID: 05ef13bf38d768d66cbb7790796ddf4c0520a150bd0b7259f405025335dab679
Instruction ID: 123853c734f478053870f5dafa26ceef826007f04251a106606e1051076b6d2d
Opcode Fuzzy Hash: 05ef13bf38d768d66cbb7790796ddf4c0520a150bd0b7259f405025335dab679
Instruction Fuzzy Hash: E6F03667B18A8182E7109B66F944326B760FFC87D8F584431DE8D96669DEBCC5858B00

Function 00007FF672999870 Relevance: 8.2, Strings: 6, Instructions: 693COMMON

Download Yara Rule

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00007FF6729998B3, 00007FF672999D84, 00007FF672999DEB
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00007FF672999D8B, 00007FF672999DF6
(nil), xrefs: 00007FF67299A0D6
%ld, xrefs: 00007FF672999B80
.%ld, xrefs: 00007FF672999BD9
(nil), xrefs: 00007FF67299A054

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID:
String ID: %ld$(nil)$(nil)$.%ld$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 0-1379995092
Opcode ID: aa2f2b587277b0ab4dbce27bb24d019410913fa9cd9e50306f43d92b26a2bef4
Instruction ID: 995eebdad00e9bff6a6cf2919f55b23975630903a4fecc72aa5842f47e144989
Opcode Fuzzy Hash: aa2f2b587277b0ab4dbce27bb24d019410913fa9cd9e50306f43d92b26a2bef4
Instruction Fuzzy Hash: 27422933928A828AF6344A1A94403796795FFC57BCF584230DADE876D6DFBCE9518E00

Function 00007FF6729AC250 Relevance: 6.0, APIs: 4, Instructions: 33encryptionCOMMON

Download Yara Rule

APIs

CryptGetHashParam.ADVAPI32 ref: 00007FF6729AC280
CryptGetHashParam.ADVAPI32 ref: 00007FF6729AC2A6
CryptDestroyHash.ADVAPI32 ref: 00007FF6729AC2B5
CryptReleaseContext.ADVAPI32 ref: 00007FF6729AC2C5

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: Crypt$Hash$Param$ContextDestroyRelease
String ID:
API String ID: 2110207923-0
Opcode ID: 5513e9ce3c3bb6d5be74e2924c61227fada66d2b867e71bf52cd24ceed5c1bd1
Instruction ID: 1a3b1330528b0c6d10e707b1198dee25f9138ae37752d3e9d18a449999e8b7e2
Opcode Fuzzy Hash: 5513e9ce3c3bb6d5be74e2924c61227fada66d2b867e71bf52cd24ceed5c1bd1
Instruction Fuzzy Hash: AD017137A18681C2EB10CFA2E45432AB330FB85BC8F688531DA4D46A69CF7DD488CF00

Function 00007FF6729AC1F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF6729AC20C
CryptCreateHash.ADVAPI32 ref: 00007FF6729AC22D

Strings

@, xrefs: 00007FF6729AC1FC

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: Crypt$AcquireContextCreateHash
String ID: @
API String ID: 1914063823-2766056989
Opcode ID: d8ebe4e987efff2a7b71ba957b1518562946fab41be5a3812e730348d283fed2
Instruction ID: 939db22c54f6f10084d9c5c2e67e58f2bb31f61ffe40ce8be4d3f08edfeb284d
Opcode Fuzzy Hash: d8ebe4e987efff2a7b71ba957b1518562946fab41be5a3812e730348d283fed2
Instruction Fuzzy Hash: 73E01263B2469282F7605BB6E401B166260FB94B88F999020CE4C4AB59DF7DC1568F04

Function 00007FF6729B8B30 Relevance: 3.0, APIs: 2, Instructions: 38networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF6729B8B6B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729B8B9F

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _getpidhtons
String ID:
API String ID: 3416910171-0
Opcode ID: 17be246c6b9ce08b79939b91fdd45e7b100c7123979d3745743588953030ca0c
Instruction ID: 2ab1ba8df5cb92ac2fce72f55c7e5982e7e2da45e303af30324a3ee0d8cfce04
Opcode Fuzzy Hash: 17be246c6b9ce08b79939b91fdd45e7b100c7123979d3745743588953030ca0c
Instruction Fuzzy Hash: 91112E27A247D0CAD304CF76E5002AD3770FB58B88F54962AFB8987B19DB78D690C744

Function 00007FF67297EBA0 Relevance: 1.7, APIs: 1, Instructions: 187COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF67297EC80

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: Xbad_function_call@std@@
String ID:
API String ID: 1029415015-0
Opcode ID: 14973adebc5437691580ebe63d17496663c69ac8811f739b30f26fd181c27c9d
Instruction ID: e930256797b19f38e548078b101b8f83749c20078cd970a0af7a8b9047604f3a
Opcode Fuzzy Hash: 14973adebc5437691580ebe63d17496663c69ac8811f739b30f26fd181c27c9d
Instruction Fuzzy Hash: 0581AF23B29BD989EB01CB6AD0843AC37B0EB55B48F584426CF8D97796DFB9D080C750

Function 00007FF67297D280 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25ca6de128e55fb6ce216344201d591ed70013569d8b0f4d9d2315b49ebf49f1
Instruction ID: 6863623d7e070990d6590a4ab07ec5283b09398e57ee268e2b41c8a9526fff36
Opcode Fuzzy Hash: 25ca6de128e55fb6ce216344201d591ed70013569d8b0f4d9d2315b49ebf49f1
Instruction Fuzzy Hash: E6610363B29B8882DB14CB2AE44027963A1FB597D8F189231DF5D87B89EF7CE041C710

Function 00007FF6729AC240 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbbc81eeac69b129650ffbabaef16724ba72c03feca7b0af32eb80f6d28ec6ea
Instruction ID: 3d190f1654cc5b3cff0fbedf342fafffd6ee0b20e608352c043940a953c8cc77
Opcode Fuzzy Hash: cbbc81eeac69b129650ffbabaef16724ba72c03feca7b0af32eb80f6d28ec6ea
Instruction Fuzzy Hash: 8AA02433F05C45C0D3004711F150D143350F7CC71C3545031C40C41410CD34C041C300

Function 00007FF6729A9460 Relevance: 145.9, APIs: 50, Strings: 47, Instructions: 399stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF6729A9493
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729A94E3
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729A9504
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729A951A
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729A9538
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729A9556
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729A9574
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729A958C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729A95A4

Strings

CALG_MD5, xrefs: 00007FF6729A954F
CALG_ECDSA, xrefs: 00007FF6729A9A44
CALG_SHA_512, xrefs: 00007FF6729A99F3
CALG_TLS1_MASTER, xrefs: 00007FF6729A98A9
CALG_ECDH_EPHEM, xrefs: 00007FF6729A9A5F
CALG_DES, xrefs: 00007FF6729A9633
CALG_RSA_KEYX, xrefs: 00007FF6729A9615
CALG_SSL3_SHAMD5, xrefs: 00007FF6729A97D7
CALG_TEK, xrefs: 00007FF6729A979B
CALG_AES_256, xrefs: 00007FF6729A997B
CALG_SEAL, xrefs: 00007FF6729A96E7
CALG_3DES, xrefs: 00007FF6729A966F
CALG_RC4, xrefs: 00007FF6729A96C9
CALG_MD4, xrefs: 00007FF6729A9531
CALG_PCT1_MASTER, xrefs: 00007FF6729A986D
CALG_HMAC, xrefs: 00007FF6729A98E5
CALG_AES, xrefs: 00007FF6729A9999
CALG_SSL3_MASTER, xrefs: 00007FF6729A97F5
CALG_SCHANNEL_ENC_KEY, xrefs: 00007FF6729A984F
CALG_CYLINK_MEK, xrefs: 00007FF6729A97B9
CALG_SCHANNEL_MASTER_HASH, xrefs: 00007FF6729A9813
CALG_3DES_112, xrefs: 00007FF6729A9651
CALG_RC5, xrefs: 00007FF6729A98C7
CALG_NO_SIGN, xrefs: 00007FF6729A95F7
CALG_DH_EPHEM, xrefs: 00007FF6729A9723
CALG_MD2, xrefs: 00007FF6729A9513
CALG_SHA_256, xrefs: 00007FF6729A99B7
CALG_DSS_SIGN, xrefs: 00007FF6729A95D9
CALG_SHA1, xrefs: 00007FF6729A9585
CALG_SCHANNEL_MAC_KEY, xrefs: 00007FF6729A9831
CALG_RC2, xrefs: 00007FF6729A96AB
CALG_RSA_SIGN, xrefs: 00007FF6729A95BB
CALG_AES_192, xrefs: 00007FF6729A995D
CALG_MAC, xrefs: 00007FF6729A959D
CALG_SHA, xrefs: 00007FF6729A956D
CALG_DESX, xrefs: 00007FF6729A968D
CALG_DH_SF, xrefs: 00007FF6729A9705
CALG_HASH_REPLACE_OWF, xrefs: 00007FF6729A9921
CALG_TLS1PRF, xrefs: 00007FF6729A9903
CALG_AGREEDKEY_ANY, xrefs: 00007FF6729A9741
CALG_HUGHES_MD5, xrefs: 00007FF6729A975F
CALG_SHA_384, xrefs: 00007FF6729A99D5
CALG_AES_128, xrefs: 00007FF6729A993F
CALG_ECDH, xrefs: 00007FF6729A9A0E
CALG_SSL2_MASTER, xrefs: 00007FF6729A988B
CALG_ECMQV, xrefs: 00007FF6729A9A29
CALG_SKIPJACK, xrefs: 00007FF6729A977D

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: strcmp$strncpy$strchr
String ID: CALG_3DES$CALG_3DES_112$CALG_AES$CALG_AES_128$CALG_AES_192$CALG_AES_256$CALG_AGREEDKEY_ANY$CALG_CYLINK_MEK$CALG_DES$CALG_DESX$CALG_DH_EPHEM$CALG_DH_SF$CALG_DSS_SIGN$CALG_ECDH$CALG_ECDH_EPHEM$CALG_ECDSA$CALG_ECMQV$CALG_HASH_REPLACE_OWF$CALG_HMAC$CALG_HUGHES_MD5$CALG_MAC$CALG_MD2$CALG_MD4$CALG_MD5$CALG_NO_SIGN$CALG_PCT1_MASTER$CALG_RC2$CALG_RC4$CALG_RC5$CALG_RSA_KEYX$CALG_RSA_SIGN$CALG_SCHANNEL_ENC_KEY$CALG_SCHANNEL_MAC_KEY$CALG_SCHANNEL_MASTER_HASH$CALG_SEAL$CALG_SHA$CALG_SHA1$CALG_SHA_256$CALG_SHA_384$CALG_SHA_512$CALG_SKIPJACK$CALG_SSL2_MASTER$CALG_SSL3_MASTER$CALG_SSL3_SHAMD5$CALG_TEK$CALG_TLS1PRF$CALG_TLS1_MASTER
API String ID: 1395212091-3550120021
Opcode ID: 294ccd8b3ac8f6595e935296ddd7f8583b4d940c8e4deb5fd182542c1ff9ba44
Instruction ID: 588f9ef082e4a66cf36b67da9da1943bff6df249223dd10b218f6b30e7aacffa
Opcode Fuzzy Hash: 294ccd8b3ac8f6595e935296ddd7f8583b4d940c8e4deb5fd182542c1ff9ba44
Instruction Fuzzy Hash: 3E02D912F3C62395FB50A767DC542BA6265FF5038CF984032EA4EC659BEE9CE605DB00

Function 00007FF6729B0960 Relevance: 47.5, APIs: 18, Strings: 9, Instructions: 297stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729B09BE
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729B09F2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B0A71
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B0A8B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729B0A9A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729B0AE7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B0AF8

Strings

<%s@%s>, xrefs: 00007FF6729B0A56, 00007FF6729B0B9A
Mime-Version, xrefs: 00007FF6729B0C39
<%s>, xrefs: 00007FF6729B0A79, 00007FF6729B0BBD
SIZE=, xrefs: 00007FF6729B0D61
%I64d, xrefs: 00007FF6729B0CAE
MAIL FROM:%s%s%s%s%s%s, xrefs: 00007FF6729B0D8C
AUTH=, xrefs: 00007FF6729B0D55
SMTPUTF8, xrefs: 00007FF6729B0D4A
Mime-Version: 1.0, xrefs: 00007FF6729B0C54

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdupfree$strpbrk
String ID: AUTH=$ SIZE=$ SMTPUTF8$%I64d$<%s>$<%s@%s>$MAIL FROM:%s%s%s%s%s%s$Mime-Version$Mime-Version: 1.0
API String ID: 2737852498-2994854565
Opcode ID: 2c1e0a3cd7c4c791d4884a222bff0644d51e0ea281dfc68788704b76a4288ce9
Instruction ID: 6b3ce7f71846166022f5a9d11e295db63b3a5e2af41130a7a4bc6c6e475ca141
Opcode Fuzzy Hash: 2c1e0a3cd7c4c791d4884a222bff0644d51e0ea281dfc68788704b76a4288ce9
Instruction Fuzzy Hash: C4D18A23A29B92C4FA50DB239814AB923A0FF46B8CF484535DD4D97793EFBCA545CB00

Function 00007FF6729925E0 Relevance: 42.6, APIs: 34, Instructions: 121COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729925FD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672992613
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672992627
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299263B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299264F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672992663
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672992677
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299268B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299269F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729926B3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729926C7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729926DB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729926EF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672992703
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672992717
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299272B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299273F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672992753
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672992767
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299277B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299278F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729927A3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729927B7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729927CB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729927DF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729927F3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672992807
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299281B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299282F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672992843

Part of subcall function 00007FF6729928D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672992858), ref: 00007FF6729928EB
Part of subcall function 00007FF6729928D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672992858), ref: 00007FF672992919

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299286D

Part of subcall function 00007FF67298F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672992886), ref: 00007FF67298F091
Part of subcall function 00007FF67298F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672992886), ref: 00007FF67298F0A1
Part of subcall function 00007FF67298F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672992886), ref: 00007FF67298F0AF
Part of subcall function 00007FF67298F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672992886), ref: 00007FF67298F0BD
Part of subcall function 00007FF67298F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672992886), ref: 00007FF67298F0CB
Part of subcall function 00007FF67298F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672992886), ref: 00007FF67298F0D9
Part of subcall function 00007FF67298F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672992886), ref: 00007FF67298F0E7
Part of subcall function 00007FF67298F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672992886), ref: 00007FF67298F0F5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672992899
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729928AD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729928BD

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: cf303ff94083c9de6daad69ad2c4e33e1595a5d771b7a307520e3bc15327dd24
Instruction ID: 940bdb8f500e05c9091a547f2ecf145c51f4efcb2b1d2f374ea4faed5203c74d
Opcode Fuzzy Hash: cf303ff94083c9de6daad69ad2c4e33e1595a5d771b7a307520e3bc15327dd24
Instruction Fuzzy Hash: 68719D37928B81C1D740DF62E9942BC73A4FB89F99F080535CE8D96729CFB89199C721

Function 00007FF6729C2BE0 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 312networkCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6729C2CC9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C2D10
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C2F66
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C2F7D
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C2F98
htons.WS2_32 ref: 00007FF6729C2FF7

Strings

bad error code, xrefs: 00007FF6729C2D28
CNAME: %s, xrefs: 00007FF6729C2EF3
TTL: %u seconds, xrefs: 00007FF6729C2DA5
%s%02x%02x, xrefs: 00007FF6729C2E5E
DOH A: %u.%u.%u.%u, xrefs: 00007FF6729C2DDE
Could not DOH-resolve: %s, xrefs: 00007FF6729C2C36
AAAA, xrefs: 00007FF6729C2D36
DOH AAAA: , xrefs: 00007FF6729C2E12
DOH Host name: %s, xrefs: 00007FF6729C2D91
%s, xrefs: 00007FF6729C2EB3
DOH: %s type %s for %s, xrefs: 00007FF6729C2D44

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: calloc$_strdupfreehtonsmemset
String ID: %s$%s%02x%02x$AAAA$CNAME: %s$Could not DOH-resolve: %s$DOH A: %u.%u.%u.%u$DOH AAAA: $DOH Host name: %s$DOH: %s type %s for %s$TTL: %u seconds$bad error code
API String ID: 130798683-4053692942
Opcode ID: f0e7626ea890ef2b8ab4e43f107f6aa888679d89bf47c42e7902bd8be2fba08f
Instruction ID: 9547ddf1dcfd1ad8a41a8c888c28cfd097f28b06388b7d837420246d73697366
Opcode Fuzzy Hash: f0e7626ea890ef2b8ab4e43f107f6aa888679d89bf47c42e7902bd8be2fba08f
Instruction Fuzzy Hash: D3E19333A286868AEB60CF22E4403B97764FB84B9CF484235DA4D97756DFBCE544CB40

Function 00007FF672979918 Relevance: 35.4, APIs: 17, Strings: 3, Instructions: 423COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297A074
__std_exception_destroy.VCRUNTIME140 ref: 00007FF67297A0A2
__std_exception_destroy.VCRUNTIME140 ref: 00007FF67297A0B0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297A0EB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297A12A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297AB1E

Strings

object, xrefs: 00007FF67297A339
number overflow parsing ', xrefs: 00007FF672979FB0
array, xrefs: 00007FF67297A1AA

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: array$number overflow parsing '$object
API String ID: 1346393832-579821726
Opcode ID: 8f241ce969d7e7a2561a02d714add0442801e01a17d0d110784d24c95400e9c0
Instruction ID: 64b657372c6a47bf13fda524602933ccf24a3850368af40f05c1a22ac0ceda3f
Opcode Fuzzy Hash: 8f241ce969d7e7a2561a02d714add0442801e01a17d0d110784d24c95400e9c0
Instruction Fuzzy Hash: CA12B563B28B8686FB008B7AD4443AD3361FB457A8F545235DA6D92BDADFBCD081D700

Function 00007FF6729BDB40 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 257stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF6729BD2FF), ref: 00007FF6729BDBC6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF6729BD2FF), ref: 00007FF6729BDBEC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF6729BD2FF), ref: 00007FF6729BDBFD
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF6729BD2FF), ref: 00007FF6729BDC6B
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF6729BD2FF), ref: 00007FF6729BDC9C
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF6729BD2FF), ref: 00007FF6729BDCBC
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF6729BD2FF), ref: 00007FF6729BDCCE
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF6729BD2FF), ref: 00007FF6729BDD30
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF6729BD2FF), ref: 00007FF6729BDDA1
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF6729BD2FF), ref: 00007FF6729BDDB8
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF6729BD2FF), ref: 00007FF6729BDE73
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF6729BD2FF), ref: 00007FF6729BDEE7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF6729BD2FF), ref: 00007FF6729BDEF0

Strings

one, xrefs: 00007FF6729BDDD3
sub, xrefs: 00007FF6729BDE24
base, xrefs: 00007FF6729BDDF9
subtree, xrefs: 00007FF6729BDE37
onetree, xrefs: 00007FF6729BDDE6
LDAP, xrefs: 00007FF6729BDB86

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: strchr$free$_strdupcalloc
String ID: LDAP$base$one$onetree$sub$subtree
API String ID: 112326314-884163498
Opcode ID: b84309b16dae3d30e95ce5c9ba1baef686c3abbee5afad03e8c37bea81966266
Instruction ID: 12e3f69f93b2223d3c7a889fa130e96ba54fd643a92c4b7d02b53b95e4ea46a6
Opcode Fuzzy Hash: b84309b16dae3d30e95ce5c9ba1baef686c3abbee5afad03e8c37bea81966266
Instruction Fuzzy Hash: CEB19027A29B82C2EB51DB16944027927A0FF85B88F4C8135DE8D87796EFBCE455CB10

Function 00007FF6729BBD10 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 175stringCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140 ref: 00007FF6729BBD71
memchr.VCRUNTIME140 ref: 00007FF6729BBDA7
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6729BBE2B
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6729BBEBB

Strings

%s (%ld), xrefs: 00007FF6729BBECB
server requested blksize larger than allocated, xrefs: 00007FF6729BBF18
%s (%ld), xrefs: 00007FF6729BBF22
got option=(%s) value=(%s), xrefs: 00007FF6729BBDEC
Malformed ACK packet, rejecting, xrefs: 00007FF6729BBFAA
tsize parsed from OACK, xrefs: 00007FF6729BBEC4
invalid tsize -:%s:- value in OACK packet, xrefs: 00007FF6729BBF97
blksize, xrefs: 00007FF6729BBE0F
tsize, xrefs: 00007FF6729BBE9F
blksize is larger than max supported, xrefs: 00007FF6729BBF61
blksize is smaller than min supported, xrefs: 00007FF6729BBF3E
blksize parsed from OACK, xrefs: 00007FF6729BBE63
invalid blocksize value in OACK packet, xrefs: 00007FF6729BBF7E
%s (%d), xrefs: 00007FF6729BBF45, 00007FF6729BBF68
requested, xrefs: 00007FF6729BBE6A
%s (%d) %s (%d), xrefs: 00007FF6729BBE7D

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: memchrstrtol
String ID: %s (%d)$%s (%d) %s (%d)$%s (%ld)$%s (%ld)$Malformed ACK packet, rejecting$blksize$blksize is larger than max supported$blksize is smaller than min supported$blksize parsed from OACK$got option=(%s) value=(%s)$invalid blocksize value in OACK packet$invalid tsize -:%s:- value in OACK packet$requested$server requested blksize larger than allocated$tsize$tsize parsed from OACK
API String ID: 1626215102-895336422
Opcode ID: ea6ec9816968572db341cebdcb040f08a17af7e53987a05bbea11e0177727c8c
Instruction ID: 1cc07046b918f8c2780071ddd5819d4bc7c803821c149f1c9e06985491401ecb
Opcode Fuzzy Hash: ea6ec9816968572db341cebdcb040f08a17af7e53987a05bbea11e0177727c8c
Instruction Fuzzy Hash: FF610063B2864695FA10EB27E4242BD6350AF847A8F984631DE5DC76E3CEBCE145CF04

Function 00007FF6729A44B0 Relevance: 33.2, APIs: 6, Strings: 16, Instructions: 206COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A4627

Strings

Authorization, xrefs: 00007FF6729A466A
Authorization:, xrefs: 00007FF6729A4601
Proxy-, xrefs: 00007FF6729A4736
NTLM, xrefs: 00007FF6729A450C
Negotiate, xrefs: 00007FF6729A44EA
Proxy, xrefs: 00007FF6729A47D4
%s:%s, xrefs: 00007FF6729A46B9
Bearer, xrefs: 00007FF6729A4620
%s auth using %s with user '%s', xrefs: 00007FF6729A47C6
CONNECT, xrefs: 00007FF6729A44BE
Proxy-authorization, xrefs: 00007FF6729A4593
%sAuthorization: Basic %s, xrefs: 00007FF6729A4740
Basic, xrefs: 00007FF6729A4787
Server, xrefs: 00007FF6729A47BC
Authorization: Bearer %s, xrefs: 00007FF6729A4630
Digest, xrefs: 00007FF6729A452E

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: %s auth using %s with user '%s'$%s:%s$%sAuthorization: Basic %s$Authorization$Authorization:$Authorization: Bearer %s$Basic$Bearer$CONNECT$Digest$NTLM$Negotiate$Proxy$Proxy-$Proxy-authorization$Server
API String ID: 1294909896-115817326
Opcode ID: fd6a6f590ba3b9f76b173b9da0afe2d76329b0cebe41a92544a57b0f83bd53aa
Instruction ID: 11ba37e461c3cf38dc49d7d371cc23fca18eb19f047a3bc509125158cfc04c2a
Opcode Fuzzy Hash: fd6a6f590ba3b9f76b173b9da0afe2d76329b0cebe41a92544a57b0f83bd53aa
Instruction Fuzzy Hash: 50916F23E2DB9286FB508B16A4003B963B0FF45798F5C5135DA5C87697DFACE855CB00

Function 00007FF672976340 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 463COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF672974340: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF672971B79), ref: 00007FF672974371

memcpy.VCRUNTIME140 ref: 00007FF6729764B6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF672976548
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF672976589
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729766D3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672976712
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672976760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729767A1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729767FE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729768B8

Part of subcall function 00007FF6729CF220: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF67297441E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF672971B79), ref: 00007FF6729CF23A

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729768F9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729769C6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672976A07
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF672976A2A

Strings

unexpected , xrefs: 00007FF672976843
rsing , xrefs: 00007FF672976498
; expected , xrefs: 00007FF672976950
; last read: ', xrefs: 00007FF67297660C
syntax error , xrefs: 00007FF67297638D

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$Concurrency::cancel_current_taskmalloc
String ID: ; expected $; last read: '$rsing $syntax error $unexpected
API String ID: 264867259-3075834232
Opcode ID: 0634fe5d6185bdcaaf29ebc1e3ad1ea41f49e3ffe33e675177ad46c51168a3fa
Instruction ID: 7dc7bf4b18148ec46dcbd7d6308a93c22edd25f616943f0c6570ac23fb3972aa
Opcode Fuzzy Hash: 0634fe5d6185bdcaaf29ebc1e3ad1ea41f49e3ffe33e675177ad46c51168a3fa
Instruction Fuzzy Hash: 2F12D463E28A4285FB148B66E50036D2361EB847ECF185335DA6D937DADFBCE084DB00

Function 00007FF6729BE270 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 214stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729BE280
strstr.VCRUNTIME140 ref: 00007FF6729BE2AF
strchr.VCRUNTIME140 ref: 00007FF6729BE2DB
strrchr.VCRUNTIME140 ref: 00007FF6729BE2F5
strchr.VCRUNTIME140 ref: 00007FF6729BE30A
strrchr.VCRUNTIME140 ref: 00007FF6729BE36A

Strings

/, xrefs: 00007FF6729BE2C5
/, xrefs: 00007FF6729BE33E
., xrefs: 00007FF6729BE34A
/, xrefs: 00007FF6729BE383
?, xrefs: 00007FF6729BE2E8

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: strchrstrrchr$_strdupstrstr
String ID: .$/$/$/$?
API String ID: 2325335452-1821401756
Opcode ID: 2284dae3748b343e103639d28157e9229f46ab4921bb2383cf6124227c587528
Instruction ID: 23dfa8bdafe179296588bde61b14cba636e91c407dd62ff6229829207c0dd46f
Opcode Fuzzy Hash: 2284dae3748b343e103639d28157e9229f46ab4921bb2383cf6124227c587528
Instruction Fuzzy Hash: B981AF13A2D2C685FB658B2395003796A9AAF45B8CF8C4035DECD863C7EEBCA4459B11

Function 00007FF6729B9170 Relevance: 31.7, APIs: 9, Strings: 12, Instructions: 208stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF6729B9243
strchr.VCRUNTIME140 ref: 00007FF6729B929A
strchr.VCRUNTIME140 ref: 00007FF6729B92B2
strchr.VCRUNTIME140 ref: 00007FF6729B92CD
strchr.VCRUNTIME140 ref: 00007FF6729B9349
strchr.VCRUNTIME140 ref: 00007FF6729B9361
strchr.VCRUNTIME140 ref: 00007FF6729B937C
strchr.VCRUNTIME140 ref: 00007FF6729B9397
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B9424

Strings

/LOOKUP:, xrefs: 00007FF6729B922D
/D:, xrefs: 00007FF6729B9216
/DEFINE:, xrefs: 00007FF6729B91FB
Failed sending DICT request, xrefs: 00007FF6729B9431
/MATCH:, xrefs: 00007FF6729B91AA
/FIND:, xrefs: 00007FF6729B91E0
CLIENT libcurl 7.70.0%sQUIT, xrefs: 00007FF6729B927A
/M:, xrefs: 00007FF6729B91C5
CLIENT libcurl 7.70.0MATCH %s %s %sQUIT, xrefs: 00007FF6729B9405
lookup word is missing, xrefs: 00007FF6729B92E4, 00007FF6729B93AE
default, xrefs: 00007FF6729B92F3, 00007FF6729B93BD
CLIENT libcurl 7.70.0DEFINE %s %sQUIT, xrefs: 00007FF6729B932A

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: strchr$free
String ID: /D:$/DEFINE:$/FIND:$/LOOKUP:$/M:$/MATCH:$CLIENT libcurl 7.70.0%sQUIT$CLIENT libcurl 7.70.0DEFINE %s %sQUIT$CLIENT libcurl 7.70.0MATCH %s %s %sQUIT$Failed sending DICT request$default$lookup word is missing
API String ID: 3578582447-31095704
Opcode ID: 7979e9260d8f6ae97095ef7ad274fa747478fcc8311dfd9fa4e9728ae142e31c
Instruction ID: 00e596a75f22cecd2b31be306755d5963058c53e82d5e1a67bccdf365dd8e83b
Opcode Fuzzy Hash: 7979e9260d8f6ae97095ef7ad274fa747478fcc8311dfd9fa4e9728ae142e31c
Instruction Fuzzy Hash: E281AC23A3D68695FB519B1395513B96281AF45BCCF9C8031DA8D87787EEACEA01CE10

Function 00007FF6729951A0 Relevance: 30.1, APIs: 24, Instructions: 137COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729951BC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729951D2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729951E6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729951F3

Part of subcall function 00007FF67298F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672992886), ref: 00007FF67298F091
Part of subcall function 00007FF67298F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672992886), ref: 00007FF67298F0A1
Part of subcall function 00007FF67298F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672992886), ref: 00007FF67298F0AF
Part of subcall function 00007FF67298F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672992886), ref: 00007FF67298F0BD
Part of subcall function 00007FF67298F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672992886), ref: 00007FF67298F0CB
Part of subcall function 00007FF67298F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672992886), ref: 00007FF67298F0D9
Part of subcall function 00007FF67298F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672992886), ref: 00007FF67298F0E7
Part of subcall function 00007FF67298F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672992886), ref: 00007FF67298F0F5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299522F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672995243
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672995296
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729952AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729952BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729952D2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299533A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299534E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672995362
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672995376
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729953DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299541A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299542E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672995442
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672995456
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299546A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299547E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672995492
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729954A6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729954C8

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1a51e7440e4e295c9a9ff19624615fac48ce2bced439325f57758b62f034ad1e
Instruction ID: 28c126735b80f51156598d0854e8bb3197a7f44ea332fb1839dd87ffb224c8a7
Opcode Fuzzy Hash: 1a51e7440e4e295c9a9ff19624615fac48ce2bced439325f57758b62f034ad1e
Instruction Fuzzy Hash: 1F91A237A28BC1D7E749CF21D9902A87368FB49F59F080235EF9D87265CF74A2A58710

Function 00007FF67299E600 Relevance: 30.1, APIs: 7, Strings: 10, Instructions: 312stringCOMMON

Download Yara Rule

APIs

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67299E6F5
strchr.VCRUNTIME140 ref: 00007FF67299E795
memcpy.VCRUNTIME140 ref: 00007FF67299E7C5
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF67299E7F1
strchr.VCRUNTIME140 ref: 00007FF67299E83C
memcpy.VCRUNTIME140 ref: 00007FF67299E89B

Part of subcall function 00007FF67298AB50: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF67298AB94

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67299E9B4

Strings

Couldn't parse CURLOPT_RESOLVE entry '%s'!, xrefs: 00007FF67299E92A
%255[^:]:%d, xrefs: 00007FF67299E681
RESOLVE %s:%d is - old addresses discarded!, xrefs: 00007FF67299EA3B
RESOLVE %s:%d is wildcard, enabling wildcard checks, xrefs: 00007FF67299EADE
], xrefs: 00007FF67299E875
Resolve address '%s' found illegal!, xrefs: 00007FF67299E91B
Couldn't parse CURLOPT_RESOLVE removal entry '%s'!, xrefs: 00007FF67299E697
:%u, xrefs: 00007FF67299E709, 00007FF67299E9C8
@, xrefs: 00007FF67299E886
Added %s:%d:%s to DNS cache, xrefs: 00007FF67299EAAD

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: memcpystrchrtolower$__stdio_common_vsscanfstrtoul
String ID: %255[^:]:%d$:%u$@$Added %s:%d:%s to DNS cache$Couldn't parse CURLOPT_RESOLVE entry '%s'!$Couldn't parse CURLOPT_RESOLVE removal entry '%s'!$RESOLVE %s:%d is - old addresses discarded!$RESOLVE %s:%d is wildcard, enabling wildcard checks$Resolve address '%s' found illegal!$]
API String ID: 1094891576-1753329177
Opcode ID: cd896446f913934da4a0315a097b3cf1fd3ba11ec05cb9612f91d296c3e1b97d
Instruction ID: d22ae614e3ca1d2241656a4ad16b2d5969a267e4c4127be655cc4eaa776bfc00
Opcode Fuzzy Hash: cd896446f913934da4a0315a097b3cf1fd3ba11ec05cb9612f91d296c3e1b97d
Instruction Fuzzy Hash: 90D17F23A2D6C689EB618B22D4103B92760FB857ACF5C5132DA9D976C6DEBCE411CB40

Function 00007FF6729B39E0 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 284stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B3A2D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729B3B1F
strchr.VCRUNTIME140 ref: 00007FF6729B3A61

Part of subcall function 00007FF67298AB50: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF67298AB94

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729B3C87
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B3E51
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729B3E73

Part of subcall function 00007FF67299EF10: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299EF4E

Strings

Skip %u.%u.%u.%u for data connection, re-use %s instead, xrefs: 00007FF6729B3C5B
Bad PASV/EPSV response: %03d, xrefs: 00007FF6729B3E9E
Connecting to %s (%s) port %d, xrefs: 00007FF6729B3E2A
Weirdly formatted EPSV reply, xrefs: 00007FF6729B3B3F
%u.%u.%u.%u, xrefs: 00007FF6729B3C93
Couldn't interpret the 227-response, xrefs: 00007FF6729B3BCE
%u,%u,%u,%u,%u,%u, xrefs: 00007FF6729B3BAB
Can't resolve new host %s:%hu, xrefs: 00007FF6729B3D9E
%c%c%c%u%c, xrefs: 00007FF6729B3A9B
Can't resolve proxy host %s:%hu, xrefs: 00007FF6729B3D33
Illegal port number in EPSV reply, xrefs: 00007FF6729B3ADF

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdupfree$__stdio_common_vsscanfstrchr
String ID: %c%c%c%u%c$%u,%u,%u,%u,%u,%u$%u.%u.%u.%u$Bad PASV/EPSV response: %03d$Can't resolve new host %s:%hu$Can't resolve proxy host %s:%hu$Connecting to %s (%s) port %d$Couldn't interpret the 227-response$Illegal port number in EPSV reply$Skip %u.%u.%u.%u for data connection, re-use %s instead$Weirdly formatted EPSV reply
API String ID: 3103143820-2414412286
Opcode ID: f247440655668cabf6ec7b0e28eb19d9d8c255d968504d8ee9b24d82d72750b5
Instruction ID: 26b7e73197c641c48400f2becbcbdc3fba1640fae27e5ddf678c0c0faa95bdd6
Opcode Fuzzy Hash: f247440655668cabf6ec7b0e28eb19d9d8c255d968504d8ee9b24d82d72750b5
Instruction Fuzzy Hash: C9D1B723A1C682D6EB24DB26D5402B9B3A1FF85798F580036DB4D83B56DFBCE564CB04

Function 00007FF672994270 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 219COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672994592

Strings

Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support., xrefs: 00007FF6729943D4
http, xrefs: 00007FF67299438E
socks5, xrefs: 00007FF672994330
https, xrefs: 00007FF6729942F4
socks, xrefs: 00007FF67299437A
socks5h, xrefs: 00007FF672994312
socks4a, xrefs: 00007FF67299434B
socks4, xrefs: 00007FF672994366
Unsupported proxy scheme for '%s', xrefs: 00007FF6729943A1
Unsupported proxy syntax in '%s', xrefs: 00007FF67299457A

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support.$Unsupported proxy scheme for '%s'$Unsupported proxy syntax in '%s'$http$https$socks$socks4$socks4a$socks5$socks5h
API String ID: 1294909896-874090715
Opcode ID: 487d783a96d1e4630c0920c9b124cd6da701f5b1fa2d70bc6843ba75a4713cb7
Instruction ID: 38c417ebbe19eae269542b2f906a4806916b05d287d0ea0b6b3b95567289fb24
Opcode Fuzzy Hash: 487d783a96d1e4630c0920c9b124cd6da701f5b1fa2d70bc6843ba75a4713cb7
Instruction Fuzzy Hash: 31A1AD33E2864289FB11DB63E8406BD37A4BB847A8F485531DE8D97796DFB8E414CB40

Function 00007FF67298A3D0 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6729910E9,?,?,00000000,00007FF672991625), ref: 00007FF67298A433
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6729910E9,?,?,00000000,00007FF672991625), ref: 00007FF67298A4AD
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6729910E9,?,?,00000000,00007FF672991625), ref: 00007FF67298A4D1
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6729910E9,?,?,00000000,00007FF672991625), ref: 00007FF67298A520
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6729910E9,?,?,00000000,00007FF672991625), ref: 00007FF67298A55A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6729910E9,?,?,00000000,00007FF672991625), ref: 00007FF67298A56C
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6729910E9,?,?,00000000,00007FF672991625), ref: 00007FF67298A57F
_unlink.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6729910E9,?,?,00000000,00007FF672991625), ref: 00007FF67298A59A
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6729910E9,?,?,00000000,00007FF672991625), ref: 00007FF67298A5B0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6729910E9,?,?,00000000,00007FF672991625), ref: 00007FF67298A5B9

Strings

# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk., xrefs: 00007FF67298A4A6
%s, xrefs: 00007FF67298A54B
%s.%s.tmp, xrefs: 00007FF67298A46A
## Fatal libcurl error, xrefs: 00007FF67298A5E7

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$fclose$__acrt_iob_func_unlinkcallocfputsqsort
String ID: ## Fatal libcurl error$# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.$%s$%s.%s.tmp
API String ID: 1368378007-4087121635
Opcode ID: 9a475ded2f6528280dbc7a2589dbf427c50b43f49b50cf7615e192bfb41c9b03
Instruction ID: ad84b7621b589a6b1c94e768081cd5a7e43c0bbb69aa352b42ea5772ee08984a
Opcode Fuzzy Hash: 9a475ded2f6528280dbc7a2589dbf427c50b43f49b50cf7615e192bfb41c9b03
Instruction Fuzzy Hash: 9C518063F3D64285FE649B23A81427A63A0BF45BCDF4C4431CD4EC67A2EEBCE4459A00

Function 00007FF6729A6470 Relevance: 27.3, APIs: 1, Strings: 17, Instructions: 341COMMON

Download Yara Rule

Strings

SOCKS4 reply has wrong version, version should be 0., xrefs: 00007FF6729A6911
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids., xrefs: 00007FF6729A69A3
SOCKS4: Failed receiving connect request ack: %s, xrefs: 00007FF6729A68CA
SOCKS4%s: connecting to HTTP proxy %s port %d, xrefs: 00007FF6729A6536
[, xrefs: 00007FF6729A6A04
SOCKS4%s request granted., xrefs: 00007FF6729A6A36
SOCKS4 connection to %s not supported, xrefs: 00007FF6729A673C
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed., xrefs: 00007FF6729A6A14
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client., xrefs: 00007FF6729A69DD
Failed to resolve "%s" for SOCKS4 connect., xrefs: 00007FF6729A675B
SOCKS4: too long host name, xrefs: 00007FF6729A6836
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown., xrefs: 00007FF6729A6976
Failed to send SOCKS4 connect request., xrefs: 00007FF6729A681D
SOCKS4 connect to IPv4 %s (locally resolved), xrefs: 00007FF6729A66DA
Too long SOCKS proxy name, can't use!, xrefs: 00007FF6729A6637
SOCKS4 communication to %s:%d, xrefs: 00007FF6729A654F
SOCKS4 non-blocking resolve of %s, xrefs: 00007FF6729A65DB

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID:
String ID: Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.$Failed to resolve "%s" for SOCKS4 connect.$Failed to send SOCKS4 connect request.$SOCKS4 communication to %s:%d$SOCKS4 connect to IPv4 %s (locally resolved)$SOCKS4 connection to %s not supported$SOCKS4 non-blocking resolve of %s$SOCKS4 reply has wrong version, version should be 0.$SOCKS4%s request granted.$SOCKS4%s: connecting to HTTP proxy %s port %d$SOCKS4: Failed receiving connect request ack: %s$SOCKS4: too long host name$Too long SOCKS proxy name, can't use!$[
API String ID: 0-3760664348
Opcode ID: b825a17788fdad71866711f133a602818987d43fd1e449d2600b90b65f199960
Instruction ID: 5f0e44f067d871b8b05ce1f5398af67dc21e5a1fb2e57c73dc4d1e06526a6ddc
Opcode Fuzzy Hash: b825a17788fdad71866711f133a602818987d43fd1e449d2600b90b65f199960
Instruction Fuzzy Hash: EFE1A063D2C7818AEB548F16D0403B977A0EB85798F5C813ADA9D87796CFBCE054CB10

Function 00007FF6729754A0 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 364COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729755FE
__std_exception_destroy.VCRUNTIME140 ref: 00007FF67297562C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF67297563A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672975674
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729756C5
memset.VCRUNTIME140 ref: 00007FF6729754F3

Part of subcall function 00007FF672974340: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF672971B79), ref: 00007FF672974371

Part of subcall function 00007FF672976340: memcpy.VCRUNTIME140 ref: 00007FF6729764B6

Part of subcall function 00007FF672971FE0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672972151

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672975832
__std_exception_destroy.VCRUNTIME140 ref: 00007FF67297585E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF67297586C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729758A7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729758FA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729759E1
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF6729759F9
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF672975A06

Strings

value, xrefs: 00007FF672975566, 00007FF67297579E

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy$?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@U?$char_traits@memset
String ID: value
API String ID: 2102519606-494360628
Opcode ID: 3c521106999654edccb803f0085ffad8a7644ab3a63695003f190d1da085dee7
Instruction ID: bf61bfe46845de9db760c63121568bef319e328891fcc5ba9cbd75519fec8213
Opcode Fuzzy Hash: 3c521106999654edccb803f0085ffad8a7644ab3a63695003f190d1da085dee7
Instruction Fuzzy Hash: 6CF1CA23A2868195FB10CB75D4443AD7760EB857ACF585331EAAD42BEADFBCD185CB00

Function 00007FF6729AB210 Relevance: 26.5, APIs: 4, Strings: 11, Instructions: 241encryptionCOMMON

Download Yara Rule

APIs

CertEnumCertificatesInStore.CRYPT32 ref: 00007FF6729AB4F7
CertEnumCertificatesInStore.CRYPT32 ref: 00007FF6729AB567
CertFreeCertificateContext.CRYPT32 ref: 00007FF6729AB5A5
CertFreeCertificateContext.CRYPT32 ref: 00007FF6729AB5B8

Strings

schannel: failed to setup confidentiality, xrefs: 00007FF6729AB2A2
schannel: failed to setup stream orientation, xrefs: 00007FF6729AB2E0
http/1.1, xrefs: 00007FF6729AB36B
schannel: failed to retrieve remote cert context, xrefs: 00007FF6729AB5D7
schannel: failed to setup sequence detection, xrefs: 00007FF6729AB26A
schannel: failed to retrieve ALPN result, xrefs: 00007FF6729AB32B
schannel: failed to setup memory allocation, xrefs: 00007FF6729AB2C1
ALPN, server did not agree to a protocol, xrefs: 00007FF6729AB385
schannel: failed to store credential handle, xrefs: 00007FF6729AB45C
schannel: failed to setup replay detection, xrefs: 00007FF6729AB286
schannel: ALPN, server accepted to use %.*s, xrefs: 00007FF6729AB358

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: Cert$CertificateCertificatesContextEnumFreeStore
String ID: ALPN, server did not agree to a protocol$http/1.1$schannel: ALPN, server accepted to use %.*s$schannel: failed to retrieve ALPN result$schannel: failed to retrieve remote cert context$schannel: failed to setup confidentiality$schannel: failed to setup memory allocation$schannel: failed to setup replay detection$schannel: failed to setup sequence detection$schannel: failed to setup stream orientation$schannel: failed to store credential handle
API String ID: 2572311694-3353508759
Opcode ID: 4b971829e254e2b4d94d743c89b437f06f1d7d8664499aa41a7e1b28bf0555e2
Instruction ID: b4b57feb2ac3d3975503201e61e10ac48de6d990fab1a5d7f05f6d25b29472ab
Opcode Fuzzy Hash: 4b971829e254e2b4d94d743c89b437f06f1d7d8664499aa41a7e1b28bf0555e2
Instruction Fuzzy Hash: 66B19263E28B8285EB609B17D8603BA63A1FB94B9CF8C5131D94DC7696DFBCD445CB00

Function 00007FF6729A1A30 Relevance: 26.5, APIs: 6, Strings: 9, Instructions: 218stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF6729A1AE8
strchr.VCRUNTIME140 ref: 00007FF6729A1AFF
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729A1B4B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A1D17
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A1D66
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A1D6F

Strings

Cookie:, xrefs: 00007FF6729A1CBB
Transfer-Encoding:, xrefs: 00007FF6729A1C88
Authorization:, xrefs: 00007FF6729A1CA1
Content-Type:, xrefs: 00007FF6729A1BEF, 00007FF6729A1C15
Host:, xrefs: 00007FF6729A1BC9
Connection:, xrefs: 00007FF6729A1C61
1.1, xrefs: 00007FF6729A1A4B
Content-Length:, xrefs: 00007FF6729A1C3B
%s, xrefs: 00007FF6729A1CFC

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$strchr$_strdup
String ID: %s$1.1$Authorization:$Connection:$Content-Length:$Content-Type:$Cookie:$Host:$Transfer-Encoding:
API String ID: 1922034842-2519073162
Opcode ID: 5b14193b18b1b3fc1d3f272b21cebfe4fce381e81d118df4099abe4e1669195a
Instruction ID: 6e1bdf5511889f7a266dcdde73342f0ce622861907e8887d8273b64f9972ea4a
Opcode Fuzzy Hash: 5b14193b18b1b3fc1d3f272b21cebfe4fce381e81d118df4099abe4e1669195a
Instruction Fuzzy Hash: BF919F23E2978285FB61CA1794043B967A4AF45BCCF5C6035CE4ECA697EEADE540CB00

Function 00007FF67298F500 Relevance: 25.7, APIs: 17, Instructions: 236COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67298F564
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67298F598
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298F5A9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298F67F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298F68C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298F6C7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298F6D1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67298F74F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67298F770
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67298F791
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67298F7B2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298F849
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298F852

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$_strdup
String ID:
API String ID: 2653869212-0
Opcode ID: 9380430da2d47361279ed07955a7a1d3f2428018cb9ebdc78f4957e134170792
Instruction ID: 7db32a6af2619570ff7d4be125c685f10b596beb6b62fe78c2736aa721ccb245
Opcode Fuzzy Hash: 9380430da2d47361279ed07955a7a1d3f2428018cb9ebdc78f4957e134170792
Instruction Fuzzy Hash: 8BB14B33A1AB8186EB65CF66E54027973A0FB54B58F9C1135CB8E83B51EF7CE4648B00

Function 00007FF6729C7C31 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 165COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C7C62
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C8129
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C8169
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C817C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C82DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C8318

Strings

Signature, xrefs: 00007FF6729C80FF
-----BEGIN CERTIFICATE-----, xrefs: 00007FF6729C81BC
-----END CERTIFICATE-----, xrefs: 00007FF6729C8267
Signature: %s, xrefs: 00007FF6729C8117
%s, xrefs: 00007FF6729C8306
TRUE, xrefs: 00007FF6729C7C54
Cert, xrefs: 00007FF6729C82EE
FALSE, xrefs: 00007FF6729C7C4D

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Signature: %s$%s$-----BEGIN CERTIFICATE-----$-----END CERTIFICATE-----$Cert$FALSE$Signature$TRUE
API String ID: 111713529-3006446216
Opcode ID: 02abba850a0345260d715ce6a239b115f8926d698564452907b891d2d2d54c04
Instruction ID: 2460b5039f6cd4d7a47104b8681c76a8822be221220f477e110936d23e3c5ddd
Opcode Fuzzy Hash: 02abba850a0345260d715ce6a239b115f8926d698564452907b891d2d2d54c04
Instruction Fuzzy Hash: 9C71C767E1D6C195FB128B3694042B9BBA0FB45B8CF5C4532CA8D93367DEACD585CB00

Function 00007FF6729C1CA0 Relevance: 24.2, APIs: 14, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C1D62
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C1D9A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C1DAD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C1DE1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C1DEC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C1EA2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C1EAB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C1EB6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C1FA1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C1FAA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C1FB5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C202B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C2034
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C203F

Part of subcall function 00007FF6729C2430: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729C431A,?,?,00000000,00007FF6729C0D55), ref: 00007FF6729C2440
Part of subcall function 00007FF6729C2430: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729C431A,?,?,00000000,00007FF6729C0D55), ref: 00007FF6729C2451
Part of subcall function 00007FF6729C2430: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729C431A,?,?,00000000,00007FF6729C0D55), ref: 00007FF6729C2463

Strings

DIGEST-MD5 handshake failure (empty challenge message), xrefs: 00007FF6729C204C
WDigest, xrefs: 00007FF6729C1D4C, 00007FF6729C1E64

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$malloc
String ID: DIGEST-MD5 handshake failure (empty challenge message)$WDigest
API String ID: 2190258309-1086287758
Opcode ID: b2ff5eccef6c7242e6bfc742c5f45018369fa37ea9bd22011d40722926cede23
Instruction ID: d33c8d577f16b40327ae43a32a2bbc627e1c1ddb476abcee0c0f9f6512816302
Opcode Fuzzy Hash: b2ff5eccef6c7242e6bfc742c5f45018369fa37ea9bd22011d40722926cede23
Instruction Fuzzy Hash: 17B14273A18B86C6EB10CB66E8402AD77A0FB48B98F481135DE4D87B65DFBCD585CB40

Function 00007FF6729C89F5 Relevance: 24.2, APIs: 1, Strings: 15, Instructions: 178COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C8B03

Strings

RSA Public Key, xrefs: 00007FF6729C8AEF
rsaEncryption, xrefs: 00007FF6729C8A35
dh(g), xrefs: 00007FF6729C8C90
RSA Public Key (%lu bits), xrefs: 00007FF6729C8ABE
dsa(pub_key), xrefs: 00007FF6729C8C12
dsa(p), xrefs: 00007FF6729C8B9D
rsa(e), xrefs: 00007FF6729C8B3B
rsa(n), xrefs: 00007FF6729C8B10
dsa(g), xrefs: 00007FF6729C8BFC
%lu, xrefs: 00007FF6729C8AD8
dsa(q), xrefs: 00007FF6729C8BCC
dhpublicnumber, xrefs: 00007FF6729C8C26
dh(p), xrefs: 00007FF6729C8C5F
dsa, xrefs: 00007FF6729C8B65
dh(pub_key), xrefs: 00007FF6729C8CA6

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: RSA Public Key (%lu bits)$%lu$RSA Public Key$dh(g)$dh(p)$dh(pub_key)$dhpublicnumber$dsa$dsa(g)$dsa(p)$dsa(pub_key)$dsa(q)$rsa(e)$rsa(n)$rsaEncryption
API String ID: 1294909896-1220118048
Opcode ID: b4de5ed57bb57669b67f7af2eaede6024d4230c24242518587f8c807ac82773d
Instruction ID: 6b8e3cafaad986bbef1714fe5d8087830c689ee9384ae28f8059529029633332
Opcode Fuzzy Hash: b4de5ed57bb57669b67f7af2eaede6024d4230c24242518587f8c807ac82773d
Instruction Fuzzy Hash: FA717F63A1D78641EE159B2395401F9A350FF84B88F5C4636DE8D8378BEE7CE541CA40

Function 00007FF6729A88E0 Relevance: 22.7, APIs: 15, Instructions: 160COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00000000,?,00007FF6729A8B96), ref: 00007FF6729A88FB
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729A891B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A893C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A8945

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$_strdupmalloc
String ID:
API String ID: 111713529-0
Opcode ID: 24a113ce95a812e312ab05967f779217229c1f4643dcbc9ea1e24fda7f206e02
Instruction ID: f895c96e06f25f516f3664d9e986496b90f409eaf679cbd81a66bb4acc6ef4b2
Opcode Fuzzy Hash: 24a113ce95a812e312ab05967f779217229c1f4643dcbc9ea1e24fda7f206e02
Instruction Fuzzy Hash: 32616C77A25B41C2EB25CF56E444169B3A4FB88B99F094535CE4E83B61EFBCE494CB00

Function 00007FF6729B1A00 Relevance: 21.3, APIs: 5, Strings: 9, Instructions: 279COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B1B20

Strings

Received only partial file: %I64d bytes, xrefs: 00007FF6729B1E2E
Remembering we are in dir "%s", xrefs: 00007FF6729B1BB8
Failure sending ABOR command: %s, xrefs: 00007FF6729B1C41
control connection looks dead, xrefs: 00007FF6729B1D12
No data was received!, xrefs: 00007FF6729B1E5C
server did not report OK, got %d, xrefs: 00007FF6729B1D8E
ABOR, xrefs: 00007FF6729B1C1B
Uploaded unaligned file size (%I64d out of %I64d bytes), xrefs: 00007FF6729B1DF6
partial download completed, closing connection, xrefs: 00007FF6729B1D53

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: ABOR$Failure sending ABOR command: %s$No data was received!$Received only partial file: %I64d bytes$Remembering we are in dir "%s"$Uploaded unaligned file size (%I64d out of %I64d bytes)$control connection looks dead$partial download completed, closing connection$server did not report OK, got %d
API String ID: 1294909896-2312071747
Opcode ID: d3566684f7d95327d9952a739720b24db241f121ff0e772a393bdc290ca6bce6
Instruction ID: c535bce8ad1fb4709aeede41369ecf569c124fd11207db2854f5b65e2e7d5fd5
Opcode Fuzzy Hash: d3566684f7d95327d9952a739720b24db241f121ff0e772a393bdc290ca6bce6
Instruction Fuzzy Hash: D4D1B623A2C786C6FA64DB2695403B97352FB417A8F481235CAAD872D7DFFCB4548B01

Function 00007FF67297A7D2 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF672974340: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF672971B79), ref: 00007FF672974371

Part of subcall function 00007FF672976340: memcpy.VCRUNTIME140 ref: 00007FF6729764B6

Part of subcall function 00007FF672971FE0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672972151

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297A881
__std_exception_destroy.VCRUNTIME140 ref: 00007FF67297A8AF
__std_exception_destroy.VCRUNTIME140 ref: 00007FF67297A8BD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297A8F7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297A954
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297AA0D
__std_exception_destroy.VCRUNTIME140 ref: 00007FF67297AA3B
__std_exception_destroy.VCRUNTIME140 ref: 00007FF67297AA49
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297AA83
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297AAD4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297AB1E

Strings

value, xrefs: 00007FF67297A7F0, 00007FF67297A979

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy
String ID: value
API String ID: 3212548336-494360628
Opcode ID: 7056b0f1c721280fb284e5e7ae5969341d642bf2f36c784024ac4ab3cc5f1426
Instruction ID: 804c895499541ca5dd632d1930be696d76473bd8086d7ef2cbf1315501f21863
Opcode Fuzzy Hash: 7056b0f1c721280fb284e5e7ae5969341d642bf2f36c784024ac4ab3cc5f1426
Instruction Fuzzy Hash: 28A19463B28A4286FB008B79E5443AD3361FB417B8F541335DA6D42AEADFBCD081DB40

Function 00007FF672982530 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 88stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF672982552
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67298255A
__sys_nerr.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672982579
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672982585
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF672982594
strrchr.VCRUNTIME140 ref: 00007FF6729825E5
strrchr.VCRUNTIME140 ref: 00007FF672982606
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67298261F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67298262A
GetLastError.KERNEL32 ref: 00007FF672982633
SetLastError.KERNEL32 ref: 00007FF67298263F

Strings

Unknown error %d (%#x), xrefs: 00007FF6729825C7

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: ErrorLast_errno$strrchr$__sys_nerrstrerrorstrncpy
String ID: Unknown error %d (%#x)
API String ID: 4262108436-2414550090
Opcode ID: 6f7dd274e679bca5782eaaf641e77cf90ddbb36aedc1ee2566df042437650c49
Instruction ID: e514fbcdde1b82bbb5ca8a087f2694b1c1d66f3eb87e060e3a91942f65850734
Opcode Fuzzy Hash: 6f7dd274e679bca5782eaaf641e77cf90ddbb36aedc1ee2566df042437650c49
Instruction Fuzzy Hash: 37317327E2878287EB155F63A8202BD7291AF84F88F5C0035DE4E87797DEBCE4419B00

Function 00007FF6729C4960 Relevance: 19.8, APIs: 8, Strings: 5, Instructions: 266COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C49D5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C49F6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C4A11
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C4A1F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C4AA6
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C4AF5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C4B56
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C4CDC

Strings

CompleteAuthToken failed: %s, xrefs: 00007FF6729C4D37
SPNEGO handshake failure (empty challenge message), xrefs: 00007FF6729C4BA6
InitializeSecurityContext failed: %s, xrefs: 00007FF6729C4CFA
Negotiate, xrefs: 00007FF6729C4964, 00007FF6729C4A6C, 00007FF6729C4B13
HTTP, xrefs: 00007FF6729C4960

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$calloc$malloc
String ID: CompleteAuthToken failed: %s$HTTP$InitializeSecurityContext failed: %s$Negotiate$SPNEGO handshake failure (empty challenge message)
API String ID: 3103867982-1477229593
Opcode ID: e52b0c64f2e82feddbdf262b1f03a03451ee8f80b35f158c7f5a815ad507c03c
Instruction ID: 007dd8909c70735878dfce04e3a9c6a7fb461b260cfb5f2f0090ce1245f08722
Opcode Fuzzy Hash: e52b0c64f2e82feddbdf262b1f03a03451ee8f80b35f158c7f5a815ad507c03c
Instruction Fuzzy Hash: 29C14977A24B4186EB10DF66E8402AD77A5FB48F88F080136DE4D87759DFB8E885CB40

Function 00007FF6729C6840 Relevance: 19.7, APIs: 5, Strings: 8, Instructions: 165COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C68F3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C6959
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C697C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C69DC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C6A4C

Strings

Issuer: %s, xrefs: 00007FF6729C69CA
Issuer, xrefs: 00007FF6729C69B0
%lx, xrefs: 00007FF6729C6A1C
%2d Subject: %s, xrefs: 00007FF6729C6944
Version: %lu (0x%lx), xrefs: 00007FF6729C6A5E
Version, xrefs: 00007FF6729C6A37
Subject, xrefs: 00007FF6729C692A
TRUE, xrefs: 00007FF6729C6AB1

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$malloc
String ID: Issuer: %s$ Version: %lu (0x%lx)$%2d Subject: %s$%lx$Issuer$Subject$TRUE$Version
API String ID: 2190258309-1457932261
Opcode ID: 3da65c213a6298ad8ccfb1e77edb3e95b4b88f223e27cf3c19b71073ad107e6d
Instruction ID: ef21d34877802133673365b532e641ff06abb80d91bc7e66ad85b39b394c2baa
Opcode Fuzzy Hash: 3da65c213a6298ad8ccfb1e77edb3e95b4b88f223e27cf3c19b71073ad107e6d
Instruction Fuzzy Hash: EE61A363A2878295EB168B22A4043FA7391BB45B9CF4C0635CD5D87797EFBCE185CB00

Function 00007FF6729BC5D3 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 290COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BC6D3

Strings

tsize, xrefs: 00007FF6729BC7E2
TFTP file name too long, xrefs: 00007FF6729BC6BF
%s%c%s%c, xrefs: 00007FF6729BC6EA
%I64d, xrefs: 00007FF6729BC766
timeout, xrefs: 00007FF6729BC995
TFTP buffer too small for options, xrefs: 00007FF6729BC7CF, 00007FF6729BC918
blksize, xrefs: 00007FF6729BC8A8

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: %I64d$%s%c%s%c$TFTP buffer too small for options$TFTP file name too long$blksize$timeout$tsize
API String ID: 1294909896-3837278924
Opcode ID: aeb7ba6e34b5f7e575e9dd94b3d6c8ca483cf51f8455fa305e94a52ecd4c2104
Instruction ID: c2886d7e8edfd07f34d2f9f0c2eb0e1606988351c4e46b769e33bee21bcf4efe
Opcode Fuzzy Hash: aeb7ba6e34b5f7e575e9dd94b3d6c8ca483cf51f8455fa305e94a52ecd4c2104
Instruction Fuzzy Hash: A8D19263A18A86D9EB11CF26D0403B977A1FB85B9CF888132CA4D87786DFBCD545CB10

Function 00007FF6729BA880 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 180networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF6729BAA7C
WSAGetLastError.WS2_32 ref: 00007FF6729BAA8E
send.WS2_32 ref: 00007FF6729BAB86
WSAGetLastError.WS2_32 ref: 00007FF6729BAB90

Strings

%127[^,],%127s, xrefs: 00007FF6729BA9E8
%c%c%c%c, xrefs: 00007FF6729BA95D
%c%c, xrefs: 00007FF6729BAA58
%c%c%c%c%s%c%c, xrefs: 00007FF6729BAB5F
#, xrefs: 00007FF6729BAAFE
%c%s%c%s, xrefs: 00007FF6729BAA20
Sending data failed (%d), xrefs: 00007FF6729BAA94, 00007FF6729BAB96

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: ErrorLastsend
String ID: #$%127[^,],%127s$%c%c$%c%c%c%c$%c%c%c%c%s%c%c$%c%s%c%s$Sending data failed (%d)
API String ID: 1802528911-931584821
Opcode ID: 9664455fc349fcbc525f1d573342fb5eff2cd5137165feef64fa9e822d2f567c
Instruction ID: 46ab5ecc81d73b35e55efc0a2c652caeccedbc82c433ea642e274016b541001d
Opcode Fuzzy Hash: 9664455fc349fcbc525f1d573342fb5eff2cd5137165feef64fa9e822d2f567c
Instruction Fuzzy Hash: 5091CE22A18AC195F7219F66E4047EA73A1FB847ACF480235EE8D47B86DF7CD245CB40

Function 00007FF6729BC230 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

sendto.WS2_32 ref: 00007FF6729BC3A8
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6729BC3C3
sendto.WS2_32 ref: 00007FF6729BC42A
sendto.WS2_32 ref: 00007FF6729BC4E1
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6729BC519

Strings

tftp_rx: internal error, xrefs: 00007FF6729BC27E
Timeout waiting for block %d ACK. Retries = %d, xrefs: 00007FF6729BC2A2
Received unexpected DATA packet block %d, expecting block %d, xrefs: 00007FF6729BC521
Received last DATA packet block %d again., xrefs: 00007FF6729BC475

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: sendto$_time64
String ID: Received last DATA packet block %d again.$Received unexpected DATA packet block %d, expecting block %d$Timeout waiting for block %d ACK. Retries = %d$tftp_rx: internal error
API String ID: 2327272419-1785996722
Opcode ID: b5aed5f5e874f08da3f6bfb81dc77b14add32bcb1054fe6c0e72a8edd01829ad
Instruction ID: db5f3f5c9b9233dc18a8b5110376c04c79d00e0e811f3556a515a72e9897a584
Opcode Fuzzy Hash: b5aed5f5e874f08da3f6bfb81dc77b14add32bcb1054fe6c0e72a8edd01829ad
Instruction Fuzzy Hash: 41917E73628791CAE711CF2AD4503A93BA0F798F88F988132DA4D8B759DF79D506CB10

Function 00007FF67299BA00 Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 227COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF67299BD96

Strings

Read callback asked for PAUSE when not supported!, xrefs: 00007FF67299BBF9
Successfully compiled trailers., xrefs: 00007FF67299BADA
operation aborted by callback, xrefs: 00007FF67299BB6D
Moving trailers state machine from initialized to sending., xrefs: 00007FF67299BA41
Unable to allocate trailing headers buffer !, xrefs: 00007FF67299BA73
Signaling end of chunked upload after trailers., xrefs: 00007FF67299BDE0
operation aborted by trailing headers callback, xrefs: 00007FF67299BB8D
%zx%s, xrefs: 00007FF67299BCB7
Signaling end of chunked upload via terminating chunk., xrefs: 00007FF67299BD2A
read function returned funny value, xrefs: 00007FF67299BC3B

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: memcpy
String ID: %zx%s$Moving trailers state machine from initialized to sending.$Read callback asked for PAUSE when not supported!$Signaling end of chunked upload after trailers.$Signaling end of chunked upload via terminating chunk.$Successfully compiled trailers.$Unable to allocate trailing headers buffer !$operation aborted by callback$operation aborted by trailing headers callback$read function returned funny value
API String ID: 3510742995-1652449680
Opcode ID: 4cec76c179983dc5c1c82ef5c10379651a4e79a04eda0abc12d3d9b353303c46
Instruction ID: 913bc0ca887a1b0e69f41c93062634951f688fa6df37572acf1fa8fe275b3a95
Opcode Fuzzy Hash: 4cec76c179983dc5c1c82ef5c10379651a4e79a04eda0abc12d3d9b353303c46
Instruction Fuzzy Hash: D4A18363A28A8285E750DF26D4503F93391EF85BACF5C0131DE8D8B29ADEBCD455CB10

Function 00007FF6729ADA10 Relevance: 18.2, APIs: 4, Strings: 8, Instructions: 207COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729ADB40
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729ADB56
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729ADBB9

Strings

SELECT %s, xrefs: 00007FF6729ADBA5
Mime-Version, xrefs: 00007FF6729ADC46
Cannot APPEND with unknown input file size, xrefs: 00007FF6729ADCB7
Cannot SELECT without a mailbox., xrefs: 00007FF6729ADB6F
APPEND %s (\Seen) {%I64d}, xrefs: 00007FF6729ADCED
Cannot APPEND without a mailbox., xrefs: 00007FF6729ADBE4
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_, xrefs: 00007FF6729ADA28
Mime-Version: 1.0, xrefs: 00007FF6729ADC61

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_$APPEND %s (\Seen) {%I64d}$Cannot APPEND with unknown input file size$Cannot APPEND without a mailbox.$Cannot SELECT without a mailbox.$Mime-Version$Mime-Version: 1.0$SELECT %s
API String ID: 1294909896-3146291949
Opcode ID: 2bad4d79c21dddf33696f9eb2f16f977882c4fa031e8a757c5df9d57b3edebb2
Instruction ID: d4a45b85189721b5911f577dc313ca863137d0d654e19ccd9325d841b040b7cd
Opcode Fuzzy Hash: 2bad4d79c21dddf33696f9eb2f16f977882c4fa031e8a757c5df9d57b3edebb2
Instruction Fuzzy Hash: F7914B23E2DB4286FB649B2395503B962A0EF45B8CF5C4435DA5E87683EFACE444CB50

Function 00007FF6729945C0 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 280stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6729955A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729955B4
Part of subcall function 00007FF6729955A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729955CA
Part of subcall function 00007FF6729955A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729955DE
Part of subcall function 00007FF6729955A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729955F2
Part of subcall function 00007FF6729955A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF672995606
Part of subcall function 00007FF6729955A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF67299561A
Part of subcall function 00007FF6729955A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF67299562E
Part of subcall function 00007FF6729955A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF672995642

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672994642

Part of subcall function 00007FF6729BE570: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729945E5,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729BE585
Part of subcall function 00007FF6729BE570: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6729945E5,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729BE59F
Part of subcall function 00007FF6729BE570: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6729945E5,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729BE5BA
Part of subcall function 00007FF6729BE570: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6729945E5,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729BE5D6
Part of subcall function 00007FF6729BE570: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6729945E5,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729BE5F2
Part of subcall function 00007FF6729BE570: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6729945E5,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729BE60A
Part of subcall function 00007FF6729BE570: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6729945E5,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729BE622
Part of subcall function 00007FF6729BE570: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6729945E5,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729BE63A
Part of subcall function 00007FF6729BE570: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6729945E5,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729BE652
Part of subcall function 00007FF6729BE570: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6729945E5,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729BE66A
Part of subcall function 00007FF6729BE570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729945E5,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729BE684

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF672994846
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF672994889
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6729949CE
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF672994A4B

Strings

Protocol "%s" not supported or disabled in libcurl, xrefs: 00007FF67299478F
file, xrefs: 00007FF672994933, 00007FF6729949AC
%s://%s, xrefs: 00007FF67299464F

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdup$free$callocstrtoul
String ID: %s://%s$Protocol "%s" not supported or disabled in libcurl$file
API String ID: 954404409-4150109901
Opcode ID: dee1f77ea007a52df643cc65f3d8b2c4ff8c3a203c5ab7a0c04ccb3bc46d63e4
Instruction ID: 82000067ce52c31e21991a228c9c7083452b84e95b1e6b85fee3d7de48b19f77
Opcode Fuzzy Hash: dee1f77ea007a52df643cc65f3d8b2c4ff8c3a203c5ab7a0c04ccb3bc46d63e4
Instruction Fuzzy Hash: D3C18633A286C28AEB658B27D5503B96394FB8575CF4C1131DB8DC7686DFB8E5648B00

Function 00007FF67299E190 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 178COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299E221
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299E268
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299E304
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299E31A
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299E33B
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67299E38A
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF67299E3DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299E40F

Strings

Shuffling %i addresses, xrefs: 00007FF67299E20A
:%u, xrefs: 00007FF67299E39E

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$malloc$_time64calloctolower
String ID: :%u$Shuffling %i addresses
API String ID: 133842801-338667637
Opcode ID: 3f088b5c08b8398036632549c7ac13fcbb9409222e6035e94bb58e22c516e89e
Instruction ID: 211eec49471e2cdfbc5b38cc799d64634d165959cea24a6cfb475d275a86462f
Opcode Fuzzy Hash: 3f088b5c08b8398036632549c7ac13fcbb9409222e6035e94bb58e22c516e89e
Instruction Fuzzy Hash: 73719673A28A8285EB148B12D5047BD7761FB88BA8F484532CE8D87796EFBCD455CB00

Function 00007FF6729CB6B0 Relevance: 16.8, APIs: 2, Strings: 9, Instructions: 279COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729CBB7B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729CBBD3

Strings

OAUTHBEARER, xrefs: 00007FF6729CB9C2
GSSAPI, xrefs: 00007FF6729CB846
CRAM-MD5, xrefs: 00007FF6729CB902
PLAIN, xrefs: 00007FF6729CBA8A
XOAUTH2, xrefs: 00007FF6729CBA35
EXTERNAL, xrefs: 00007FF6729CB7CB
NTLM, xrefs: 00007FF6729CB939
DIGEST-MD5, xrefs: 00007FF6729CB8E3
LOGIN, xrefs: 00007FF6729CBAF3

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: CRAM-MD5$DIGEST-MD5$EXTERNAL$GSSAPI$LOGIN$NTLM$OAUTHBEARER$PLAIN$XOAUTH2
API String ID: 1294909896-1896214517
Opcode ID: 6901eb28b55e1e04e0dde3610f9daacd020a6cec1ea86de7a99c7c0992e3ca38
Instruction ID: 83ad33ef5e862ca2cd9e3bcae748f26cf60dbf085ddb64f04c426c36ab75710e
Opcode Fuzzy Hash: 6901eb28b55e1e04e0dde3610f9daacd020a6cec1ea86de7a99c7c0992e3ca38
Instruction Fuzzy Hash: 96D15E7391978285EB60CF22E4503A977A4FB84B58F080236DE8D4779ADFBCD585CB14

Function 00007FF6729AD6E0 Relevance: 16.7, APIs: 5, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6729AC0B0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF67299343F), ref: 00007FF6729AC0DE

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729AD97E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729AD988
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729AD9E3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729AD9ED
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729AD9FA

Strings

SECTION, xrefs: 00007FF6729AD8F8
MAILINDEX, xrefs: 00007FF6729AD8B7
PARTIAL, xrefs: 00007FF6729AD936
UID, xrefs: 00007FF6729AD876
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_, xrefs: 00007FF6729AD6E8
UIDVALIDITY, xrefs: 00007FF6729AD835

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$malloc
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_$MAILINDEX$PARTIAL$SECTION$UID$UIDVALIDITY
API String ID: 2190258309-1670639106
Opcode ID: 5d8d57d0abad1ca864aa77d03316f206784e5215f7fc8db3d3d34cdfebe80e45
Instruction ID: 51362512527179ea525aa6ba191cfc9e663e59815feefd2c07767477310bc0a3
Opcode Fuzzy Hash: 5d8d57d0abad1ca864aa77d03316f206784e5215f7fc8db3d3d34cdfebe80e45
Instruction Fuzzy Hash: E0A15463D29B8285EB559F26D4403B827A0FB84B9CF0C5031EA8E87697DFBCD591C710

Function 00007FF6729BF221 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BF12B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BF191
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BF19F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BF29D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BF306
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BF31E

Part of subcall function 00007FF6729BE270: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729BE280

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BF346
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BF35D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BF382
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BF3CF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BF3E4

Part of subcall function 00007FF6729BF520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729BE552,?,?,00000000,00007FF67299565B,?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729BF52C
Part of subcall function 00007FF6729BF520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729BE552,?,?,00000000,00007FF67299565B,?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729BF536
Part of subcall function 00007FF6729BF520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729BE552,?,?,00000000,00007FF67299565B,?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729BF540
Part of subcall function 00007FF6729BF520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729BE552,?,?,00000000,00007FF67299565B,?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729BF54A
Part of subcall function 00007FF6729BF520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729BE552,?,?,00000000,00007FF67299565B,?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729BF554
Part of subcall function 00007FF6729BF520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729BE552,?,?,00000000,00007FF67299565B,?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729BF55E
Part of subcall function 00007FF6729BF520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729BE552,?,?,00000000,00007FF67299565B,?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729BF568
Part of subcall function 00007FF6729BF520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729BE552,?,?,00000000,00007FF67299565B,?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729BF572
Part of subcall function 00007FF6729BF520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729BE552,?,?,00000000,00007FF67299565B,?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729BF57C
Part of subcall function 00007FF6729BF520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729BE552,?,?,00000000,00007FF67299565B,?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729BF586
Part of subcall function 00007FF6729BF520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729BE552,?,?,00000000,00007FF67299565B,?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729BF590

Strings

:, xrefs: 00007FF6729BF247
,, xrefs: 00007FF6729BF264

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$calloc$_strdup
String ID: ,$:
API String ID: 2460172880-4193410690
Opcode ID: ab7cf525d048fa14623e063d400a5f34e0d2eb12631cc4848d5bb2d9c8bf81f1
Instruction ID: 6a78403186c4f709b5bdd5b40e311c33a4d602f93996af2dc4956ce54561d604
Opcode Fuzzy Hash: ab7cf525d048fa14623e063d400a5f34e0d2eb12631cc4848d5bb2d9c8bf81f1
Instruction Fuzzy Hash: D6517313E2CB86C2FA219F3699102B96350BB55B8CF089234DE8D92653FFACF5C58700

Function 00007FF67298C960 Relevance: 16.6, APIs: 11, Instructions: 119stringCOMMON

Download Yara Rule

APIs

_stat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF67298C9A7
_access.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF67298C9B7
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67298C9CE
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67298CA4A
strrchr.VCRUNTIME140 ref: 00007FF67298CA67
strrchr.VCRUNTIME140 ref: 00007FF67298CA77
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67298CAA7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298CAB3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298CAC2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67298CAD3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298CAE9

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdup$free$strrchr$_access_stat64
String ID:
API String ID: 2557200964-0
Opcode ID: 02d0ca63fde20aae63bd8b5aab88cfca85a1dbff93ed1b69c37c8004dc00e462
Instruction ID: 233bac4a0f75b04d086e4c659b06f68816cbe44e0d265f448bc7fb4afa77d66c
Opcode Fuzzy Hash: 02d0ca63fde20aae63bd8b5aab88cfca85a1dbff93ed1b69c37c8004dc00e462
Instruction Fuzzy Hash: 8F414033A29B4285FA28DB53E4502796390FF48B99F5C4134DE5D87B92EFBCE455CA00

Function 00007FF6729BE570 Relevance: 16.6, APIs: 11, Instructions: 89COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729945E5,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729BE585
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6729945E5,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729BE59F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6729945E5,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729BE5BA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6729945E5,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729BE5D6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6729945E5,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729BE5F2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6729945E5,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729BE60A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6729945E5,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729BE622
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6729945E5,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729BE63A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6729945E5,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729BE652
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6729945E5,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729BE66A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729945E5,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729BE684

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdup$callocfree
String ID:
API String ID: 1183638330-0
Opcode ID: c561f18844330da2ca565e1c9d945ce310ded9e51ba32418f44b7c0c45106f41
Instruction ID: ef95460dce3f5128ee2101a8ef3a393197eaeaddd7bafbe172f85710d5c6c722
Opcode Fuzzy Hash: c561f18844330da2ca565e1c9d945ce310ded9e51ba32418f44b7c0c45106f41
Instruction Fuzzy Hash: 8831DF77A26B42C2EE59CFA7A05017823E4BF48B59B4C0535CE4D86752EFBCE4A48B50

Function 00007FF672991C90 Relevance: 16.4, APIs: 13, Instructions: 164stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF672991CC8
strchr.VCRUNTIME140 ref: 00007FF672991CEF
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672991DA4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672991DCA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672991DEB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672991DFC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672991E05
memcpy.VCRUNTIME140 ref: 00007FF672991E23
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672991E37
memcpy.VCRUNTIME140 ref: 00007FF672991E54
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672991E69
memcpy.VCRUNTIME140 ref: 00007FF672991E81
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672991E96

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$mallocmemcpy$strchr
String ID:
API String ID: 1615377186-0
Opcode ID: b640f6529230601bcac7f0afbe2668f86e12438bfad648e636857a6ab1cb28e0
Instruction ID: 98e57caf0c41886276ab7fa8690d3f3b0546e5f6668955b99aca8cdaa28c79b8
Opcode Fuzzy Hash: b640f6529230601bcac7f0afbe2668f86e12438bfad648e636857a6ab1cb28e0
Instruction Fuzzy Hash: 1651D427B29B81C9EA658F1BA500279A395FF84BD8F0C4530CE8D87746DFBCE4258B00

Function 00007FF672993BB0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672993BF4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672993C08
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672993C2C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF672993C39
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672993C62
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF672993C6F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672993CA0
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF672993CAD

Strings

Couldn't find host %s in the .netrc file; using defaults, xrefs: 00007FF672993D39

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$_strdup
String ID: Couldn't find host %s in the .netrc file; using defaults
API String ID: 2653869212-3983049644
Opcode ID: 17444c9839ce5642dedb8125fa4cfd937cded4d596d586cc28355339739553ee
Instruction ID: 00b564affc8c0fbc5cd99864c06f7f2c022dd9661e57efb8f6326ffab7de7bda
Opcode Fuzzy Hash: 17444c9839ce5642dedb8125fa4cfd937cded4d596d586cc28355339739553ee
Instruction Fuzzy Hash: 90719527A18B828AE7658F6AD4543A967A0FF84758F0C0131DF8D87392DFBDE464CB14

Function 00007FF672993B58 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672993BF4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672993C08
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672993C2C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF672993C39
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672993C62
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF672993C6F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672993CA0
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF672993CAD

Strings

Couldn't find host %s in the .netrc file; using defaults, xrefs: 00007FF672993D39

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$_strdup
String ID: Couldn't find host %s in the .netrc file; using defaults
API String ID: 2653869212-3983049644
Opcode ID: da4fb7422d50e069c6dc1f5ec7017e207be36013f9d53281eed96c4a942a731c
Instruction ID: 3a5b5db11619379123f79354219a660192ac7dadfba9b192ec888c390af03963
Opcode Fuzzy Hash: da4fb7422d50e069c6dc1f5ec7017e207be36013f9d53281eed96c4a942a731c
Instruction Fuzzy Hash: E3619363A18A828AE7558F66D4643A97760FB84B58F0D4035DF8D87352DFBCE4A5CB00

Function 00007FF6729B45C0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 117COMMON

Download Yara Rule

Strings

Got a %03d response code instead of the assumed 200, xrefs: 00007FF6729B4600
NLST, xrefs: 00007FF6729B46BB
%s%s%s, xrefs: 00007FF6729B46E5
Couldn't set desired mode, xrefs: 00007FF6729B45DE
LIST, xrefs: 00007FF6729B46C2

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID:
String ID: %s%s%s$Couldn't set desired mode$Got a %03d response code instead of the assumed 200$LIST$NLST
API String ID: 0-1262176364
Opcode ID: 488a0d100d17fb145cfc9866da5502e926ddddcf3182e73546c425658076ceab
Instruction ID: 0874f5597f0e3a533dc6771904791c46b95057893b29f424e358271806b30afb
Opcode Fuzzy Hash: 488a0d100d17fb145cfc9866da5502e926ddddcf3182e73546c425658076ceab
Instruction Fuzzy Hash: 1441D433B28642C6EA149B57E4941B97360FF41B98F581031DA4D87A97DFFCE444EB00

Function 00007FF6729984D0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 112stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF6729A453A), ref: 00007FF67299854F
strchr.VCRUNTIME140(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF6729A453A), ref: 00007FF6729985A1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF6729A453A), ref: 00007FF6729985C5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF6729A453A), ref: 00007FF672998615
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF6729A453A), ref: 00007FF672998658

Strings

%.*s, xrefs: 00007FF6729985AE
Proxy-, xrefs: 00007FF67299862B
%sAuthorization: Digest %s, xrefs: 00007FF672998635
Digest, xrefs: 00007FF6729984DB

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$_strdupstrchr
String ID: %.*s$%sAuthorization: Digest %s$Digest$Proxy-
API String ID: 153040452-3976116069
Opcode ID: 97965fbf7a9ecc29e30deb5c7fee3ed18232edf4587cbdfb6a5bc5a7c7e768d5
Instruction ID: dab2a2c25ddd86a58156d93768017a21f5b189d49f4839eea32c9b39518c1b5a
Opcode Fuzzy Hash: 97965fbf7a9ecc29e30deb5c7fee3ed18232edf4587cbdfb6a5bc5a7c7e768d5
Instruction Fuzzy Hash: 8141C673B18B8596E610CF02E4403AAB760FB85B98F580439DE8D87756DFBDD566CB00

Function 00007FF6729C75FE Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 103COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C7632
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7B29
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7BF2

Strings

Public Key Algorithm, xrefs: 00007FF6729C7BA8
Public Key Algorithm: %s, xrefs: 00007FF6729C7BC2
Expire Date, xrefs: 00007FF6729C7AFD
Expire Date: %s, xrefs: 00007FF6729C7B17
TRUE, xrefs: 00007FF6729C7620
FALSE, xrefs: 00007FF6729C7627

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$_strdup
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$FALSE$Public Key Algorithm$TRUE
API String ID: 2653869212-571364039
Opcode ID: aee92922b1fe9f8066213444efad0f4202db36149096e68dd7fc1dca2bc30f33
Instruction ID: fa2b08c6031e506e0876488c72b6d4c6cb539b7fc77609370c7726f55d511e6a
Opcode Fuzzy Hash: aee92922b1fe9f8066213444efad0f4202db36149096e68dd7fc1dca2bc30f33
Instruction Fuzzy Hash: 12418E67A1878295EB168B63A8041FA77A5BB05B8CF4C0935CE8D97757DFBCE184CB00

Function 00007FF6729B77E0 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 168COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B7A38

Part of subcall function 00007FF672995870: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,FFFFFFFF,00007FF6729A1685,?,?,00000000,00007FF6729A19E5), ref: 00007FF672995885
Part of subcall function 00007FF672995870: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,FFFFFFFF,00007FF6729A1685,?,?,00000000,00007FF6729A19E5), ref: 00007FF67299589B

memcpy.VCRUNTIME140 ref: 00007FF6729B7858
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B79A9
memcpy.VCRUNTIME140 ref: 00007FF6729B7A72
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B7A7E

Strings

Failed writing RTP data, xrefs: 00007FF6729B7973
Got an error writing an RTP packet, xrefs: 00007FF6729B798B
Cannot pause RTP, xrefs: 00007FF6729B797C

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$memcpy$realloc
String ID: Cannot pause RTP$Failed writing RTP data$Got an error writing an RTP packet
API String ID: 657767516-1165944077
Opcode ID: 1f6ce7b4e3821a7b3e1a1ffa02d724365aaeb5b847b69e8db2504c9ba8cc51f1
Instruction ID: 65a3e2691a683affb82448b31df4f373be9a286ba9a48dea01927a7ef3deeca2
Opcode Fuzzy Hash: 1f6ce7b4e3821a7b3e1a1ffa02d724365aaeb5b847b69e8db2504c9ba8cc51f1
Instruction Fuzzy Hash: D4718E33B29B85D6EA48CB26D8403A977A4FB4AB94F484135DB9D87752DF7CE460C700

Function 00007FF67298A9A0 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,00007FF67298A41E,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6729910E9), ref: 00007FF67298A9C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298AA19
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298AA23
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298AA2D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298AA37
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298AA41
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298AA4B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298AA55
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298AA5F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298AA68

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$_time64
String ID:
API String ID: 3087401894-0
Opcode ID: 7d0639c7a6b5ea817b2713a306598321ba490f172ceec9c2b792b3fcaebe51c4
Instruction ID: 052f989af5c5f36406669bc3c93562e04100734ef5d900d919cb164c827d5bfa
Opcode Fuzzy Hash: 7d0639c7a6b5ea817b2713a306598321ba490f172ceec9c2b792b3fcaebe51c4
Instruction Fuzzy Hash: 0321EC37A28A51C1DB10DF63E9441696360FB88F99F0D4531DE8E93B66DEBCD885CB40

Function 00007FF672977429 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

invalid number; expected digit after '.', xrefs: 00007FF6729777C7
invalid number; expected '+', '-', or digit after exponent, xrefs: 00007FF672977977

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID:
String ID: invalid number; expected '+', '-', or digit after exponent$invalid number; expected digit after '.'
API String ID: 0-808606891
Opcode ID: 692257602e1f08fc3bb0b9b97680759fab13f7ca6e9ee14735d70863b04f3c07
Instruction ID: f5431e28367c2bf3c519635530e9ea90ff723dc729ee955757d8723b54ff59c4
Opcode Fuzzy Hash: 692257602e1f08fc3bb0b9b97680759fab13f7ca6e9ee14735d70863b04f3c07
Instruction Fuzzy Hash: 09B15E63928A41C5E7248F2AD4402BC3761FB15B5CF684636D64E823DADFBCE985CB50

Function 00007FF6729CE270 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729CE33A
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729CE388
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729CE3EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729CE529

Part of subcall function 00007FF6729C22D0: strchr.VCRUNTIME140(00000000,?,?,00007FF6729C188F), ref: 00007FF6729C2316
Part of subcall function 00007FF6729C22D0: strchr.VCRUNTIME140(00000000,?,?,00007FF6729C188F), ref: 00007FF6729C2326
Part of subcall function 00007FF6729C22D0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,00007FF6729C188F), ref: 00007FF6729C2350
Part of subcall function 00007FF6729C22D0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C2385
Part of subcall function 00007FF6729C22D0: strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C23AA
Part of subcall function 00007FF6729C22D0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C23CC

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729CE5B4

Strings

GSSAPI, xrefs: 00007FF6729CE273
Kerberos, xrefs: 00007FF6729CE303, 00007FF6729CE3A5
GSSAPI handshake failure (empty challenge message), xrefs: 00007FF6729CE433

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdup$callocmallocstrchr$freestrncpy
String ID: GSSAPI$GSSAPI handshake failure (empty challenge message)$Kerberos
API String ID: 370574955-353107822
Opcode ID: 5dd48d71ec66cbc7e6a2dabf75876b503afe133f621ecb721dcbbe461a5e67d2
Instruction ID: 66d9a92d23b82d6e8d430c3a383a6b1cd42d2f0bc54750a3deeb95d35aa15359
Opcode Fuzzy Hash: 5dd48d71ec66cbc7e6a2dabf75876b503afe133f621ecb721dcbbe461a5e67d2
Instruction Fuzzy Hash: ABA16E33A28B858AEB50CF66E4502AD73A5FB48B8CF080135DE8D97759EF78E445DB40

Function 00007FF6729891E5 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 206COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67298922A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67298924A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67298929B

Part of subcall function 00007FF67298AAB0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67298AAB6

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729893A1

Strings

Replaced, xrefs: 00007FF672989631
Added, xrefs: 00007FF67298963D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF672989647
FALSE, xrefs: 00007FF67298937B

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 1169197092-2292467869
Opcode ID: ed61ffd1455d321f565c0e9c82bc1d26ae6c209a1b700be9856021a9b0418834
Instruction ID: 6c46f84b054e981e29e710b8ed0b2170908a88c3e28ab17d08acba0791fe59a2
Opcode Fuzzy Hash: ed61ffd1455d321f565c0e9c82bc1d26ae6c209a1b700be9856021a9b0418834
Instruction Fuzzy Hash: 95912C23A2968285FE758B2394443B977E4AF4575CF4C4036DA8E82793DEBCF6849B01

Function 00007FF6729A24E0 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 181COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729A25AC

Strings

Ignoring duplicate digest auth header., xrefs: 00007FF6729A265D
Basic, xrefs: 00007FF6729A26A1
Digest, xrefs: 00007FF6729A2644
NTLM, xrefs: 00007FF6729A25DC
Authentication problem. Ignoring this., xrefs: 00007FF6729A26ED
Negotiate, xrefs: 00007FF6729A2556
Bearer, xrefs: 00007FF6729A26C8

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdup
String ID: Authentication problem. Ignoring this.$Basic$Bearer$Digest$Ignoring duplicate digest auth header.$NTLM$Negotiate
API String ID: 1169197092-907567932
Opcode ID: 2267486c0cb40ddf9ea8a5db3634d9b738a0fdcb490261acc8b2c23042154446
Instruction ID: 257bc799e18ad6fcfe9ab4f14a2ff3b8ccc849d9a5240609e51b5224f4d4d450
Opcode Fuzzy Hash: 2267486c0cb40ddf9ea8a5db3634d9b738a0fdcb490261acc8b2c23042154446
Instruction Fuzzy Hash: E971B263D2C38247FB148A2395512BA76E1AF4178CF0C4035DE9AD6283DFACF654CB00

Function 00007FF6729892F3 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 169COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729892F6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729893A1

Strings

Replaced, xrefs: 00007FF672989631
__Host-, xrefs: 00007FF67298932D
Added, xrefs: 00007FF67298963D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF672989647
__Secure-, xrefs: 00007FF672989310
FALSE, xrefs: 00007FF67298937B

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced$__Host-$__Secure-
API String ID: 1169197092-978722393
Opcode ID: fb0a04ef7a88d7d8be5cb761ab5cc2247ec32a38ba288bb1ee10f9abf62dcab5
Instruction ID: 5ea36d96de209657cbf4e374dcaef825f97df247b29119379265f34940913d9c
Opcode Fuzzy Hash: fb0a04ef7a88d7d8be5cb761ab5cc2247ec32a38ba288bb1ee10f9abf62dcab5
Instruction Fuzzy Hash: 1C713D23A2868245FE719B2790443B96790AF4575CF4C4036DE8E83793DFACF684CB00

Function 00007FF6729B06D0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 135stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729B078F
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729B07D4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B0890

Strings

HELP, xrefs: 00007FF6729B08C5
VRFY %s%s%s%s, xrefs: 00007FF6729B085E
%s %s%s, xrefs: 00007FF6729B0759
EXPN, xrefs: 00007FF6729B0717
SMTPUTF8, xrefs: 00007FF6729B073D, 00007FF6729B0845

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdupfreestrpbrk
String ID: SMTPUTF8$%s %s%s$EXPN$HELP$VRFY %s%s%s%s
API String ID: 1812939018-2300960079
Opcode ID: 0b5abbc9bf6e8c938b982695b4a6ae5f25daa90c40de89fe8ffefb369641a07d
Instruction ID: 28eb5865fb5e985c5b18a84c498bb169c31a3883438385a3000f44122144913e
Opcode Fuzzy Hash: 0b5abbc9bf6e8c938b982695b4a6ae5f25daa90c40de89fe8ffefb369641a07d
Instruction Fuzzy Hash: A451A423E28B81C1FB51CB12E450BB977A0FB85B88F484135DA8D83792DFADE545CB40

Function 00007FF6729B63A1 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 108stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140 ref: 00007FF6729B63B3
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729B63CE
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729B63FA
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B641F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B64FC

Strings

Wildcard - Parsing started, xrefs: 00007FF6729B6497

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdup$callocfreestrrchr
String ID: Wildcard - Parsing started
API String ID: 2641349667-2274641867
Opcode ID: 8e1ec359457061d5bb31d48fca307f91988928829d745b62054a33b852c2ac14
Instruction ID: 3f1f4b9085b9b589e3d2ab205949c779f96768b4b2d447473c7b9ed30651164f
Opcode Fuzzy Hash: 8e1ec359457061d5bb31d48fca307f91988928829d745b62054a33b852c2ac14
Instruction Fuzzy Hash: 86517733A18B82C1EB15CF52E4401B837A5FB84B88F4D4539CA4E8B396EFB8E455CB10

Function 00007FF6729C6ACC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C6AF3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C6FAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7053

Strings

Serial Number, xrefs: 00007FF6729C6F82
Serial Number: %s, xrefs: 00007FF6729C6F9C
Signature Algorithm: %s, xrefs: 00007FF6729C7041
Signature Algorithm, xrefs: 00007FF6729C7027
FALSE, xrefs: 00007FF6729C6AE8

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$_strdup
String ID: Serial Number: %s$ Signature Algorithm: %s$FALSE$Serial Number$Signature Algorithm
API String ID: 2653869212-3672398475
Opcode ID: 9d45eb127893167d2b3ad7924b6b1f9a7cbf381342c0adfe06e15ca9dcd5f3f1
Instruction ID: 38ca385cd49579063838f5c6eb4c2897941c41da481addeff7250c9979356811
Opcode Fuzzy Hash: 9d45eb127893167d2b3ad7924b6b1f9a7cbf381342c0adfe06e15ca9dcd5f3f1
Instruction Fuzzy Hash: FD41BE67A2878295EF128B63A4042F967A1BB45B8CF4C0939CE4D97357DFBCE184CB00

Function 00007FF6729896D0 Relevance: 13.8, APIs: 11, Instructions: 52COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF6729910E9,?,?,00000000,00007FF672991625), ref: 00007FF6729896FD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF6729910E9,?,?,00000000,00007FF672991625), ref: 00007FF672989727
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF6729910E9,?,?,00000000,00007FF672991625), ref: 00007FF672989731
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF6729910E9,?,?,00000000,00007FF672991625), ref: 00007FF67298973B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF6729910E9,?,?,00000000,00007FF672991625), ref: 00007FF672989745
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF6729910E9,?,?,00000000,00007FF672991625), ref: 00007FF67298974F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF6729910E9,?,?,00000000,00007FF672991625), ref: 00007FF672989759
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF6729910E9,?,?,00000000,00007FF672991625), ref: 00007FF672989763
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF6729910E9,?,?,00000000,00007FF672991625), ref: 00007FF67298976D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF6729910E9,?,?,00000000,00007FF672991625), ref: 00007FF672989776
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF6729910E9,?,?,00000000,00007FF672991625), ref: 00007FF672989791

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 9209ad5f54c43818d7a84247bd6de7dc3350ad0c3622f6169f3d1dc7c1563e82
Instruction ID: a49d1a4644eeb0d298e6b77d5b9f140444983ee477aa9f28dc3735cba0926ec0
Opcode Fuzzy Hash: 9209ad5f54c43818d7a84247bd6de7dc3350ad0c3622f6169f3d1dc7c1563e82
Instruction Fuzzy Hash: 38218C37A25A81C2D754DF52E854169A770FB88F99F181531DE8E93725CFBCD489CB00

Function 00007FF6729BF520 Relevance: 13.8, APIs: 11, Instructions: 29COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729BE552,?,?,00000000,00007FF67299565B,?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729BF52C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729BE552,?,?,00000000,00007FF67299565B,?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729BF536
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729BE552,?,?,00000000,00007FF67299565B,?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729BF540
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729BE552,?,?,00000000,00007FF67299565B,?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729BF54A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729BE552,?,?,00000000,00007FF67299565B,?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729BF554
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729BE552,?,?,00000000,00007FF67299565B,?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729BF55E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729BE552,?,?,00000000,00007FF67299565B,?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729BF568
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729BE552,?,?,00000000,00007FF67299565B,?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729BF572
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729BE552,?,?,00000000,00007FF67299565B,?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729BF57C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729BE552,?,?,00000000,00007FF67299565B,?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729BF586
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729BE552,?,?,00000000,00007FF67299565B,?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729BF590

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a7b77239a4e14c71d39f7ba7f0ac28c37d6e28cfe88217e4797fadce2066e909
Instruction ID: 3444009855e8d19dffa45c578651ff3d42c7a37d02d399331a14c172dc4c3c79
Opcode Fuzzy Hash: a7b77239a4e14c71d39f7ba7f0ac28c37d6e28cfe88217e4797fadce2066e909
Instruction Fuzzy Hash: E901B337A34981C2D714DFA6EC540686330FB88F5AF181531CE4E96235DEB8D899C740

Function 00007FF6729BE910 Relevance: 13.7, APIs: 3, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BEA65
memcpy.VCRUNTIME140 ref: 00007FF6729BEA82

Strings

file://%s%s%s, xrefs: 00007FF6729BE95E
file, xrefs: 00007FF6729BE92B
https, xrefs: 00007FF6729BE9A0
%ld, xrefs: 00007FF6729BE9CE
%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF6729BEC52
%%25%s], xrefs: 00007FF6729BEA92

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: mallocmemcpy
String ID: %%25%s]$%ld$%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$file$file://%s%s%s$https
API String ID: 4276657696-1832275178
Opcode ID: d9529c345f17073791a05fbee086d5c2c1eb739df361c1278cd929c336069526
Instruction ID: 08033642ff9f5f154e8bbddb8e364369604bd3666aca26053eebd508cf5d1a07
Opcode Fuzzy Hash: d9529c345f17073791a05fbee086d5c2c1eb739df361c1278cd929c336069526
Instruction Fuzzy Hash: 75A17D63A19BC6C5EA658F12A5003A973A8FF44B88F584135DE8D8379ADF7CE854DB00

Function 00007FF6729CA530 Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 211COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6729CA5D8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729CA5E9
memcpy.VCRUNTIME140 ref: 00007FF6729CA729
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729CA784
memcpy.VCRUNTIME140 ref: 00007FF6729CA7A1

Strings

response reading failed, xrefs: 00007FF6729CA7C1
Excessive server response line length received, %zd bytes. Stripping, xrefs: 00007FF6729CA701
8, xrefs: 00007FF6729CA7D3
cached response data too big to handle, xrefs: 00007FF6729CA821

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: memcpy$freemalloc
String ID: 8$Excessive server response line length received, %zd bytes. Stripping$cached response data too big to handle$response reading failed
API String ID: 3313557100-1003742340
Opcode ID: 4863a18df18424c35c6d518f31953f08958877e3d4c435d57c46c371e650c6a0
Instruction ID: 554d75116692a7b91c97cc6349011ae03e58771c80a9542bbc2a0cf5a78ce155
Opcode Fuzzy Hash: 4863a18df18424c35c6d518f31953f08958877e3d4c435d57c46c371e650c6a0
Instruction Fuzzy Hash: 6A81A233A2DB8186EA548F27D5503AA67A0FB45B88F484935DF8D87742DFBCD4A1CB40

Function 00007FF6729C797C Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 174COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C79BF
memcpy.VCRUNTIME140 ref: 00007FF6729C79E5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7AB8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7B29
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7BF2

Strings

Public Key Algorithm, xrefs: 00007FF6729C7BA8
Public Key Algorithm: %s, xrefs: 00007FF6729C7BC2
Expire Date, xrefs: 00007FF6729C7AFD
Expire Date: %s, xrefs: 00007FF6729C7B17

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3401966785-2901970132
Opcode ID: 99264802169c6fb1e284fc524a0492557dd68a8aa16ea3e1f045eb687e729ad6
Instruction ID: 582c8cb95abd1f9d8d083f24c14d7d9dc393f7cdc48286c686ed9767cb49d159
Opcode Fuzzy Hash: 99264802169c6fb1e284fc524a0492557dd68a8aa16ea3e1f045eb687e729ad6
Instruction Fuzzy Hash: 28614463A2828246EB198B7388141F96795BB05B9CF4C4739CE5E877D7DEBCE1858B00

Function 00007FF6729B7B40 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 111stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF67298AB50: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF67298AB94

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729B7C5D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B7CB5
memcpy.VCRUNTIME140 ref: 00007FF6729B7CDA

Strings

CSeq:, xrefs: 00007FF6729B7B5D
Unable to read the CSeq header: [%s], xrefs: 00007FF6729B7BB2
Got a blank Session ID, xrefs: 00007FF6729B7C07
Session:, xrefs: 00007FF6729B7BCE
Got RTSP Session ID Line [%s], but wanted ID [%s], xrefs: 00007FF6729B7C6E
: %ld, xrefs: 00007FF6729B7B81

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: __stdio_common_vsscanfmallocmemcpystrncmp
String ID: : %ld$CSeq:$Got RTSP Session ID Line [%s], but wanted ID [%s]$Got a blank Session ID$Session:$Unable to read the CSeq header: [%s]
API String ID: 1392894463-1168109407
Opcode ID: 013e8ff6218a1f24a8f683551b33c595a9a9cf2dbede89bace14227a7205b159
Instruction ID: 88ce2b0b58393b858e6c47496e7c84cf456d5c6661f3b72e0d9d0e91775ae10f
Opcode Fuzzy Hash: 013e8ff6218a1f24a8f683551b33c595a9a9cf2dbede89bace14227a7205b159
Instruction Fuzzy Hash: F041C463A2C682C6FA509B2B94402F927A0EF45B9DF5C4235DA9EC7787DF6CE045CB10

Function 00007FF6729CBC50 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 252stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729CBCE8
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729CBD44
strchr.VCRUNTIME140 ref: 00007FF6729CBF2C
strchr.VCRUNTIME140 ref: 00007FF6729CBF9A

Strings

<DIR>, xrefs: 00007FF6729CBE70
0123456789-, xrefs: 00007FF6729CBF93
APM0123456789:, xrefs: 00007FF6729CBF25

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: strchr$mallocrealloc
String ID: 0123456789-$<DIR>$APM0123456789:
API String ID: 359134164-4291660576
Opcode ID: 43d45ae9e9e69d87e2c9fffd15e3b05a548deb80d0f6452d75515b0324022df0
Instruction ID: 4e9c7dbbf365c6dfaa70c74ba14d214c50ccb29e4495c264a445bc0d4daf8dd6
Opcode Fuzzy Hash: 43d45ae9e9e69d87e2c9fffd15e3b05a548deb80d0f6452d75515b0324022df0
Instruction Fuzzy Hash: E2B13A37A2964286EB649F36D06433D7BA1FB44F4CF184235CA4E86796CFB8E491CA50

Function 00007FF67299D3A0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 227networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299D3FA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299D4FE
WSAIoctl.WS2_32 ref: 00007FF67299D657
setsockopt.WS2_32 ref: 00007FF67299D67F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299D776

Strings

Failed to alloc scratch buffer!, xrefs: 00007FF67299D510
We are completely uploaded and fine, xrefs: 00007FF67299D6EA

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: malloc$Ioctlsetsockopt
String ID: Failed to alloc scratch buffer!$We are completely uploaded and fine
API String ID: 3352517165-607151321
Opcode ID: 6576756d07fa2295633ce59655db78e992ae5612541d13e9bcf3e746d44fe572
Instruction ID: edaa2595576b17b91babfcdb7f2b8fe0d20739c8c562302be2c77dbf58ce0cbe
Opcode Fuzzy Hash: 6576756d07fa2295633ce59655db78e992ae5612541d13e9bcf3e746d44fe572
Instruction Fuzzy Hash: 5FB17673A18A8589EB659F26D4443F92390EB84B6CF0C0135CE8C8678ADFBD9465CB20

Function 00007FF67297ABA0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297C29C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF67297C2CA
__std_exception_destroy.VCRUNTIME140 ref: 00007FF67297C2D8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297C312
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297C363

Strings

value, xrefs: 00007FF67297C208

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: c0f00be0ae70886b0bce34e8ced1ed52396001ffe496063c8d92012d52487524
Instruction ID: bb4619a209f11d6ae9901ecca9b2af6356ba7ac21987124daa7f5dbd44fa8f9a
Opcode Fuzzy Hash: c0f00be0ae70886b0bce34e8ced1ed52396001ffe496063c8d92012d52487524
Instruction Fuzzy Hash: C1618423A28A8586EB10CB75E4443ED7361FB457B8F545331EA6D86ADADFB8D081C700

Function 00007FF672979500 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297AA0D
__std_exception_destroy.VCRUNTIME140 ref: 00007FF67297AA3B
__std_exception_destroy.VCRUNTIME140 ref: 00007FF67297AA49
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297AA83
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297AAD4

Strings

value, xrefs: 00007FF67297A979

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: 06ba1203dce5f85c0f00e9c04d7833a16e6fb57afc36449dfe2fa1005df09fde
Instruction ID: cd8c0efab1381454593520125f2ab9468029816be449fceb880026d2017796c2
Opcode Fuzzy Hash: 06ba1203dce5f85c0f00e9c04d7833a16e6fb57afc36449dfe2fa1005df09fde
Instruction Fuzzy Hash: 5961B333A28A8585EB14CB76E4443ED3361FB457A8F145331DAAD46AEADFBCD081CB40

Function 00007FF6729C97E5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C9828
memcpy.VCRUNTIME140 ref: 00007FF6729C984D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C991F
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C9963
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C9977
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C99DE

Strings

TRUE, xrefs: 00007FF6729C993D

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: freeisupper$mallocmemcpy
String ID: TRUE
API String ID: 3511497317-3412697401
Opcode ID: dcd119684ac195530b672a08376666c1f266823b961955da020f1f5a4929e721
Instruction ID: e58f0e0e43a6db55edcf765c34173b446a31549ce8571c075f5f1b21a7317711
Opcode Fuzzy Hash: dcd119684ac195530b672a08376666c1f266823b961955da020f1f5a4929e721
Instruction Fuzzy Hash: DF51F613E2D59245FB198B3781543782B91AB12F98F0C4736C69F876C7EEAC9285CB01

Function 00007FF6729B6BF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF6729B6C26
_open.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6729B6C7B
_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF6729B6CEC
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6729B6CF9
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6729B6E0B

Strings

Can't open %s for writing, xrefs: 00007FF6729B6C8B
Can't get the size of %s, xrefs: 00007FF6729B6D02

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _close$_fstat64_openstrchr
String ID: Can't get the size of %s$Can't open %s for writing
API String ID: 423814720-3544860555
Opcode ID: 1b0b7728815f10fc8d74d69a40bf31f1530567b1dad60f3671a2889a10cb8077
Instruction ID: d0fbad47df99a8c00e768413d1f18fa0488f8809deec0422e2feda00c76acb8a
Opcode Fuzzy Hash: 1b0b7728815f10fc8d74d69a40bf31f1530567b1dad60f3671a2889a10cb8077
Instruction Fuzzy Hash: 01517463B28A4681EB249B27D4103B96391FF85BD8F5C4539DA5EC7396DEBCF4418B00

Function 00007FF6729BA6D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF6729BA73C
htons.WS2_32 ref: 00007FF6729BA752
send.WS2_32 ref: 00007FF6729BA7F8
WSAGetLastError.WS2_32 ref: 00007FF6729BA80C
send.WS2_32 ref: 00007FF6729BA84E
WSAGetLastError.WS2_32 ref: 00007FF6729BA858

Strings

Sending data failed (%d), xrefs: 00007FF6729BA812, 00007FF6729BA85E

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: ErrorLasthtonssend
String ID: Sending data failed (%d)
API String ID: 2027122571-2319402659
Opcode ID: d442a221ddee539bce1394eb04ab0c618603c4b1e89cb1b93704ab38f9091335
Instruction ID: 84d20a007fc399268026084e869a04e49600f5423d3f784bcdf72142bc924a54
Opcode Fuzzy Hash: d442a221ddee539bce1394eb04ab0c618603c4b1e89cb1b93704ab38f9091335
Instruction Fuzzy Hash: 97418A37A18A86C5E7019F76D460AA83760F754F8DF884632DB8A83A56DFBCE416C701

Function 00007FF6729C76EE Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 82COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C76F8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7B29
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7BF2

Part of subcall function 00007FF672990270: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729902C2

Strings

Public Key Algorithm, xrefs: 00007FF6729C7BA8
Public Key Algorithm: %s, xrefs: 00007FF6729C7BC2
Expire Date, xrefs: 00007FF6729C7AFD
Expire Date: %s, xrefs: 00007FF6729C7B17

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 111713529-2901970132
Opcode ID: 6446d9a16236ad501082da5ba7500cb184d07b747af498ee6d264632d6d16b07
Instruction ID: bfed38a842a39a4aed4d2bafe84fc57bd5f86e4fe25456b605a3fc318b9a3b7b
Opcode Fuzzy Hash: 6446d9a16236ad501082da5ba7500cb184d07b747af498ee6d264632d6d16b07
Instruction Fuzzy Hash: 68316B67A2878255EB168B6298050F967A5BF05B8CF4C0939CE8D9B757DFBCE1848B00

Function 00007FF6729C6B9E Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C6BA1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C6FAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7053

Part of subcall function 00007FF672990270: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729902C2

Strings

Serial Number, xrefs: 00007FF6729C6F82
Serial Number: %s, xrefs: 00007FF6729C6F9C
Signature Algorithm: %s, xrefs: 00007FF6729C7041
Signature Algorithm, xrefs: 00007FF6729C7027

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 111713529-517259162
Opcode ID: e13c357a02edb4e78be87c4d519663a5315eedc29d84f34a2e6f00efc7e66247
Instruction ID: b883d10b7a9c3f91f3749670bad785fc1cde97b11e13feb53bf7e7b97c6f62d4
Opcode Fuzzy Hash: e13c357a02edb4e78be87c4d519663a5315eedc29d84f34a2e6f00efc7e66247
Instruction Fuzzy Hash: D031AC63A2878255EF168B7398001F967A1BF45B8CF4C0939CE4E9B357DEBCA1858B00

Function 00007FF672971BD0 Relevance: 12.3, APIs: 8, Instructions: 277COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF672971D9A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672971E5D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672971EAB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672971EEB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672971F3A

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy
String ID:
API String ID: 3063020102-0
Opcode ID: 47e5079ae4cf50616b9e292b3a100a95151d2dfdb3261185e8ebcf2263a26bbe
Instruction ID: 50179860ed950fa8e3dcdb6d4a8b683bafbcc296921df0f054955259360ca7fd
Opcode Fuzzy Hash: 47e5079ae4cf50616b9e292b3a100a95151d2dfdb3261185e8ebcf2263a26bbe
Instruction Fuzzy Hash: 16B1BF23B28B4686FB10CB66E5003AD2361EB44BA8F585635DE6C43BD6DFBCE095D740

Function 00007FF6729C77ED Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 173COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7B29
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7BF2

Strings

Public Key Algorithm, xrefs: 00007FF6729C7BA8
GMT, xrefs: 00007FF6729C78AE
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF6729C7921
Public Key Algorithm: %s, xrefs: 00007FF6729C7BC2
Expire Date, xrefs: 00007FF6729C7AFD
Expire Date: %s, xrefs: 00007FF6729C7B17

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Expire Date$Public Key Algorithm
API String ID: 1294909896-3805148269
Opcode ID: b66bff930b9a99e2163571bbe8c7e35951551dbc2600129889dec36e78be12d4
Instruction ID: 188ce8b6820efbc49350918b7374f6d2220970084546bc16fd58d9022b685d7b
Opcode Fuzzy Hash: b66bff930b9a99e2163571bbe8c7e35951551dbc2600129889dec36e78be12d4
Instruction Fuzzy Hash: B571CE73A2C68245EB158B2298441F977A9FB05B8CF5C4536CA8D87757DFBCE185CB00

Function 00007FF6729C6C8D Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 165COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C6FAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7053

Strings

GMT, xrefs: 00007FF6729C6D3E
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF6729C6DB1
Serial Number, xrefs: 00007FF6729C6F82
Serial Number: %s, xrefs: 00007FF6729C6F9C
Signature Algorithm, xrefs: 00007FF6729C7027
Signature Algorithm: %s, xrefs: 00007FF6729C7041

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Serial Number$Signature Algorithm
API String ID: 1294909896-599393795
Opcode ID: 24409d74ef0c3c983000df88594ab0611bdd94340ab8b8c31497de981cb73665
Instruction ID: dae6d2ad374c078c1aa5f0b40c2d4f0c4852d5eb34a42dc2b2f0f84e48db0004
Opcode Fuzzy Hash: 24409d74ef0c3c983000df88594ab0611bdd94340ab8b8c31497de981cb73665
Instruction Fuzzy Hash: 6F61CF63A286D244EB158B3398041B97BA5BF45B8CF4C453ADA8D87757DFBCE581CB00

Function 00007FF6729C7724 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 130COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7B29
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7BF2

Strings

Public Key Algorithm, xrefs: 00007FF6729C7BA8
GMT, xrefs: 00007FF6729C7786
Public Key Algorithm: %s, xrefs: 00007FF6729C7BC2
Expire Date, xrefs: 00007FF6729C7AFD
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF6729C77D9
Expire Date: %s, xrefs: 00007FF6729C7B17

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$Expire Date$GMT$Public Key Algorithm
API String ID: 1294909896-1642401773
Opcode ID: ac3ae1ec92fe9eda962c1da221c990b855aa2862be8a4c7e9238d2ff60b43d35
Instruction ID: 4bd771e21a39dbd2fa91daa1378170a58f9a4602a9fb2be828b57ba374fea6ee
Opcode Fuzzy Hash: ac3ae1ec92fe9eda962c1da221c990b855aa2862be8a4c7e9238d2ff60b43d35
Instruction Fuzzy Hash: 66518E63A28B8695EB118B7294001F977A5BB45B8CF8C0535CE8D9B357DFBCE684CB00

Function 00007FF6729C6BC7 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 123COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C6FAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7053

Strings

GMT, xrefs: 00007FF6729C6C26
Serial Number, xrefs: 00007FF6729C6F82
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF6729C6C79
Serial Number: %s, xrefs: 00007FF6729C6F9C
Signature Algorithm, xrefs: 00007FF6729C7027
Signature Algorithm: %s, xrefs: 00007FF6729C7041

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Serial Number$Signature Algorithm
API String ID: 1294909896-3876350232
Opcode ID: 991e10a59c756c39dc960e4a496096ab80f054e50294d3ee2542f012545a078a
Instruction ID: 66430aaae5f2089ab62bf0c53dd38d36309dd018b49610ba66f4fbdc17763127
Opcode Fuzzy Hash: 991e10a59c756c39dc960e4a496096ab80f054e50294d3ee2542f012545a078a
Instruction Fuzzy Hash: CC517F63A28B8295EB118B7694001F977A1BB45B8CF4C0539CA8D97357DFBCE585CB00

Function 00007FF6729C7984 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C79BF
memcpy.VCRUNTIME140 ref: 00007FF6729C79E5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7B29
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7BF2

Strings

Public Key Algorithm, xrefs: 00007FF6729C7BA8
Public Key Algorithm: %s, xrefs: 00007FF6729C7BC2
Expire Date, xrefs: 00007FF6729C7AFD
Expire Date: %s, xrefs: 00007FF6729C7B17

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3401966785-2901970132
Opcode ID: faf1963ed05dd05ad384984308d4c276c6619af939163f9e00465d8b7c11df46
Instruction ID: 949c24052471886344e2d6ea5a91099ba332143cf9bce27d3337ef4e9f1f5bb5
Opcode Fuzzy Hash: faf1963ed05dd05ad384984308d4c276c6619af939163f9e00465d8b7c11df46
Instruction Fuzzy Hash: 9841A066A1878245EF158B6398041F967A5BF05B9CF4C0A35CE4D87797DEBCE1848B00

Function 00007FF6729B57E6 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B580D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B58C5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B58D1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B5908
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B597C

Strings

SYST, xrefs: 00007FF6729B58A6
Entry path is '%s', xrefs: 00007FF6729B58DE, 00007FF6729B5915
Failed to figure out path, xrefs: 00007FF6729B5982

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$malloc
String ID: Entry path is '%s'$Failed to figure out path$SYST
API String ID: 2190258309-1780565354
Opcode ID: 2bc02004d10b1fa802452eb04251b6e2d94f5a7f3797ce50d78a711d9206cef8
Instruction ID: c252b33c52e097d897bae4ac077a23a52e6c43e270d55b6c98ef4e386ff50d74
Opcode Fuzzy Hash: 2bc02004d10b1fa802452eb04251b6e2d94f5a7f3797ce50d78a711d9206cef8
Instruction Fuzzy Hash: 2C419373A296C2D5EB219B27E4102B867A0FB4579CF584431CE8D837A7DEBCD856CB00

Function 00007FF6729AC960 Relevance: 11.3, APIs: 9, Instructions: 89COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729ACA2C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729ACA3A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729ACA48
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729ACA56
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729ACA64
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729ACA72
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729ACA80
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729ACA8E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729ACA9C

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d2bf5ce6e59d74913779a6aff84d0731153e11b5c3adca26ad8de61eab2be0f5
Instruction ID: be45c0776f1564f5089db384a843957a34c970d2545411d195dff7a75207ca94
Opcode Fuzzy Hash: d2bf5ce6e59d74913779a6aff84d0731153e11b5c3adca26ad8de61eab2be0f5
Instruction Fuzzy Hash: 2741FD37D28B9282E761DF22D44027977B4FB88B58F484535DA8D97355CFB8D890CB80

Function 00007FF6729898A0 Relevance: 11.3, APIs: 9, Instructions: 68COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298991A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672989924
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298992E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672989938
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672989942
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298994C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672989956
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672989960
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672989969

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 3c6349e33358d1217792a263bd4ef89c8ce5e9f3ef4ce73052a32b19d8a3f52d
Instruction ID: 249067a2984ea27ef7489bcd4f85ea11af813600916d828aae740b870a9d2d53
Opcode Fuzzy Hash: 3c6349e33358d1217792a263bd4ef89c8ce5e9f3ef4ce73052a32b19d8a3f52d
Instruction Fuzzy Hash: 8631E937A28A91C1E7109F12E844169A764FB84FD9F0C0531DE8E97B69CFBDE545CB00

Function 00007FF6729897C0 Relevance: 11.3, APIs: 9, Instructions: 52COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672989807
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672989811
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298981B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672989825
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298982F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672989839
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672989843
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298984D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672989856

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4324a44497a7c09ff9883c1211127848d5db36abdc802fe6cc27a84d06c5bd9e
Instruction ID: fa548d13e0c07cd0f5605994f595a676dc338786b48692dadf3a3b6959f32917
Opcode Fuzzy Hash: 4324a44497a7c09ff9883c1211127848d5db36abdc802fe6cc27a84d06c5bd9e
Instruction Fuzzy Hash: C2218837A28A81C2E710DF62E854069A364FB88F99F180531DE8D93729CFBCD4998B40

Function 00007FF6729899C0 Relevance: 11.3, APIs: 9, Instructions: 32COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729899D9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729899E3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729899ED
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729899F7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672989A01
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672989A0B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672989A15
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672989A1F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672989A28

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a301b36d456e24db524119d8642cbca10183247d752d742f16f73bf9139d7298
Instruction ID: 25fa6e1798cd3b5aeb064515ddf90b7255802684f8909a7839761b63b64ebabd
Opcode Fuzzy Hash: a301b36d456e24db524119d8642cbca10183247d752d742f16f73bf9139d7298
Instruction Fuzzy Hash: DE016737A34A41C2EB04DF62ED54068A320FB88F9AB081531CD8E92735CEBCE8998740

Function 00007FF6729C36D0 Relevance: 10.9, APIs: 5, Strings: 2, Instructions: 424stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,00007FF6729C2AE3), ref: 00007FF6729C3778
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,00007FF6729C2AE3), ref: 00007FF6729C37BA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00007FF6729C2AE3), ref: 00007FF6729C385F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00007FF6729C2AE3), ref: 00007FF6729C3872
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C3D57

Strings

Failed to encode DOH packet [%d], xrefs: 00007FF6729C38B1
%s?dns=%s, xrefs: 00007FF6729C3848

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$memcpystrchr
String ID: %s?dns=%s$Failed to encode DOH packet [%d]
API String ID: 1438451818-3030351490
Opcode ID: 82bc53f84c1080ae032cbc6df8f69e041b8db7bc5c03bc76c234bbc572488a28
Instruction ID: 168de2df4f682e92930a80ae4e79108a8c39170795a7e70ca996b9a1db853dd3
Opcode Fuzzy Hash: 82bc53f84c1080ae032cbc6df8f69e041b8db7bc5c03bc76c234bbc572488a28
Instruction Fuzzy Hash: B1029C63B2878346F7119AB798447B92795AB85B9CF0D4135DE0CC7B87DEF8E8848B04

Function 00007FF6729A7930 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 165stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF67298A95A,?,?,?,?,?,?,?,00007FF67298A727), ref: 00007FF6729A7941
strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF6729A7AE3
strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF6729A7B00

Strings

0123456789abcdef, xrefs: 00007FF6729A7AD2, 00007FF6729A7ADC
0123456789ABCDEF, xrefs: 00007FF6729A7AF2, 00007FF6729A7AF9
TRUE, xrefs: 00007FF6729A7A6C

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: strchr$_errno
String ID: 0123456789ABCDEF$0123456789abcdef$TRUE
API String ID: 2644425738-1191287149
Opcode ID: d000488c619edf59d83c7ce8e9535076ed59e5745e2b7226eb6187664dd6f18e
Instruction ID: 65a44a5d81e62a27e9ab4223edb8b0ba0ab816d7972280be3c0b3068f42d5aba
Opcode Fuzzy Hash: d000488c619edf59d83c7ce8e9535076ed59e5745e2b7226eb6187664dd6f18e
Instruction Fuzzy Hash: CD511453E2D78641EF619B26A4421FE73B0EB85B8CF9C4135DA4D86346EEBCE541CB00

Function 00007FF6729891AC Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729891B2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729893A1

Strings

Replaced, xrefs: 00007FF672989631
Added, xrefs: 00007FF67298963D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF672989647
FALSE, xrefs: 00007FF67298937B

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 1169197092-2292467869
Opcode ID: c0909fe2cdf2a7880f9f085e41a63babe4e5bd2286b78ef4bec303a21daba0e1
Instruction ID: 4759c5a430bcab471b2afa6d93c3424d50c2a8d08a20b845cc352c5bb7732fcf
Opcode Fuzzy Hash: c0909fe2cdf2a7880f9f085e41a63babe4e5bd2286b78ef4bec303a21daba0e1
Instruction Fuzzy Hash: 62611A63A2978245FE719B2794443BA67A0AF4575CF4C4036DE8E82793DFACF685CB00

Function 00007FF6729C965A Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 154COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C9963
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C9977
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C99DE

Strings

GMT, xrefs: 00007FF6729C970E
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF6729C9781
TRUE, xrefs: 00007FF6729C993D

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: isupper$free
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$TRUE
API String ID: 573759493-910067264
Opcode ID: 7508f70eca448fbad623f97c0d58f067d9e27dd40cec46a1315b959460e7d627
Instruction ID: eae08014e39320346bc47bbf87b7625c431a6b9dc94f4dba1027adb2f0dd6a55
Opcode Fuzzy Hash: 7508f70eca448fbad623f97c0d58f067d9e27dd40cec46a1315b959460e7d627
Instruction Fuzzy Hash: B061F623E2C5D684FB158F3695042797B94EB01B8CF5C4632C58DC2A96EFBCD681CB00

Function 00007FF672989349 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67298934C

Part of subcall function 00007FF6729A7720: strchr.VCRUNTIME140 ref: 00007FF6729A7756

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729893A1

Strings

Replaced, xrefs: 00007FF672989631
Added, xrefs: 00007FF67298963D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF672989647
FALSE, xrefs: 00007FF67298937B

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdup$strchr
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 3404610657-2292467869
Opcode ID: f5bfa94a21e5a2cd1f52fb9da97d7aad9ad16aee0efa89024457b666e086c78b
Instruction ID: bb8dfe40e572d0e7d02db0fb8fcdf9a4ff6700ad89c0ab52836918585fb33ca8
Opcode Fuzzy Hash: f5bfa94a21e5a2cd1f52fb9da97d7aad9ad16aee0efa89024457b666e086c78b
Instruction Fuzzy Hash: A7611A63A2968245FE719B2794443BA67A0AF4575CF4C4036DA8E82793DFACF6848B00

Function 00007FF6729B3430 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 146stringCOMMON

Download Yara Rule

APIs

strstr.VCRUNTIME140 ref: 00007FF6729B34F3

Strings

Maxdownload = %I64d, xrefs: 00007FF6729B358C, 00007FF6729B362B
RETR response: %03d, xrefs: 00007FF6729B3488
bytes, xrefs: 00007FF6729B34E9
Data conn was not available immediately, xrefs: 00007FF6729B35E7
, xrefs: 00007FF6729B3497
Getting file with size: %I64d, xrefs: 00007FF6729B35A5

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: strstr
String ID: $ bytes$Data conn was not available immediately$Getting file with size: %I64d$Maxdownload = %I64d$RETR response: %03d
API String ID: 1392478783-2096918210
Opcode ID: f3eefc1fe7cf2eb6f1783ef9009c17f7cab3792f8ade0a95222f90c7e434a887
Instruction ID: 33082dd94e130fd1ea485a62086a29ff3e5b72a13ff013f6ef41094918181ed9
Opcode Fuzzy Hash: f3eefc1fe7cf2eb6f1783ef9009c17f7cab3792f8ade0a95222f90c7e434a887
Instruction Fuzzy Hash: 8E51B563A18785C5EB25C726A4442B97291EB45778F8C0235DA5C82ED7DFFCE4868B04

Function 00007FF6729B02F0 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B033A
memcpy.VCRUNTIME140 ref: 00007FF6729B0451
memcpy.VCRUNTIME140 ref: 00007FF6729B04C2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B04EE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B0500

Strings

Failed to alloc scratch buffer!, xrefs: 00007FF6729B0350

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: freememcpy$malloc
String ID: Failed to alloc scratch buffer!
API String ID: 169112436-1446904845
Opcode ID: 2911e9d9862181d0d23f3f2179dd06e8a51e3eba0696f77bbfe9040c1eead9c1
Instruction ID: 175d2c8703f4c9b33709ca9e31aeae8e60a05c1ffd6e93da722ed8ff346e55a1
Opcode Fuzzy Hash: 2911e9d9862181d0d23f3f2179dd06e8a51e3eba0696f77bbfe9040c1eead9c1
Instruction Fuzzy Hash: 3751BF33A287C19AE664CB66E5406EAB7A0FB09788F480535DF8D83752DF7CE164CB00

Function 00007FF6729B3200 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 145networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF6729B33A6

Part of subcall function 00007FF6729CA530: memcpy.VCRUNTIME140 ref: 00007FF6729CA5D8
Part of subcall function 00007FF6729CA530: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729CA5E9

Strings

QUOT string not accepted: %s, xrefs: 00007FF6729B33CF
We got a 421 - timeout!, xrefs: 00007FF6729B33E5
*, xrefs: 00007FF6729B3374
FTP response timeout, xrefs: 00007FF6729B3413
FTP response aborted due to select/poll error: %d, xrefs: 00007FF6729B33B4

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: ErrorLastfreememcpy
String ID: *$FTP response aborted due to select/poll error: %d$FTP response timeout$QUOT string not accepted: %s$We got a 421 - timeout!
API String ID: 1248052217-2335292235
Opcode ID: 92ad066e7cf2b41f79d709ed2b0dd671db1923be8338fc5a32b28ec1310911d6
Instruction ID: 7db4094760e311cf72da72004c096d14c9bf6980bd369d55f72df6b10dcdf471
Opcode Fuzzy Hash: 92ad066e7cf2b41f79d709ed2b0dd671db1923be8338fc5a32b28ec1310911d6
Instruction Fuzzy Hash: 7F519523A2C682D5FB64DA2795043BA2391BB85798F8C4135DE4DC7AC3EFBCE4458B04

Function 00007FF672998450 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 144COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C2174
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C219A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C21A8

Strings

Digest, xrefs: 00007FF672998478
stale, xrefs: 00007FF6729C20FF
true, xrefs: 00007FF6729C2114

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: Digest$stale$true
API String ID: 1294909896-2487968700
Opcode ID: 5e083c3b28abd34dce874b12143eca139322f8b1c265274bf5555b72504f67ad
Instruction ID: 7cdcdb8293da77cc5022a66193a76f4bde4403642f3ddd3a0318fd6e56450422
Opcode Fuzzy Hash: 5e083c3b28abd34dce874b12143eca139322f8b1c265274bf5555b72504f67ad
Instruction Fuzzy Hash: C2515623D2868286EB608B26A8503B96390FF45B98F5C4231DB9DC76D7DF6CD595CB00

Function 00007FF6729723A0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF672976E00: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF6729723FB), ref: 00007FF672976E7E
Part of subcall function 00007FF672976E00: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF6729723FB), ref: 00007FF672976E8C
Part of subcall function 00007FF672976E00: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF6729723FB), ref: 00007FF672976EA2

Part of subcall function 00007FF672973BE0: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF672971DBB), ref: 00007FF672973C26

Part of subcall function 00007FF672975E00: memcpy.VCRUNTIME140(?,?,?,00007FF672971DEA), ref: 00007FF672975E91

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672972499
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729724D8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672972526
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672972574

Strings

, column , xrefs: 00007FF672972429
at line , xrefs: 00007FF6729723EC

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturn
String ID: at line $, column
API String ID: 2665656946-191570568
Opcode ID: 15e0b2872fbc33c4a2dbb2bdf92b5e1f85169dc5fbac5f9a365335660fdb23de
Instruction ID: 9a584be3fa44e0a6ae273a84c3e9fa69bb1e9005ca5d9e48bc872c395a979e02
Opcode Fuzzy Hash: 15e0b2872fbc33c4a2dbb2bdf92b5e1f85169dc5fbac5f9a365335660fdb23de
Instruction Fuzzy Hash: 1F51BF63F24A8186FB00CBB6D4543AC3321EB44BECF545235DA6D52BEADEB894859340

Function 00007FF672974A30 Relevance: 10.6, APIs: 7, Instructions: 133COMMON

Download Yara Rule

APIs

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,00000000,?,?,00007FF67297317B,?,?,?,00007FF672973134), ref: 00007FF672974AC3
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,?,00000000,?,?,00007FF67297317B,?,?,?,00007FF672973134), ref: 00007FF672974B17
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,?,00000000,?,?,00007FF67297317B,?,?,?,00007FF672973134), ref: 00007FF672974B3E
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,?,00000000,?,?,00007FF67297317B,?,?,?,00007FF672973134), ref: 00007FF672974B66
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,00000000,?,?,00007FF67297317B,?,?,?,00007FF672973134), ref: 00007FF672974BAC
?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,00000000,?,?,00007FF67297317B,?,?,?,00007FF672973134), ref: 00007FF672974BB3
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140(?,?,00000000,?,?,00007FF67297317B,?,?,?,00007FF672973134), ref: 00007FF672974BC0

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 1492985063-0
Opcode ID: 8d1e933b32d01b2dd2de9809d640aa598a1230861a3adeee3272f4e38bd4e7ba
Instruction ID: d2090e7960919bb71846f7eaf8db3e7811e68cf75642c24135367f8682cb2c6c
Opcode Fuzzy Hash: 8d1e933b32d01b2dd2de9809d640aa598a1230861a3adeee3272f4e38bd4e7ba
Instruction Fuzzy Hash: 4451652761864181EB258F1AE58033CB7B0FB85F99F19D635CA5E837A2CF79D8429B04

Function 00007FF6729C0B60 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 129COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,Negotiate,?,00007FF6729A44F6), ref: 00007FF6729C0CBD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,Negotiate,?,00007FF6729A44F6), ref: 00007FF6729C0CD3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C0CE5

Strings

Proxy-, xrefs: 00007FF6729C0C8D
Curl_output_negotiate, no persistent authentication: cleanup existing context, xrefs: 00007FF6729C0C11
%sAuthorization: Negotiate %s, xrefs: 00007FF6729C0C9E
Negotiate, xrefs: 00007FF6729C0B66, 00007FF6729C0C42

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: %sAuthorization: Negotiate %s$Curl_output_negotiate, no persistent authentication: cleanup existing context$Negotiate$Proxy-
API String ID: 1294909896-1255959952
Opcode ID: d2d383da439ed67b25530f3826ac251d04be643363f622f9ba8fe52b92a16719
Instruction ID: 7db7c11bb28a415d29f57452d0043fed23fad8ce71b49211bbc56be81c866acd
Opcode Fuzzy Hash: d2d383da439ed67b25530f3826ac251d04be643363f622f9ba8fe52b92a16719
Instruction Fuzzy Hash: 4B51A133A1868696FB91CB26E4802BD6790FB50B9CF480131DA8CC3682DFB9E495CB50

Function 00007FF6729BCB30 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 109COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6729BCB48
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6729BCCB1

Strings

gfff, xrefs: 00007FF6729BCC28
set timeouts for state %d; Total %ld, retry %d maxtry %d, xrefs: 00007FF6729BCC8C
Connection time-out, xrefs: 00007FF6729BCB6B
gfff, xrefs: 00007FF6729BCBBC

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _time64
String ID: Connection time-out$gfff$gfff$set timeouts for state %d; Total %ld, retry %d maxtry %d
API String ID: 1670930206-870032562
Opcode ID: 96d8e795d8dc0221def0faa5de9f761ed58ff8dc1ee8509011a82a4cfeb79321
Instruction ID: 3b30b0bbf0f02b8e8002e056fe2d58cfd648f1a6a4cbf26964e797462461a167
Opcode Fuzzy Hash: 96d8e795d8dc0221def0faa5de9f761ed58ff8dc1ee8509011a82a4cfeb79321
Instruction Fuzzy Hash: C041D177B24615CADB24CF2BE00066873A0E798B8CF685035DA0CCBB95DE79E551CB40

Function 00007FF67299C390 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 106COMMON

Download Yara Rule

APIs

fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF67299C4DA

Strings

ioctl callback returned error %d, xrefs: 00007FF67299C49F
seek callback returned error %d, xrefs: 00007FF67299C42E
the ioctl callback returned %d, xrefs: 00007FF67299C485
Cannot rewind mime/post data, xrefs: 00007FF67299C510
necessary data rewind wasn't possible, xrefs: 00007FF67299C4E5

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: fseek
String ID: Cannot rewind mime/post data$ioctl callback returned error %d$necessary data rewind wasn't possible$seek callback returned error %d$the ioctl callback returned %d
API String ID: 623662203-959247533
Opcode ID: 4cb51b8f7b3c6420dcb1a42218714fde17280e2795559b8cce4f73910a518404
Instruction ID: 1c16ed370a7f5cd1de3691e73d849795d32cea5dbc3b9142294485672cb6761e
Opcode Fuzzy Hash: 4cb51b8f7b3c6420dcb1a42218714fde17280e2795559b8cce4f73910a518404
Instruction Fuzzy Hash: 58417767B2864145E7549B27A4403B92391EBC9BACF9C2031DD4DCB68ADEBDD4948F10

Function 00007FF6729C7640 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7B29
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7BF2

Strings

Public Key Algorithm, xrefs: 00007FF6729C7BA8
Public Key Algorithm: %s, xrefs: 00007FF6729C7BC2
Expire Date, xrefs: 00007FF6729C7AFD
%s%lx, xrefs: 00007FF6729C769D
Expire Date: %s, xrefs: 00007FF6729C7B17

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$%s%lx$Expire Date$Public Key Algorithm
API String ID: 1294909896-3155708153
Opcode ID: 6abb169fce306cc574bdf74e27b14dd5f75b228d61501ddae04e26c30ac2afe5
Instruction ID: 36582ba58df7b9c10648ee5b77b2616c598e3ece3a3bd9b1c30f089a9fbad176
Opcode Fuzzy Hash: 6abb169fce306cc574bdf74e27b14dd5f75b228d61501ddae04e26c30ac2afe5
Instruction Fuzzy Hash: E041AD63A2868259EF159B7398001F967A5BF05B8CF4C0935CE8D8A787DFBCE1848B00

Function 00007FF6729C6B01 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C6FAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7053

Strings

Serial Number, xrefs: 00007FF6729C6F82
%s%lx, xrefs: 00007FF6729C6B56
Serial Number: %s, xrefs: 00007FF6729C6F9C
Signature Algorithm: %s, xrefs: 00007FF6729C7041
Signature Algorithm, xrefs: 00007FF6729C7027

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$%s%lx$Serial Number$Signature Algorithm
API String ID: 1294909896-659367561
Opcode ID: 230d1f76593cb9ca8ce2cd6d09faa35744d3473a0d836651f12b3eab05c61cda
Instruction ID: a2b1d72cdc9a34797e128b769c9a08e0fe9c4910d1116ceda2b973a44b645845
Opcode Fuzzy Hash: 230d1f76593cb9ca8ce2cd6d09faa35744d3473a0d836651f12b3eab05c61cda
Instruction Fuzzy Hash: AE41C363A2878245EE158B7394101F96B91BF45B8CF4C0939CE4E87747DEBCE1848B00

Function 00007FF6729C97ED Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C9828
memcpy.VCRUNTIME140 ref: 00007FF6729C984D
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C9963
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C9977
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C99DE

Strings

TRUE, xrefs: 00007FF6729C993D

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: isupper$freemallocmemcpy
String ID: TRUE
API String ID: 2172629687-3412697401
Opcode ID: 025627bed9b3f6bb5b42eb1cd5d59a074ddd3b35ae260d66b5a09de62ff4d497
Instruction ID: e9b5539167eb6af3a9223facc1748b29b88f4f7739d24aad8b5529549b13f7b1
Opcode Fuzzy Hash: 025627bed9b3f6bb5b42eb1cd5d59a074ddd3b35ae260d66b5a09de62ff4d497
Instruction Fuzzy Hash: 6731F713E2D69245FB1ACB3785443786B91AF15F98F1C0731C99EC2AD7EEAC9281CB00

Function 00007FF6729C0460 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6729ABF70: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729904E9,?,?,?,?,00007FF67298F88B), ref: 00007FF6729ABF98
Part of subcall function 00007FF6729ABF70: GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF6729904E9,?,?,?,?,00007FF67298F88B), ref: 00007FF6729ABFBE
Part of subcall function 00007FF6729ABF70: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729904E9,?,?,?,?,00007FF67298F88B), ref: 00007FF6729ABFDF
Part of subcall function 00007FF6729ABF70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729904E9,?,?,?,?,00007FF67298F88B), ref: 00007FF6729ABFF0

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C04FF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C0548
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C0551

Strings

HOME, xrefs: 00007FF6729C0499
%s%s_netrc, xrefs: 00007FF6729C0514
%s%s.netrc, xrefs: 00007FF6729C04BF

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$realloc$EnvironmentVariable
String ID: %s%s.netrc$%s%s_netrc$HOME
API String ID: 4174189579-3384076093
Opcode ID: b869fc200caa22f51e408745042efcd56d544b49642b4d97719db25c294e09e5
Instruction ID: 5d7d155cf4c727cb2511d191d3fc743bcbe965d2549bf11e68da0e7b602bd490
Opcode Fuzzy Hash: b869fc200caa22f51e408745042efcd56d544b49642b4d97719db25c294e09e5
Instruction Fuzzy Hash: 7C317623A28B8182DA50DB27B800166B3A0FF44FD8F5C4631ED8C87756EF7CE5458B44

Function 00007FF6729AE966 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF67298AB50: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF67298AB94

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729AE9A4
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729AE9B6

Strings

OK [UIDVALIDITY %19[0123456789]], xrefs: 00007FF6729AE988
Select failed, xrefs: 00007FF6729AEA48
Mailbox UIDVALIDITY has changed, xrefs: 00007FF6729AE9EE

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: __stdio_common_vsscanf_strdupfree
String ID: Mailbox UIDVALIDITY has changed$OK [UIDVALIDITY %19[0123456789]]$Select failed
API String ID: 860312144-3309259123
Opcode ID: 69eb5151cf844d15431584245605bc794f59789ef45b3a786a60099332dc6132
Instruction ID: 307b727075a93b63d3fb263aa2577f2d7b8d5a992031fe1d988803cb0b382495
Opcode Fuzzy Hash: 69eb5151cf844d15431584245605bc794f59789ef45b3a786a60099332dc6132
Instruction Fuzzy Hash: 27314B27E287C286EB649B27D0501BD2360BF84B9CF580431DA8E87697DFBCE851CB41

Function 00007FF6729C7D15 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C7D18
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C8129
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C8169
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C817C

Part of subcall function 00007FF672990270: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729902C2

Strings

Signature, xrefs: 00007FF6729C80FF
Signature: %s, xrefs: 00007FF6729C8117

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: Signature: %s$Signature
API String ID: 1941130848-1663925961
Opcode ID: d2b0390003bde4f3d8c9d9a099129285d2a086d2a1d485c90c926fea41e374f1
Instruction ID: ac18f0017aee338503ce7d0fab6dec0b0a3859c0c6a88de29c4b46dce65a06ef
Opcode Fuzzy Hash: d2b0390003bde4f3d8c9d9a099129285d2a086d2a1d485c90c926fea41e374f1
Instruction Fuzzy Hash: 33218367A1868286EA51CB23A4442FAA3A0FB85B98F480531DE4D57767DE7CD145CB00

Function 00007FF672995670 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729956A5
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729956D1
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729956D9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF6729929EC), ref: 00007FF6729956FB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF6729929EC), ref: 00007FF672995712

Strings

Invalid zoneid: %s; %s, xrefs: 00007FF6729956E4

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$_errnostrerrorstrtoul
String ID: Invalid zoneid: %s; %s
API String ID: 439826447-2159854051
Opcode ID: a577736e6cc84a33cf28ac3ab062d474e5c2e04be8e8fa538a07e0bdc373823c
Instruction ID: c7eb085b34cc209af41abe69be8b62dbb16a98d375a60f22243a8c64515273f6
Opcode Fuzzy Hash: a577736e6cc84a33cf28ac3ab062d474e5c2e04be8e8fa538a07e0bdc373823c
Instruction Fuzzy Hash: 08115E77A29A42D6EB109B62E84017973A0FFC5B5CF5C1031DA4D836A6DEADD994CF00

Function 00007FF6729955A0 Relevance: 10.0, APIs: 8, Instructions: 36COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729955B4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729955CA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729955DE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729955F2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF672995606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF67299561A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF67299562E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF672995642

Part of subcall function 00007FF6729BE540: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF67299565B,?,?,00000000,00007FF6729910A3,?,?,00000000,00007FF672991625), ref: 00007FF6729BE555

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 0ac56f9f3095a765d70fd7ee3fbadc727edcd2fa7d841a7ff76cc8dd65d9388f
Instruction ID: 24156292e4478bff73b86fe24c379b84a83896a07f73d33bdef6cd955211d8cb
Opcode Fuzzy Hash: 0ac56f9f3095a765d70fd7ee3fbadc727edcd2fa7d841a7ff76cc8dd65d9388f
Instruction Fuzzy Hash: DE115237928E81C1D700DF62ED940E863A4FBC9B9AF180535DE8E8E669DF7890958610

Function 00007FF67298A7E0 Relevance: 10.0, APIs: 8, Instructions: 23COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298A7ED
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298A7F7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298A801
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298A80B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298A815
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298A81F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298A829
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298A833

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 68c759e749b78e890934f347d39feda483829c2dc72f88ccd59fc80c8563f15f
Instruction ID: c87a7abb1771fe0180dfd35cde404bedade9ef68b89b0cb6b6741a04534977a9
Opcode Fuzzy Hash: 68c759e749b78e890934f347d39feda483829c2dc72f88ccd59fc80c8563f15f
Instruction Fuzzy Hash: BAF0E437A34941C2D714DFA2EC540686330FB88F5AF181531CD4E96235CEB8D899C640

Function 00007FF672992150 Relevance: 9.2, APIs: 6, Instructions: 161COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF6729929CB), ref: 00007FF672992167
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF6729929CB), ref: 00007FF672992198

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: 60a397edcec825f9182ffd100ce317656e274da55a106e4871860feaabab515f
Instruction ID: df246a53bc61915841a5570ddb49e80ea9da7c82ca37038ef7ec0fa0e49ad016
Opcode Fuzzy Hash: 60a397edcec825f9182ffd100ce317656e274da55a106e4871860feaabab515f
Instruction Fuzzy Hash: 0E915B27A19BC18AD7558F3594403ED77A0FB96B28F0C0235CBAC4B3D6DF6991A4CB21

Function 00007FF6729C740C Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C744F
memcpy.VCRUNTIME140 ref: 00007FF6729C7475
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7548
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C75B9

Strings

Start Date: %s, xrefs: 00007FF6729C75A7
Start Date, xrefs: 00007FF6729C758D

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Start Date: %s$Start Date
API String ID: 3401966785-2389359183
Opcode ID: f3c9926e1f9a7d1c51bc7e4bb02957d0861b4bfa4a35134bcd73b3548f8c2f74
Instruction ID: 8a400501b819348c156d331902d8492c97fb1120f5855f7f89e32d56fd93b25d
Opcode Fuzzy Hash: f3c9926e1f9a7d1c51bc7e4bb02957d0861b4bfa4a35134bcd73b3548f8c2f74
Instruction Fuzzy Hash: A9413753A292C246EB19873744142F92B96FB05BA8F0C4735CA5F877D7DDACE185CB10

Function 00007FF67297C630 Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF67297C71A
memcpy.VCRUNTIME140 ref: 00007FF67297C729
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF67297C75D
memcpy.VCRUNTIME140 ref: 00007FF67297C764
memcpy.VCRUNTIME140 ref: 00007FF67297C773
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF67297C798

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: 78c2b8e93ec47cdde9f1bc7ef5506b44f8f4ae7c003568ea7a19bcbb7900a274
Instruction ID: 15a01335ed347894a222e8596e669db25be4b6982263c5a2cb51aee3eab17650
Opcode Fuzzy Hash: 78c2b8e93ec47cdde9f1bc7ef5506b44f8f4ae7c003568ea7a19bcbb7900a274
Instruction Fuzzy Hash: 7E31CE2372974285EE149B27A6442A8A255EB44BF8F584A32DE6D877D6DFBCE081C700

Function 00007FF672998830 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32 ref: 00007FF672998915
VerSetConditionMask.KERNEL32 ref: 00007FF672998924
VerSetConditionMask.KERNEL32 ref: 00007FF672998936
VerSetConditionMask.KERNEL32 ref: 00007FF672998948
VerSetConditionMask.KERNEL32 ref: 00007FF67299895E
VerifyVersionInfoA.KERNEL32 ref: 00007FF672998971

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: 459f58616a6db70f8576c3bdb84d9d94c14690a588e5776f927a63ce7b377b60
Instruction ID: 4cd654a87a10078ec217cabc10db4dc84d978b1bb9d2d12bfb28b63a0139ed20
Opcode Fuzzy Hash: 459f58616a6db70f8576c3bdb84d9d94c14690a588e5776f927a63ce7b377b60
Instruction Fuzzy Hash: C641D863E2C6828AF2308B53A4147BAB360FBE5308F185239DAD942B55DF7DE4919F00

Function 00007FF6729C793F Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 98COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7B29
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7BF2

Strings

Public Key Algorithm, xrefs: 00007FF6729C7BA8
Public Key Algorithm: %s, xrefs: 00007FF6729C7BC2
Expire Date, xrefs: 00007FF6729C7AFD
Expire Date: %s, xrefs: 00007FF6729C7B17

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 1294909896-2901970132
Opcode ID: 55e703a286eb12d4a17305838dc27a2fccd8001fb36dc054bff373a79864cbba
Instruction ID: 67441b5e52f0f31f0e95b1814f12df9e460c264cb1292254076450ef3e4ad58a
Opcode Fuzzy Hash: 55e703a286eb12d4a17305838dc27a2fccd8001fb36dc054bff373a79864cbba
Instruction Fuzzy Hash: 7E419E77A187C249EB158B6298041F967A5BB05B9CF4C0A35CE4D9B797DFB8E184CB00

Function 00007FF6729C22D0 Relevance: 9.1, APIs: 6, Instructions: 93stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(00000000,?,?,00007FF6729C188F), ref: 00007FF6729C2316
strchr.VCRUNTIME140(00000000,?,?,00007FF6729C188F), ref: 00007FF6729C2326
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,00007FF6729C188F), ref: 00007FF6729C2350
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C2385
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C23AA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C23CC

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdupstrchr$mallocstrncpy
String ID:
API String ID: 2121287944-0
Opcode ID: 9978dde7b987217af602c33b0267b1ac9a0e33f1014f2c23a18e07962d9056ce
Instruction ID: dbd711276830cd999a2b0f0359b1d4af06c92a4144745cc006afb43faa53465e
Opcode Fuzzy Hash: 9978dde7b987217af602c33b0267b1ac9a0e33f1014f2c23a18e07962d9056ce
Instruction Fuzzy Hash: 29317322E19B8186EA55DF27A9502796690FB45F94F1C4734DE8E83792DF7CE0819B00

Function 00007FF6729CD880 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729CD929
memcpy.VCRUNTIME140 ref: 00007FF6729CD945
memcpy.VCRUNTIME140 ref: 00007FF6729CD95C
memcpy.VCRUNTIME140 ref: 00007FF6729CD977
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729CD9AA

Strings

PLAIN, xrefs: 00007FF6729CD88B

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: memcpy$freemalloc
String ID: PLAIN
API String ID: 3313557100-4000620671
Opcode ID: 828c848f34afd895875ce4f54e250403d4790207be34086366fe5dacd511e85a
Instruction ID: 1e008ca7a5e859c09a40666777b4565d1bf8c8c2ba08dc4139384414a8aab0cb
Opcode Fuzzy Hash: 828c848f34afd895875ce4f54e250403d4790207be34086366fe5dacd511e85a
Instruction Fuzzy Hash: B431D367A18B8182EB108F22E4402AAA790FB45FE8F484631DF9C877D6DE7CD045C710

Function 00007FF6729C76B5 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7B29
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7BF2

Strings

Public Key Algorithm, xrefs: 00007FF6729C7BA8
Public Key Algorithm: %s, xrefs: 00007FF6729C7BC2
Expire Date, xrefs: 00007FF6729C7AFD
Expire Date: %s, xrefs: 00007FF6729C7B17

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 1294909896-2901970132
Opcode ID: d65cbea78542c97003cce332014c1230696a1ca430f5e301204b62b9317b9b4b
Instruction ID: 886eef0421e0e30ca997cc4758a78f290de5b7583f5f6b8e72919f7633173931
Opcode Fuzzy Hash: d65cbea78542c97003cce332014c1230696a1ca430f5e301204b62b9317b9b4b
Instruction Fuzzy Hash: C3318D67A2878255EB169B7398001F967A5BF05B8CF4C0935CE4D9B757DFBCE1848B00

Function 00007FF6729AF961 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 85stringCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729AF9E6
memcpy.VCRUNTIME140 ref: 00007FF6729AFA01
strchr.VCRUNTIME140 ref: 00007FF6729AFA1D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729AFA2E

Strings

CAPA, xrefs: 00007FF6729AFA44
Got unexpected pop3-server response, xrefs: 00007FF6729AF981

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: callocfreememcpystrchr
String ID: CAPA$Got unexpected pop3-server response
API String ID: 2887963327-1591402739
Opcode ID: 92ca2e4df3dc446bd5f76ca753b447debfc1943a7c9500b1e95c89074e5b8aec
Instruction ID: 78981e39f28dbe20af12b617e09559fadf69e44b17c61772f5be2f669d1a8e80
Opcode Fuzzy Hash: 92ca2e4df3dc446bd5f76ca753b447debfc1943a7c9500b1e95c89074e5b8aec
Instruction Fuzzy Hash: EB316063F2978291EB159B2390402B962B0FB45758F580636CF1E836A3EFBDA565CB01

Function 00007FF6729C7706 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6729C8830: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C887C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7B29
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7BF2

Part of subcall function 00007FF672990270: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729902C2

Strings

Public Key Algorithm, xrefs: 00007FF6729C7BA8
Public Key Algorithm: %s, xrefs: 00007FF6729C7BC2
Expire Date, xrefs: 00007FF6729C7AFD
Expire Date: %s, xrefs: 00007FF6729C7B17

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: freemalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3061335427-2901970132
Opcode ID: 0338c75ce66ddb898541405e71a66964a07be5d2b0034bfb6d01fa5e092aedf2
Instruction ID: 0532d8485879aea9c14ec8bf2435faf424c22645a87e98e6d7a7403420f1854f
Opcode Fuzzy Hash: 0338c75ce66ddb898541405e71a66964a07be5d2b0034bfb6d01fa5e092aedf2
Instruction Fuzzy Hash: 1F319E67A2878255EB168B7298001F967A5BF05B8CF4C0939CE4D9B757DFBCE184CB00

Function 00007FF6729C76D3 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6729CA340: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729CA375

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7B29
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7BF2

Part of subcall function 00007FF672990270: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729902C2

Strings

Public Key Algorithm, xrefs: 00007FF6729C7BA8
Public Key Algorithm: %s, xrefs: 00007FF6729C7BC2
Expire Date, xrefs: 00007FF6729C7AFD
Expire Date: %s, xrefs: 00007FF6729C7B17

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: freemalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3061335427-2901970132
Opcode ID: 944a2b51398f1bca8023ee2cea3d41b77d1dca4767d27e598cae27c46d17888c
Instruction ID: ea48a1db292153b41ad25660ac8e21e1ffe279991c4ff9b9e526fc992343e4e8
Opcode Fuzzy Hash: 944a2b51398f1bca8023ee2cea3d41b77d1dca4767d27e598cae27c46d17888c
Instruction Fuzzy Hash: 19317E67A1878255EB168B7298011F967A5BF05B8CF4C0939CE4D9B757DFBCE1848B00

Function 00007FF6729C7C70 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C8129
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C8169
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C817C

Strings

Signature, xrefs: 00007FF6729C80FF
%s%lx, xrefs: 00007FF6729C7CCD
Signature: %s, xrefs: 00007FF6729C8117

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$%s%lx$Signature
API String ID: 2190258309-1406629954
Opcode ID: 27cfa11cbbfe45e45ee5de279e6cfd354cbce46847a4146959396e01ac7e941a
Instruction ID: ef8f136f8108dcb42882db2bfa559eb754d61a233aaf4311e8afe50899404580
Opcode Fuzzy Hash: 27cfa11cbbfe45e45ee5de279e6cfd354cbce46847a4146959396e01ac7e941a
Instruction Fuzzy Hash: EB31B263B2868286EE118B27A4442F9A7A0FF49BCCF5C0531DE8D87757DE6CE041CB40

Function 00007FF6729C6B71 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 80COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C6FAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7053

Strings

Serial Number, xrefs: 00007FF6729C6F82
Serial Number: %s, xrefs: 00007FF6729C6F9C
Signature Algorithm: %s, xrefs: 00007FF6729C7041
Signature Algorithm, xrefs: 00007FF6729C7027

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 1294909896-517259162
Opcode ID: 3b035fefb13404765a282561fb25b08b8e0faacd4ccd34463eb74d98d00c4a7d
Instruction ID: ae99c4ba25a9161ddd7a9adce8ecdfa42a92f1b2e30694c1f9b72647130a06e3
Opcode Fuzzy Hash: 3b035fefb13404765a282561fb25b08b8e0faacd4ccd34463eb74d98d00c4a7d
Instruction Fuzzy Hash: 88319C63A2978255EF168B7394001F967A1BF45B8CF4C0939CE4E9B397DEBCE1848B00

Function 00007FF6729B7D00 Relevance: 9.1, APIs: 6, Instructions: 80COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B7D11
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729B7D7D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B7D8F

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdupcallocfree
String ID:
API String ID: 1236595397-0
Opcode ID: 18e51c7933e36dbe072fc1e6b9de0d7a764243fc1643ae9b43aad4505edc27b6
Instruction ID: 069926ba7c528b4d254d43779c04f8c9b8b59a44ba8844e1ec2bb6c3f7a193ad
Opcode Fuzzy Hash: 18e51c7933e36dbe072fc1e6b9de0d7a764243fc1643ae9b43aad4505edc27b6
Instruction Fuzzy Hash: 4431A137A18B8582EB41CB2AE0503B963A0FB86B89F1C4130DE4C8B796DF7DD4958B00

Function 00007FF6729C6BAF Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6729C8830: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C887C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C6FAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7053

Part of subcall function 00007FF672990270: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729902C2

Strings

Serial Number, xrefs: 00007FF6729C6F82
Serial Number: %s, xrefs: 00007FF6729C6F9C
Signature Algorithm: %s, xrefs: 00007FF6729C7041
Signature Algorithm, xrefs: 00007FF6729C7027

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: freemalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3061335427-517259162
Opcode ID: 15b6c463ab1a85933ee5c7432ff4d0e69fb372e575180e53935f993b5a7d060a
Instruction ID: 46564a03b0ab64c8a8e76a4d19b17f165c0b259a8dd0fd2cb3ee6a3c67d9c8a1
Opcode Fuzzy Hash: 15b6c463ab1a85933ee5c7432ff4d0e69fb372e575180e53935f993b5a7d060a
Instruction Fuzzy Hash: D731BC63A2878255EF068B7398001F927A1BF45B8CF4C0939CE4E9B357DEBCE1858B00

Function 00007FF6729C6B89 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6729CA340: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729CA375

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C6FAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C7053

Part of subcall function 00007FF672990270: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729902C2

Strings

Serial Number, xrefs: 00007FF6729C6F82
Serial Number: %s, xrefs: 00007FF6729C6F9C
Signature Algorithm: %s, xrefs: 00007FF6729C7041
Signature Algorithm, xrefs: 00007FF6729C7027

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: freemalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3061335427-517259162
Opcode ID: f15397fdba8557afbc7230572b41e6e1bed36e773cdca7dd45ec7e050018a11e
Instruction ID: 99692b36a5a547e6ffc68e056796d4964a398373adb1f2d9249d58bc96b2e58b
Opcode Fuzzy Hash: f15397fdba8557afbc7230572b41e6e1bed36e773cdca7dd45ec7e050018a11e
Instruction Fuzzy Hash: C9319C63A2878255EF168B7398001F927A1BF45B8CF4C0939CE4E9B357DEBCE5858B00

Function 00007FF6729B5993 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B59AF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B5A2B

Strings

OS/400, xrefs: 00007FF6729B59F9
SITE NAMEFMT 1, xrefs: 00007FF6729B5A0C

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: freemalloc
String ID: OS/400$SITE NAMEFMT 1
API String ID: 3061335427-2049154998
Opcode ID: c708716cd7e412fac1277e5dadc28412cb94ead0a2f431f815a95231d1dbee4c
Instruction ID: 5f172bf1bbb2534f01408f03e39b73721eb054b1493b95122f9a39111b072903
Opcode Fuzzy Hash: c708716cd7e412fac1277e5dadc28412cb94ead0a2f431f815a95231d1dbee4c
Instruction Fuzzy Hash: 15318123A2C6C2C5F7718B27D4503B86350BB49758F984031CA8D97697DEBCE986DB00

Function 00007FF6729892D8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6729A77D0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729A77F1

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729893A1

Strings

Replaced, xrefs: 00007FF672989631
Added, xrefs: 00007FF67298963D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF672989647
FALSE, xrefs: 00007FF67298937B

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _errno_strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 2151398962-2292467869
Opcode ID: 4a7c89c5642297a4d0c7915c66b5189750f1ca465ae76c73dbad8230444b831f
Instruction ID: 34c336937304cc4460425d33650a6a472aed47f74b172bf1db606258c611a2b1
Opcode Fuzzy Hash: 4a7c89c5642297a4d0c7915c66b5189750f1ca465ae76c73dbad8230444b831f
Instruction Fuzzy Hash: DF611A63A2968245FE719B2794443BA67A0AF4575CF4C4036DE8E82793DFACF684CB00

Function 00007FF6729891CD Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6729A7720: strchr.VCRUNTIME140 ref: 00007FF6729A7756

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729893A1

Strings

Replaced, xrefs: 00007FF672989631
Added, xrefs: 00007FF67298963D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF672989647
FALSE, xrefs: 00007FF67298937B

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdupstrchr
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 3727083984-2292467869
Opcode ID: fc87ea90c0f3368a0092128a2e660db4dfc90ecd54d0ebc214185b02f98b6eef
Instruction ID: 6fe9aa09ba23a2a474727e315cdcaef3f250ef0342f6be96ce8a8a79015af43d
Opcode Fuzzy Hash: fc87ea90c0f3368a0092128a2e660db4dfc90ecd54d0ebc214185b02f98b6eef
Instruction Fuzzy Hash: 9B612C6392968246FE719B2794443BA67A0AF4575CF4C4036DF8E82793DFACF684CB00

Function 00007FF6729A21D0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A23DD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729A23F5

Strings

Forcing HTTP/1.1 for NTLM, xrefs: 00007FF6729A2299
The requested URL returned error: %d, xrefs: 00007FF6729A237E

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdupfree
String ID: Forcing HTTP/1.1 for NTLM$The requested URL returned error: %d
API String ID: 1865132094-1204028548
Opcode ID: 671fb0af8a080531b4140e808f18903820064e280e8998485c5e7eb8b0c4c462
Instruction ID: 0c4104a5244722365d8e923fcde9a63d73accdd85a481892c9e3055994b126c2
Opcode Fuzzy Hash: 671fb0af8a080531b4140e808f18903820064e280e8998485c5e7eb8b0c4c462
Instruction Fuzzy Hash: EE519533E1C78282FB648A2695402FD27A1EB42B5CF0C0135DE4DDA687CFADE450CB60

Function 00007FF672972640 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF672974340: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF672971B79), ref: 00007FF672974371

Part of subcall function 00007FF672973C60: memcpy.VCRUNTIME140 ref: 00007FF672973CB3

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672972712
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672972760
__std_exception_copy.VCRUNTIME140 ref: 00007FF6729727B0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729727FD

Strings

out_of_range, xrefs: 00007FF672972686

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$__std_exception_copy
String ID: out_of_range
API String ID: 2484256320-3053435996
Opcode ID: a1ce1c510df94e9b37a2628a96cfb258afd8347f3f7a070f3f334ec7b835f3eb
Instruction ID: e078bd35c99deb26ba40d6dd8113633e43e114ff0b8a60aae8b3d4d4dd42e110
Opcode Fuzzy Hash: a1ce1c510df94e9b37a2628a96cfb258afd8347f3f7a070f3f334ec7b835f3eb
Instruction Fuzzy Hash: 57516C33A28B4299FB008F75D5403AC3365EB5479CF445635DA5C82BDAEFB8E1A58700

Function 00007FF6729BF5B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729BF628
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729BF65A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729BF6CA

Part of subcall function 00007FF6729A7930: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF67298A95A,?,?,?,?,?,?,?,00007FF67298A727), ref: 00007FF6729A7941

strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729BF745

Strings

0123456789abcdefABCDEF:., xrefs: 00007FF6729BF61E

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _errno_strdupstrcspnstrncmpstrspn
String ID: 0123456789abcdefABCDEF:.
API String ID: 2191890455-446397347
Opcode ID: 8ab271ac9324777acf84b5e65f69c387867f0bba2528c2d1d22268592123ba3c
Instruction ID: 118a12dbbb271b929d2babdd0e52c42db4b43c3bc34a88e53fa17f466897e14a
Opcode Fuzzy Hash: 8ab271ac9324777acf84b5e65f69c387867f0bba2528c2d1d22268592123ba3c
Instruction Fuzzy Hash: 0641DA23A1C6CAD5EF218B2694503B93790EB05B58F4C0176EE8D87AD7EFACE445CB01

Function 00007FF6729C9598 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C9963
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C9977
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C99DE

Strings

GMT, xrefs: 00007FF6729C95F4
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF6729C9646

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: isupper$free
String ID: %u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT
API String ID: 573759493-632690687
Opcode ID: cfef86f47c2ac2f73bb98ecf29bfa00e79685ed802542a529cfbe9da5396edf3
Instruction ID: 12f76811f147fe403db801e0285fa3e3496d3daf79207a3b66b902f2ef781b85
Opcode Fuzzy Hash: cfef86f47c2ac2f73bb98ecf29bfa00e79685ed802542a529cfbe9da5396edf3
Instruction Fuzzy Hash: 7441A823E2CAC685F715CB36D5402787B91EB15F88F5D1231C68E82696EFBCE695CB00

Function 00007FF672974340 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF672971B79), ref: 00007FF672974371
memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF672971B79), ref: 00007FF672974436
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF672971B79), ref: 00007FF67297448A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF672974491

Part of subcall function 00007FF6729CF220: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF67297441E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF672971B79), ref: 00007FF6729CF23A

Strings

https://keyauth.win/api/1.2/, xrefs: 00007FF672974342

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID: https://keyauth.win/api/1.2/
API String ID: 1155477157-3933380396
Opcode ID: 33eb9b0c9fa6c3dd31b06b9bf23052ed593f8d5e9918006aba88df42aaf8b3cc
Instruction ID: 80aaa1682aa6935777252c9b608fdf21a1a05582635637b0d988f627b6c38fa6
Opcode Fuzzy Hash: 33eb9b0c9fa6c3dd31b06b9bf23052ed593f8d5e9918006aba88df42aaf8b3cc
Instruction Fuzzy Hash: 7E310523B25A4645FE19DB67A60427822A59B00FF8F1C1731CE2D47BD7EEBCE0829704

Function 00007FF6729806B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF6729711FC), ref: 00007FF67298078F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF6729711FC), ref: 00007FF6729807CC
memcpy.VCRUNTIME140(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF6729711FC), ref: 00007FF6729807D6
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF672980809

Strings

https://keyauth.win/api/1.2/, xrefs: 00007FF6729806B2

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: https://keyauth.win/api/1.2/
API String ID: 1775671525-3933380396
Opcode ID: be64b9e19be8eaaef7a82d3710091065530606ae48194a524367d6a23193bdb8
Instruction ID: b2c2abde6fd2560ee921c5b26db59927f0c353c8c3ec2329f0c3376831403462
Opcode Fuzzy Hash: be64b9e19be8eaaef7a82d3710091065530606ae48194a524367d6a23193bdb8
Instruction Fuzzy Hash: 8031E263B1A74295EE509B23A9003AD6291EB04BD8F5C4635DF6D877DBDEBCE0918B00

Function 00007FF67299C840 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67299C935
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299C994

Strings

Connection died, tried %d times before giving up, xrefs: 00007FF67299C8F8
Connection died, retrying a fresh connect, xrefs: 00007FF67299C91F
REFUSED_STREAM, retrying a fresh connect, xrefs: 00007FF67299C8CB

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdupfree
String ID: Connection died, retrying a fresh connect$Connection died, tried %d times before giving up$REFUSED_STREAM, retrying a fresh connect
API String ID: 1865132094-195851662
Opcode ID: f196db271e303545b7b8e26cbc9e86c731da592b660b972f710da760515af451
Instruction ID: e9d62c84a67507331af3f316e51e0e6217c4602c616d4cf88b1c33fc5cee45ad
Opcode Fuzzy Hash: f196db271e303545b7b8e26cbc9e86c731da592b660b972f710da760515af451
Instruction Fuzzy Hash: 21415333A2868299E755CB27E5503A96790EB88B9CF4C4032DA8D87756CFBDD4A1CF40

Function 00007FF67299A540 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299A5C9
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67299A65F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299A687

Strings

Unrecognized content encoding type. libcurl understands %s content encodings., xrefs: 00007FF67299A675
identity, xrefs: 00007FF67299A583, 00007FF67299A5F3, 00007FF67299A658

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: Unrecognized content encoding type. libcurl understands %s content encodings.$identity
API String ID: 3985033223-1703240927
Opcode ID: 5295d9a27b2ffbfbb6550ff84d3508ed774dd153aed319c6fabd723325ad5a2e
Instruction ID: 319c98d70b8814c37de4ad825a64af9c980da142108294eccb62a36c6382f458
Opcode Fuzzy Hash: 5295d9a27b2ffbfbb6550ff84d3508ed774dd153aed319c6fabd723325ad5a2e
Instruction Fuzzy Hash: CA418423A296428AEB158B16D440278A760FF85FFCF4D4231CE9D87796DFBCD4518B00

Function 00007FF6729C9489 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C94B0
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C9963
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C9977
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C99DE

Strings

FALSE, xrefs: 00007FF6729C94A5

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: isupper$_strdupfree
String ID: FALSE
API String ID: 3359907120-3701058176
Opcode ID: 891e92e71c781b82434672243f1e8bdb62715bea0fc24ae2df5f7719ae9ecebc
Instruction ID: e16e32b3003f7826d852ff0ef09a300abb8a5ca9cd8a1d1e14b505efc08ce4f6
Opcode Fuzzy Hash: 891e92e71c781b82434672243f1e8bdb62715bea0fc24ae2df5f7719ae9ecebc
Instruction Fuzzy Hash: CC31C123E2C59685FB16CB3BD4443786B909B01F69F5C0731C99E816D6EEAC92C1CB10

Function 00007FF6729C8D30 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C8D5D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C9226

Strings

%s: %s, xrefs: 00007FF6729C9211
TRUE, xrefs: 00007FF6729C8D4B
FALSE, xrefs: 00007FF6729C8D52

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdupfree
String ID: %s: %s$FALSE$TRUE
API String ID: 1865132094-3430445539
Opcode ID: 1528ab94a9c57f86281f4ae757fc3be9c09fe4390824a4b13d37cc0c45b922d9
Instruction ID: 3ba6ac792118c43ca66256bf5e49e76720b86430833ce6706ae7b0d877c7bc84
Opcode Fuzzy Hash: 1528ab94a9c57f86281f4ae757fc3be9c09fe4390824a4b13d37cc0c45b922d9
Instruction Fuzzy Hash: 4B016163A2878285FB658B67A4043B97390BB46F98F5C4535CE8D83357DEBCE2C58B00

Function 00007FF672980810 Relevance: 7.7, APIs: 5, Instructions: 178COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF672973DA0: memcpy.VCRUNTIME140(?,?,0000000100000000,00007FF67298086D), ref: 00007FF672973E52
Part of subcall function 00007FF672973DA0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF672973E77

Part of subcall function 00007FF672973DA0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,0000000100000000,00007FF67298086D), ref: 00007FF672973E34

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672980A80
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672980A87
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672980A8E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672980A95
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF672980A9C

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskmemcpy
String ID:
API String ID: 2318677668-0
Opcode ID: 7c2102d0d53433167d42517ba21f0402f14e0b93032f18457b72760957d9ddc0
Instruction ID: 68169b57c884925243faf8ec245f0f44327f36a4d8144213d762c93944645b2f
Opcode Fuzzy Hash: 7c2102d0d53433167d42517ba21f0402f14e0b93032f18457b72760957d9ddc0
Instruction Fuzzy Hash: 56619F63A24BC185EB60DF22E4987BD3365EB51B88F584031DA8D86A9BDFBDD4D0C740

Function 00007FF6729C4360 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6729C42C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729C0D55), ref: 00007FF6729C42E6
Part of subcall function 00007FF6729C42C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729C0D55), ref: 00007FF6729C4307
Part of subcall function 00007FF6729C42C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729C0D55), ref: 00007FF6729C4322
Part of subcall function 00007FF6729C42C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729C0D55), ref: 00007FF6729C4330
Part of subcall function 00007FF6729C42C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729C0D55), ref: 00007FF6729C4342

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C43E6

Strings

NTLM, xrefs: 00007FF6729C439E, 00007FF6729C4450
HTTP, xrefs: 00007FF6729C436A

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$malloc
String ID: HTTP$NTLM
API String ID: 2190258309-4188377180
Opcode ID: a7a0ec56128960745cd1c889af00c64ca877e2a6dbb05a50f2b070676e6fc57c
Instruction ID: 90a54cea86b1c7b1f937bd674636f6a2c1652bd1bba4aefae56077f34adfb252
Opcode Fuzzy Hash: a7a0ec56128960745cd1c889af00c64ca877e2a6dbb05a50f2b070676e6fc57c
Instruction Fuzzy Hash: 9D614133618B8586E7608F26E44066E77A5FB88B88F185235DE8D83B69DF7CD494CF40

Function 00007FF6729CD610 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 129stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF6729CD5D0), ref: 00007FF6729CD67F

Part of subcall function 00007FF6729A7930: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF67298A95A,?,?,?,?,?,?,?,00007FF67298A727), ref: 00007FF6729A7941

Part of subcall function 00007FF6729A7930: strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF6729A7AE3
Part of subcall function 00007FF6729A7930: strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF6729A7B00

strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF6729CD5D0), ref: 00007FF6729CD6EE
strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF6729CD5D0), ref: 00007FF6729CD708
strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF6729CD5D0), ref: 00007FF6729CD73E

Strings

xn--, xrefs: 00007FF6729CD725

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: strchr$_errno
String ID: xn--
API String ID: 2644425738-2826155999
Opcode ID: 4ceacaaaca8ab194aca5b5121c2b09b187d7c3a6e041e41f5be9d2ba4c7ae345
Instruction ID: e47e6117d3d6f798fef13a899f723977e73bfdf4c637dfde18cb7bf4d4f76828
Opcode Fuzzy Hash: 4ceacaaaca8ab194aca5b5121c2b09b187d7c3a6e041e41f5be9d2ba4c7ae345
Instruction Fuzzy Hash: 0C4191A2B2D28209FB549B2395153B95581AF85F98F5C8235DE4DC7BC3EEBCE4418B10

Function 00007FF67299B700 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF67299B7A8
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299B828
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299B8D2

Strings

allocate connect buffer!, xrefs: 00007FF67299B84F
CONNECT phase completed!, xrefs: 00007FF67299B913

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: callocfreememset
String ID: CONNECT phase completed!$allocate connect buffer!
API String ID: 3505321882-591125384
Opcode ID: 0664d3346f0c0206f3df147ba2a762fb062a4fdadb2e1d71280967370e05cc4f
Instruction ID: f2a163e7f545f29c4528f0fa9b27f31c837be4b9b0be7942937a93f4c7fe757e
Opcode Fuzzy Hash: 0664d3346f0c0206f3df147ba2a762fb062a4fdadb2e1d71280967370e05cc4f
Instruction Fuzzy Hash: 52517023A186829AE715DB26D5543B97390FB8879CF0C4035CB9C87292DFBDE575CB00

Function 00007FF6729C7283 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 125COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C75B9

Strings

GMT, xrefs: 00007FF6729C733E
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF6729C73B1
Start Date: %s, xrefs: 00007FF6729C75A7
Start Date, xrefs: 00007FF6729C758D

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: Start Date: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Start Date
API String ID: 1294909896-619256714
Opcode ID: 9f9450833e5cfe6c7bf61f2dd6b48b82049faf1480c4a76590da026cd217247e
Instruction ID: 018b27ba0032989952a1a454edf013d8d6f841c5329f6b8b214b5f482ffbd33e
Opcode Fuzzy Hash: 9f9450833e5cfe6c7bf61f2dd6b48b82049faf1480c4a76590da026cd217247e
Instruction Fuzzy Hash: 7551F673A2C6D285EB248B22A4041F8B799FB05B88F5C4535DA8D87756CFBCE581CB00

Function 00007FF6729AE480 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6729A77D0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6729A77F1

memcpy.VCRUNTIME140 ref: 00007FF6729AE5F1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729AE5FF

Strings

Written %zu bytes, %I64u bytes are left for transfer, xrefs: 00007FF6729AE5BD
Failed to parse FETCH response., xrefs: 00007FF6729AE4DE
Found %I64d bytes to download, xrefs: 00007FF6729AE552

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _errnofreememcpy
String ID: Failed to parse FETCH response.$Found %I64d bytes to download$Written %zu bytes, %I64u bytes are left for transfer
API String ID: 738009125-4268564757
Opcode ID: 7935b47811a66d262ccbcba43c6d1a112da378423a48b8250d22068d2cfb966d
Instruction ID: faa87bec390e57559970552c7f38dfc2cfb5e423fb7047685bf03419b3b08327
Opcode Fuzzy Hash: 7935b47811a66d262ccbcba43c6d1a112da378423a48b8250d22068d2cfb966d
Instruction Fuzzy Hash: F1518123E187C686EB149F66E4402A9B3A0FB49B98F584031DA8D83647DFBCE555CB00

Function 00007FF6729C71C0 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C75B9

Strings

GMT, xrefs: 00007FF6729C721C
Start Date: %s, xrefs: 00007FF6729C75A7
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF6729C726F
Start Date, xrefs: 00007FF6729C758D

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: Start Date: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Start Date
API String ID: 1294909896-2752585153
Opcode ID: 711fbfd062ac28d37eee4e98588648ca88c703858fc5e591fe26557a4fc3ccaa
Instruction ID: d925b107f49e76e0a83b38dee7c7b97a957a6ea66e53be594e991d1b29b8c0de
Opcode Fuzzy Hash: 711fbfd062ac28d37eee4e98588648ca88c703858fc5e591fe26557a4fc3ccaa
Instruction Fuzzy Hash: 16318F63A2C6C295EB118B3294041F9B795FB05B8CF9C4135D68D9B29BDFBCE685CB00

Function 00007FF6729A8BC0 Relevance: 7.6, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF672994FA0), ref: 00007FF6729A8BF5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF672994FA0), ref: 00007FF6729A8C0A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF672994FA0), ref: 00007FF6729A8C1F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF672994FA0), ref: 00007FF6729A8C4C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF672994FA0), ref: 00007FF6729A8C55
memcpy.VCRUNTIME140(?,?,?,00007FF672994FA0), ref: 00007FF6729A8C89

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$calloc$memcpy
String ID:
API String ID: 3478730034-0
Opcode ID: 4e5a0de7d13c98f7526ba3692002c6a0f4b14e26cd4a486146107d706928a7f8
Instruction ID: 63ae6c0a63c124c80df2f6f83f385251bf1beebef8aae3c0dadb823e5bdb98a3
Opcode Fuzzy Hash: 4e5a0de7d13c98f7526ba3692002c6a0f4b14e26cd4a486146107d706928a7f8
Instruction Fuzzy Hash: 2F21A173E2AB8186E7108F229410229B7B0FB49B98F084635DA9E97796DFBCD4508B00

Function 00007FF6729C7414 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C744F
memcpy.VCRUNTIME140 ref: 00007FF6729C7475
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C75B9

Strings

Start Date: %s, xrefs: 00007FF6729C75A7
Start Date, xrefs: 00007FF6729C758D

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: freemallocmemcpy
String ID: Start Date: %s$Start Date
API String ID: 3056473165-2389359183
Opcode ID: 7c57ede189523087b707b773c3037a5a59e8231971d0a979adb90df8bdf72e50
Instruction ID: 86eba22ac8fd54eb6dba5a5fbeeb3107463fc67920e505d9f507d6548af13654
Opcode Fuzzy Hash: 7c57ede189523087b707b773c3037a5a59e8231971d0a979adb90df8bdf72e50
Instruction Fuzzy Hash: 8D21E062A282C242EE158B2389042F86796BF15BECF0C4635CD0D877D3DEBCE1848B00

Function 00007FF6729C7CE8 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C8129
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C8169
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C817C

Strings

Signature, xrefs: 00007FF6729C80FF
Signature: %s, xrefs: 00007FF6729C8117

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$Signature
API String ID: 2190258309-1663925961
Opcode ID: 085e8bfba7099bf397b2beb75afd16dc4a4787d6d75453ad1199ca0b21f619c5
Instruction ID: 5da455c3137ca36c6b228f7c045d03b5c6e4f231defd2225696a0d774d180e66
Opcode Fuzzy Hash: 085e8bfba7099bf397b2beb75afd16dc4a4787d6d75453ad1199ca0b21f619c5
Instruction Fuzzy Hash: 9A219567A2868286EA51CB67A4442FAA3A0FF85B9CF4C0531DE4D97757DE7CD041CB40

Function 00007FF6729C7D26 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6729C8830: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C887C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C8129
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C8169
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C817C

Part of subcall function 00007FF672990270: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729902C2

Strings

Signature, xrefs: 00007FF6729C80FF
Signature: %s, xrefs: 00007FF6729C8117

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: malloc$free
String ID: Signature: %s$Signature
API String ID: 1480856625-1663925961
Opcode ID: 08fecb440a42a646be96f13bc822a9b7a76b3249bf883816c22d748f691a54a6
Instruction ID: 146731c2a71920b5a18430e5fc0c22331c444bd5fa2473c15f3145a664cb85e3
Opcode Fuzzy Hash: 08fecb440a42a646be96f13bc822a9b7a76b3249bf883816c22d748f691a54a6
Instruction Fuzzy Hash: 54218367A28A8286EA51CB27E4442EAA3A0FF84B8CF480532DE4D97757DE7CD045CB40

Function 00007FF6729C7D00 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6729CA340: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729CA375

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C8129
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C8169
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C817C

Part of subcall function 00007FF672990270: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729902C2

Strings

Signature, xrefs: 00007FF6729C80FF
Signature: %s, xrefs: 00007FF6729C8117

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: malloc$free
String ID: Signature: %s$Signature
API String ID: 1480856625-1663925961
Opcode ID: f2f22ac360362b365c9d4fe1335d944de870e67b4dd9258223f70a3c6a139585
Instruction ID: 8ee36c69306bb8762d63579526dc0b4c6eaaa3fbf2b82d0ea7b134d11806b92a
Opcode Fuzzy Hash: f2f22ac360362b365c9d4fe1335d944de870e67b4dd9258223f70a3c6a139585
Instruction Fuzzy Hash: 13218367A18A8286EA51CB27E4442EAA3A0FF85B8CF480532DE4D97767DE7CD045CB40

Function 00007FF67298AC30 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF67298B0D3
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF67298B0E7
CloseHandle.KERNEL32 ref: 00007FF67298B0F4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF67298B116
closesocket.WS2_32 ref: 00007FF67298B134
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF67298B14D

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: CriticalSectionfree$CloseEnterHandleLeaveclosesocket
String ID:
API String ID: 469868127-0
Opcode ID: 4878dfb08abf4d62c0811a917b0330daba04addaecc353a69332e903f3cdf168
Instruction ID: 8d4d46d967e412c5eadcae7d1d27b148fec016bc3db471a6bdb078134db9f239
Opcode Fuzzy Hash: 4878dfb08abf4d62c0811a917b0330daba04addaecc353a69332e903f3cdf168
Instruction Fuzzy Hash: 53111677B18A41C6E7209F53E55022AB360FB89B94F1C4135CF8E87B46CFB9E4A58B00

Function 00007FF672982C70 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 46stringCOMMON

Download Yara Rule

APIs

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6729825A9), ref: 00007FF672982F0F

Strings

Host not found, try again, xrefs: 00007FF672982F05
Unrecoverable error in call to nameserver, xrefs: 00007FF672982EFC
No data record of requested type, xrefs: 00007FF672982EF3
Host not found, xrefs: 00007FF672982ED8

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: strncpy
String ID: Host not found$Host not found, try again$No data record of requested type$Unrecoverable error in call to nameserver
API String ID: 3301158039-3625861382
Opcode ID: 0132925ce1c0e237b1a53213cb1467970d2fd44da32c3dec2bb2a5c9ca0d030e
Instruction ID: 2b4ac296a0e572a34b81efaa888af16ee8a09b4791d38691be4be2beb0d0c5de
Opcode Fuzzy Hash: 0132925ce1c0e237b1a53213cb1467970d2fd44da32c3dec2bb2a5c9ca0d030e
Instruction Fuzzy Hash: 6B11C263E2C68282EB59C72BE5542F82290EF05788F9C5031CA0EC6697DFECE4D0DA00

Function 00007FF6729A57C0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 206COMMON

Download Yara Rule

APIs

fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 00007FF6729A5B12

Strings

** Resuming transfer from byte position %I64d, xrefs: 00007FF6729A5848
%% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed, xrefs: 00007FF6729A585B
%3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s, xrefs: 00007FF6729A5AA5

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: fflush
String ID: %3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s$ %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed$** Resuming transfer from byte position %I64d
API String ID: 497872470-664487449
Opcode ID: 55fb933a215ee2738e0a240f67f9e60bd1d510c9aa497763253ff99bf8ca263d
Instruction ID: fc43dec579b3bb84b2ea09f7757951fd018f5538e2b06434dd494922dbdbd70a
Opcode Fuzzy Hash: 55fb933a215ee2738e0a240f67f9e60bd1d510c9aa497763253ff99bf8ca263d
Instruction Fuzzy Hash: C591A362F1AB8695DA20CB06E5447AA7364FB84BC8F891036DE5D8BB56EF7CD005DB00

Function 00007FF6729B27E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 120networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6729CA530: memcpy.VCRUNTIME140 ref: 00007FF6729CA5D8
Part of subcall function 00007FF6729CA530: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729CA5E9

WSAGetLastError.WS2_32 ref: 00007FF6729B294A

Strings

We got a 421 - timeout!, xrefs: 00007FF6729B296E
FTP response timeout, xrefs: 00007FF6729B2997
FTP response aborted due to select/poll error: %d, xrefs: 00007FF6729B2958

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: ErrorLastfreememcpy
String ID: FTP response aborted due to select/poll error: %d$FTP response timeout$We got a 421 - timeout!
API String ID: 1248052217-2064316097
Opcode ID: a45480fd6b1cd4aaf9f86be2baf648b8e4f1a9a3c321f0997a9d585c8d5b72b4
Instruction ID: 7763a6107dd7944fe964d0eebd07e8fdbd810409f8314bb0ea7df8568c526c35
Opcode Fuzzy Hash: a45480fd6b1cd4aaf9f86be2baf648b8e4f1a9a3c321f0997a9d585c8d5b72b4
Instruction Fuzzy Hash: EB416F23E18682C6FB649F27D5007F96290FB89B98F584131DE9DC7396EEBCD4458B00

Function 00007FF6729C9A25 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C9A4B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C9EEF

Strings

TRUE, xrefs: 00007FF6729C9EF9
FALSE, xrefs: 00007FF6729C9A40

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdupfree
String ID: FALSE$TRUE
API String ID: 1865132094-1412513891
Opcode ID: b50cbcb9562abecc3e74fe01b7723bc1cf678fb792e2943397a9ff7a01af48b2
Instruction ID: 9ed7f707df97dbdf112ed6eff81be955898701dd308eb91f5101c76d55b6ab88
Opcode Fuzzy Hash: b50cbcb9562abecc3e74fe01b7723bc1cf678fb792e2943397a9ff7a01af48b2
Instruction Fuzzy Hash: A9419363A29A5584FF158B7794042B82751AB05F98F5D4B32CE5EC73CAEEACE5C08A00

Function 00007FF6729C94BE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C9963
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C9977
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C99DE

Strings

%s%lx, xrefs: 00007FF6729C9528

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: isupper$free
String ID: %s%lx
API String ID: 573759493-530121141
Opcode ID: ac6e8409dc24b3c56def32f344c6c37d6f0c90a2fe206f8b32ba04b9d681c3c0
Instruction ID: 63061e07da0ef9e641c293713148252fbc938f4c2b17e4bb7787ed7ad1100501
Opcode Fuzzy Hash: ac6e8409dc24b3c56def32f344c6c37d6f0c90a2fe206f8b32ba04b9d681c3c0
Instruction Fuzzy Hash: 8D31F523E2D5D689FB1A8B37C0443787B919B15F8CF5C1631C58EC1A97EEAD9281CB10

Function 00007FF6729C979F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C9963
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C9977
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C99DE

Strings

TRUE, xrefs: 00007FF6729C993D

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: isupper$free
String ID: TRUE
API String ID: 573759493-3412697401
Opcode ID: fec4f20c7e443188604d93bc69b3c745436950eb7b739141f79376adc6de4618
Instruction ID: 16283be484448634747d44387bed3eb92cd4cdc2ca0e356a22b28e81bd87f2fb
Opcode Fuzzy Hash: fec4f20c7e443188604d93bc69b3c745436950eb7b739141f79376adc6de4618
Instruction Fuzzy Hash: 6F319323A1C99685FB15CB3695443787B91AB01F9CF5C4731CA9EC2AD6DEACD281CB00

Function 00007FF672995B20 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77fileCOMMON

Download Yara Rule

APIs

fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF672995C45
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF672995C60

Strings

..., xrefs: 00007FF672995BC8
..., xrefs: 00007FF672995BB2

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: fwrite
String ID: ...$...
API String ID: 3559309478-2253869979
Opcode ID: d021467800b106925d248320e1cf82cd090d14d51c3c486455b9135a660e2919
Instruction ID: b9e9911a261bc30a78e2010f34017d42e3c53ad8b45d477a8ecf3762f250c42a
Opcode Fuzzy Hash: d021467800b106925d248320e1cf82cd090d14d51c3c486455b9135a660e2919
Instruction Fuzzy Hash: 07310763A2CA8595EB60CB22E0443FA63A1FB84B98F584131CA9D837D2DF7DD155CB80

Function 00007FF6729B25C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32 ref: 00007FF6729B2612
accept.WS2_32 ref: 00007FF6729B2631

Part of subcall function 00007FF6729A4CC0: ioctlsocket.WS2_32 ref: 00007FF6729A4CD9

Strings

Connection accepted from server, xrefs: 00007FF6729B265F
Error accept()ing server connect, xrefs: 00007FF6729B264E

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: acceptgetsocknameioctlsocket
String ID: Connection accepted from server$Error accept()ing server connect
API String ID: 36920154-2331703088
Opcode ID: 428f724ef86fde4ca2a01310c409d70b17a7c6318e9c919c2bc1ca0e99aa5e70
Instruction ID: d5c49818df7804585a39552e009741c0442f092d7077124a57bf2f9fbabc5bd3
Opcode Fuzzy Hash: 428f724ef86fde4ca2a01310c409d70b17a7c6318e9c919c2bc1ca0e99aa5e70
Instruction Fuzzy Hash: C6317423A186C1C6EB549B27A4043EA7360FB48BE8F580235DA6D877C6CFBDE5458B00

Function 00007FF6729A4160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729A3B99), ref: 00007FF6729A41ED

Strings

Failed to alloc memory for big header!, xrefs: 00007FF6729A41F8
Rejected %zu bytes header (max is %d)!, xrefs: 00007FF6729A418B

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: realloc
String ID: Failed to alloc memory for big header!$Rejected %zu bytes header (max is %d)!
API String ID: 471065373-1365219457
Opcode ID: 1e71d5729da979b353650fdc256dc27aa4c209a75fd3bf7b0fd29bec740956cc
Instruction ID: bac14c7cf87e4fe40a3544a38a3b241384bc463768421a18cfff27c5c04b34a4
Opcode Fuzzy Hash: 1e71d5729da979b353650fdc256dc27aa4c209a75fd3bf7b0fd29bec740956cc
Instruction Fuzzy Hash: 10215E32B18B8486EB049B26E5402AD67A1FB89BC8F585035EF9D43B5ACF78D4A1C740

Function 00007FF672984343 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729843D2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729843EE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298440B

Strings

:, xrefs: 00007FF6729843C6

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$_strdup
String ID: :
API String ID: 2653869212-336475711
Opcode ID: 02ab7a5504034b7139eadc4e1a7234290cef37b7652e2aa92509ca4b52090d30
Instruction ID: 435e583730fd4e10f846467eb7f6053925ac59884aebcfe519b9c5c40e77cb0a
Opcode Fuzzy Hash: 02ab7a5504034b7139eadc4e1a7234290cef37b7652e2aa92509ca4b52090d30
Instruction Fuzzy Hash: A3216033619B8689EA668F16E5403A973A0FF84B98F4C4132DF9C83796EF7CD4548B10

Function 00007FF6729844C8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729843D2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729843EE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298440B

Strings

:, xrefs: 00007FF6729843C6

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$_strdup
String ID: :
API String ID: 2653869212-336475711
Opcode ID: 44a16be5e909d7fc3ac88983d5f1d4c83797e727a54356cfa5fb2d9cbec9f5a9
Instruction ID: c61e07608fbf46b7c4295b6b2a82878b55a8d3af2ed3936e88a47c5e95a34532
Opcode Fuzzy Hash: 44a16be5e909d7fc3ac88983d5f1d4c83797e727a54356cfa5fb2d9cbec9f5a9
Instruction Fuzzy Hash: E6115E33A19B8589EA668F16E6403A973A0FF847A8F5C4132CF9C83795EF7CD4548B10

Function 00007FF6729BA4C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF6729BA4FD
WSAGetLastError.WS2_32 ref: 00007FF6729BA507

Strings

SENT, xrefs: 00007FF6729BA522
Sending data failed (%d), xrefs: 00007FF6729BA50D

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: ErrorLastsend
String ID: SENT$Sending data failed (%d)
API String ID: 1802528911-3459338696
Opcode ID: cd5c057c8ec5619675f3451e50e89779a389e686ac9e1fc5b2206f9fb1ad3553
Instruction ID: 996fd5121bd0cf21377a573e7b5316e3c97de0336b26308d6b8e2f06c57a5876
Opcode Fuzzy Hash: cd5c057c8ec5619675f3451e50e89779a389e686ac9e1fc5b2206f9fb1ad3553
Instruction Fuzzy Hash: F601B133728A92C5EB108B6BE84046D7B60FB89FD8B5D5131CB5D83722DE79D505CB80

Function 00007FF6729C7191 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C7194
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C75B9

Part of subcall function 00007FF672990270: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729902C2

Strings

Start Date: %s, xrefs: 00007FF6729C75A7
Start Date, xrefs: 00007FF6729C758D

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: Start Date: %s$Start Date
API String ID: 3985033223-2389359183
Opcode ID: ce09818a56ad7afe59106ccbcec94a254847b9fd82371f50e1d2d6be26d27472
Instruction ID: ed75b542201df648b507d520ace6f85dc2bdb8e8c8040b9836db9123775689da
Opcode Fuzzy Hash: ce09818a56ad7afe59106ccbcec94a254847b9fd82371f50e1d2d6be26d27472
Instruction Fuzzy Hash: C101D4A3E2C2C256EA158B2354041F93796BF05B8DF4C0934CA4E8A293DFACA185CB10

Function 00007FF6729A15D0 Relevance: 6.3, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729A19E5), ref: 00007FF6729A1608
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729A19E5), ref: 00007FF6729A1611
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729A19E5), ref: 00007FF6729A168A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729A19E5), ref: 00007FF6729A169B
memcpy.VCRUNTIME140(?,?,00000000,00007FF6729A19E5), ref: 00007FF6729A16C4

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$mallocmemcpy
String ID:
API String ID: 3401966785-0
Opcode ID: 63bf4a12ed766e3f57477a8d7827ef677a79804a9de6dd420ca19d497ca06e3b
Instruction ID: 2b669956f659a97a59f470b184ba7664787f4a8de12b01af71192224e3037bb4
Opcode Fuzzy Hash: 63bf4a12ed766e3f57477a8d7827ef677a79804a9de6dd420ca19d497ca06e3b
Instruction Fuzzy Hash: 9F312923A29B85C1EB14DB16E5402A963A4BB49BE8F0C1631EE6D877D6DFBCD451CB00

Function 00007FF6729C42C0 Relevance: 6.3, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729C0D55), ref: 00007FF6729C42E6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729C0D55), ref: 00007FF6729C4307
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729C0D55), ref: 00007FF6729C4322
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729C0D55), ref: 00007FF6729C4330
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729C0D55), ref: 00007FF6729C4342

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 5b3e946a27e07d252e929778e6aff48a1a8b80c127e65d9acecdd987244c36db
Instruction ID: a87b5556799dbc9c1362c86e119239b90ae0cfb597b0771ec713211fac28b895
Opcode Fuzzy Hash: 5b3e946a27e07d252e929778e6aff48a1a8b80c127e65d9acecdd987244c36db
Instruction Fuzzy Hash: 82119537A24B81C2DB04DF66E99016CB3A5FF88F89B184625CE4E87769CF78D895C740

Function 00007FF67299A7E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299A900
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299A946
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299A9A8

Strings

chunked, xrefs: 00007FF67299A85E

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: calloc$free
String ID: chunked
API String ID: 171065143-1066005980
Opcode ID: d91d0ab1f036d35bafe74e17a142553036abed617deaec188e5d29b0c16cd109
Instruction ID: 205b6b69942244d67190838c611fffd5df79db4377d98987691eb76881bc2d63
Opcode Fuzzy Hash: d91d0ab1f036d35bafe74e17a142553036abed617deaec188e5d29b0c16cd109
Instruction Fuzzy Hash: 6651C533A286928DFA659B1395003796391FF84BE8F4D4031DEDD83786DFACE4628700

Function 00007FF6729C9BDF Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 132COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C9EEF

Strings

GMT, xrefs: 00007FF6729C9C8E
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF6729C9D01
TRUE, xrefs: 00007FF6729C9EF9

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$TRUE
API String ID: 1294909896-910067264
Opcode ID: 79ec50b3e7a224f9ad0c5b85d4757a8af0210a964ec725a7ffe922c3c827c0be
Instruction ID: c157ac5f60bb6218cbb136a8151ac7ef30595125250e2c7fe6dbc07efee53881
Opcode Fuzzy Hash: 79ec50b3e7a224f9ad0c5b85d4757a8af0210a964ec725a7ffe922c3c827c0be
Instruction Fuzzy Hash: 7451E773A2C69684FB158B36D5041B97BA5FB15B88F584132C98D83786EFBDE681CB00

Function 00007FF67297D500 Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF67297D1C8), ref: 00007FF67297D5DE
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF67297D1C8), ref: 00007FF67297D60C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF67297D1C8), ref: 00007FF67297D675

Part of subcall function 00007FF6729CF220: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF67297441E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF672971B79), ref: 00007FF6729CF23A

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF67297D682

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmallocmemcpymemset
String ID:
API String ID: 2942768764-0
Opcode ID: 3e328a47ceb9c28100f02eb2afa9d9752b4eedd341486f30e2d669ee0c81cc19
Instruction ID: 119a3ad28761cac2de791886078a24934e13ce2e3e2f3117488d30fe0fbc25cf
Opcode Fuzzy Hash: 3e328a47ceb9c28100f02eb2afa9d9752b4eedd341486f30e2d669ee0c81cc19
Instruction Fuzzy Hash: C741DF73B25A4686EA14CF66D10427D7361BB44BACF588631CB2D877CADFACE0518710

Function 00007FF6729CA860 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00007FF6729ACA0B), ref: 00007FF6729CA8BE

Strings

%s, xrefs: 00007FF6729CA894

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: %s
API String ID: 1294909896-3043279178
Opcode ID: ef364e122e656afae6803611e9a3dfc7a679b71f3d655f6e5d9eb35e5fea34ad
Instruction ID: 8a0e3df6ff7c582760516ffebf27435d14d4ac88587186f83617b96d017f7317
Opcode Fuzzy Hash: ef364e122e656afae6803611e9a3dfc7a679b71f3d655f6e5d9eb35e5fea34ad
Instruction Fuzzy Hash: 21416333A28B4582D651DF16F4401AAB3A0FB94BA4F180635DF9E43BA6DF7CE495C740

Function 00007FF6729CACA0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00007FF6729AE250,?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?), ref: 00007FF6729CACF3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729CAD7C

Strings

%s, xrefs: 00007FF6729CACC5

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: %s
API String ID: 1294909896-3043279178
Opcode ID: cffe4b13ead29bae0ff200e04fd536768648ba947b62f625ac449c06078c16d6
Instruction ID: e88171ea4d9d814ecd229f9310ee6fe198dc2ee2298615dd848363076de636e1
Opcode Fuzzy Hash: cffe4b13ead29bae0ff200e04fd536768648ba947b62f625ac449c06078c16d6
Instruction Fuzzy Hash: 3C417533A18B4582E611DF26F5401AAB3A0FB84BA8F084634DF8D47BA6DF7CE491C740

Function 00007FF6729C9B25 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C9EEF

Strings

GMT, xrefs: 00007FF6729C9B79
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF6729C9BCB
TRUE, xrefs: 00007FF6729C9EF9

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: %u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$TRUE
API String ID: 1294909896-918878739
Opcode ID: 1e9d3016f5acd841680f23de2bc3283443dd3966eb0dea8716a66b1e51db611f
Instruction ID: 3583b27507b671294768b574a072c56977ea5b0eb4df42ae990072b495516111
Opcode Fuzzy Hash: 1e9d3016f5acd841680f23de2bc3283443dd3966eb0dea8716a66b1e51db611f
Instruction Fuzzy Hash: 1E31C073A18A8594FB14CB36D5002B87761FB44BD8F5C4136CA4E83686EFBCE681CB00

Function 00007FF6729B61FD Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B6234

Part of subcall function 00007FF672995B20: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF672995C45
Part of subcall function 00007FF672995B20: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF672995C60

Strings

Wildcard - START of "%s", xrefs: 00007FF6729B623D
Wildcard - "%s" skipped by user, xrefs: 00007FF6729B629D
%s%s, xrefs: 00007FF6729B6204

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: fwrite$free
String ID: %s%s$Wildcard - "%s" skipped by user$Wildcard - START of "%s"
API String ID: 3468156532-1133524294
Opcode ID: 18869c7616cd04e56592bd39428d2dfb47fdbc888871900967386563bcfbffac
Instruction ID: c6fbc40aa0f2933e7e16f3ad6c8d98bbb734b8506347cc371ad57e4608c894b2
Opcode Fuzzy Hash: 18869c7616cd04e56592bd39428d2dfb47fdbc888871900967386563bcfbffac
Instruction Fuzzy Hash: 59413B73A18A42C5E710DF17E8841AD73A0EB84B99F4D413ADE4ECB796DEB9E444CB40

Function 00007FF6729805B0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,0000006E00000006,?,FFFFFFFF,00007FF6729711FC), ref: 00007FF6729805E8
memcpy.VCRUNTIME140(?,0000006E00000006,?,FFFFFFFF,00007FF6729711FC), ref: 00007FF672980689
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6729806A7

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task
String ID:
API String ID: 326894585-0
Opcode ID: 84d9a05765461089b26a3694c9bf25b7ae5f6eef53381b31f0456c051a714053
Instruction ID: 23e065692fc7b4818512f395829f25e301231426d9c0d94716ad64f8baa943ea
Opcode Fuzzy Hash: 84d9a05765461089b26a3694c9bf25b7ae5f6eef53381b31f0456c051a714053
Instruction Fuzzy Hash: EA210823B2A75645FA659B53A6003782284DF44BF8F5C0730DE6D47BD3DEBCA4928700

Function 00007FF672990270 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729902C2
memcpy.VCRUNTIME140 ref: 00007FF6729902FD

Part of subcall function 00007FF672985650: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672985665

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672990332

Part of subcall function 00007FF672985760: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF67298FD60,?,?,?,?,?,?,?,?,?,?,00000000,00007FF672981B91), ref: 00007FF672985787
Part of subcall function 00007FF672985760: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF67298FD60,?,?,?,?,?,?,?,?,?,?,00000000,00007FF672981B91), ref: 00007FF672985793

Strings

%s:, xrefs: 00007FF6729902DC

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$malloc$memcpy
String ID: %s:
API String ID: 901724546-64597662
Opcode ID: b6e72363eb6b44a24f973645435d7ae468e8c4fbe9d8e9f002d9183bb571111e
Instruction ID: 06b126fe424f63e359a81a2c71150ff0c13d734c96ee57d40897efabd5b0ebee
Opcode Fuzzy Hash: b6e72363eb6b44a24f973645435d7ae468e8c4fbe9d8e9f002d9183bb571111e
Instruction Fuzzy Hash: CE21B133A18A8595DB00CF13E9401AAB3A4FB94BF8F4C0132EEAD87396DF78D4558740

Function 00007FF6729C956A Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C9571
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C9963
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729C9977
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729C99DE

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: isupper$_strdupfree
String ID:
API String ID: 3359907120-0
Opcode ID: 5ceaff820c802d0484300f781915339d8fff395139fd2041e7e2c8705fd8df55
Instruction ID: 35c45036095e7e8bebbfe5e896c3eb5b5b63fb7dfddc9d9b5ec2dfa4bd7a745b
Opcode Fuzzy Hash: 5ceaff820c802d0484300f781915339d8fff395139fd2041e7e2c8705fd8df55
Instruction Fuzzy Hash: C321DE23E2D99685FB1ACB37C4443786B909B11F48F5D1771C5CAC1A97EFAC9281CB10

Function 00007FF67299930D Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 56stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF672998FD8), ref: 00007FF672999125
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF672998FD8), ref: 00007FF67299913F

Strings

I64, xrefs: 00007FF672999135
I32, xrefs: 00007FF672999115

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: 9058f58b6e884d782d5f191e47d18213b9382c0e878c9e38c7c463b4feb0903c
Instruction ID: 5b342b1e9055df8778f3f56292c068f24fa187cc1e3b50bc49a6d0e194c10d4c
Opcode Fuzzy Hash: 9058f58b6e884d782d5f191e47d18213b9382c0e878c9e38c7c463b4feb0903c
Instruction Fuzzy Hash: B421D423A2D65386FB244F22D4512B87A98AB44F9CF0D4130CA89C32E6DEACE614CF50

Function 00007FF6729C3160 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729C3EC9,00000000,?,?,00007FF6729C3486), ref: 00007FF6729C3189
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729C3EC9,00000000,?,?,00007FF6729C3486), ref: 00007FF6729C31C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6729C3EC9,00000000,?,?,00007FF6729C3486), ref: 00007FF6729C31D2
memcpy.VCRUNTIME140(?,?,?,00007FF6729C3EC9,00000000,?,?,00007FF6729C3486), ref: 00007FF6729C31FA

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: freemallocmemcpyrealloc
String ID:
API String ID: 3881842442-0
Opcode ID: 966fe282aaecfd9ca9c63adee5f07712b9437c76de7d035a7979e8c0797f2e00
Instruction ID: 97140c85dbe51f6ed694822ee20b4c14edc9c202c0314d8c5f7ff4f374827a14
Opcode Fuzzy Hash: 966fe282aaecfd9ca9c63adee5f07712b9437c76de7d035a7979e8c0797f2e00
Instruction Fuzzy Hash: 1D214D37A29B8182DB44CF66E490269B3A0FB48FD8B488531EE5E47759DF78D592C700

Function 00007FF6729B24E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 54stringCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B24FD
strstr.VCRUNTIME140 ref: 00007FF6729B253C
strstr.VCRUNTIME140 ref: 00007FF6729B2554

Strings

;type=, xrefs: 00007FF6729B252F, 00007FF6729B254D

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: strstr$calloc
String ID: ;type=
API String ID: 3224321581-3507045495
Opcode ID: 2e9f9788cdcd3b30e1666545e4b67bfd0abf8294030d875792f2d83994127889
Instruction ID: aa24c0025feb0652f2b759ff0488114d7a44942a091dd3328abe5cf3abf4e59c
Opcode Fuzzy Hash: 2e9f9788cdcd3b30e1666545e4b67bfd0abf8294030d875792f2d83994127889
Instruction Fuzzy Hash: 812171339186C286EB558B26E4503E937A0FB58798F4C4135DB9E8B7C6DFBCE5918B00

Function 00007FF6729CD350 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF6729CD38D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729CD39D
WideCharToMultiByte.KERNEL32 ref: 00007FF6729CD3CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729CD3D9

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: 305a81510860c09381c2a902cc7a5b2b405dc6c19f7ccc444ffd5f2c178b3282
Instruction ID: fa05c3dd087f182da523168efdb7caad6902daa2cdfce66e736187c8ee72dc64
Opcode Fuzzy Hash: 305a81510860c09381c2a902cc7a5b2b405dc6c19f7ccc444ffd5f2c178b3282
Instruction Fuzzy Hash: 85115E32B19B4186E7109FA3B84012DB7A0FB88FC4B584138DB8987B55DFB8E541CB40

Function 00007FF6729A1990 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A19EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A1A0A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729A1A13

Strings

Proxy-Connection: Keep-Alive, xrefs: 00007FF6729A19A0

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID: Proxy-Connection: Keep-Alive
API String ID: 1294909896-2835282938
Opcode ID: 4643923d4b30904997aa07d5a610e97fb1143f6965d6fce54f0be17f18545a7a
Instruction ID: c4cfe79c9df63ed60aa3b6ace9e03373cb8f8b121846c01ef28b917e6dd08b9a
Opcode Fuzzy Hash: 4643923d4b30904997aa07d5a610e97fb1143f6965d6fce54f0be17f18545a7a
Instruction Fuzzy Hash: C6018E23F14B4182EB158B56B9403A9A2A0BF84BF5F085230DEAD463D5DEBC9895C740

Function 00007FF6729CD580 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729CD5A6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729CD5B7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729CD5E6

Part of subcall function 00007FF6729CD610: strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF6729CD5D0), ref: 00007FF6729CD67F

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729CD5DD

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdupfree$strchr
String ID:
API String ID: 1739957132-0
Opcode ID: 7d92b430733ecacabbca8d44350c3de080bd73506f6653a9a1ee0bfd223ecb28
Instruction ID: 964ba5c2aaf5c4fbd7c1d1a188bcbd055fe77a73e8a169b80aec4c723e10c028
Opcode Fuzzy Hash: 7d92b430733ecacabbca8d44350c3de080bd73506f6653a9a1ee0bfd223ecb28
Instruction Fuzzy Hash: A3018063F2E7C142EE599B6765500385290BF48FD8F4C0534E94E87B5ADEACD8C58A10

Function 00007FF67298B160 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,?,?,00007FF67298B112,?,?,?,00000000), ref: 00007FF67298B171
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF67298B112,?,?,?,00000000), ref: 00007FF67298B17A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF67298B112,?,?,?,00000000), ref: 00007FF67298B184
closesocket.WS2_32 ref: 00007FF67298B1A2

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$CriticalDeleteSectionclosesocket
String ID:
API String ID: 3086658127-0
Opcode ID: f7db1f6b52b8137dabff5e355225a063c8c071eb0e0a3607985648b3c81ec94a
Instruction ID: e166d336ed3b3a82c3ed1fc96d1281c03a072193197639e59187ed32bbe3206a
Opcode Fuzzy Hash: f7db1f6b52b8137dabff5e355225a063c8c071eb0e0a3607985648b3c81ec94a
Instruction Fuzzy Hash: A7010013D28A8183E714DF76D8642782320FBE9F5CF196325DE5D811A69FA8A5D48600

Function 00007FF672999202 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF672998FD8), ref: 00007FF672999125
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF672998FD8), ref: 00007FF67299913F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF672999182

Strings

I64, xrefs: 00007FF672999135
I32, xrefs: 00007FF672999115

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: bf33a82e6db0119f0b5f8e71d19135bdba5c9901a767a2e5b31d644474056036
Instruction ID: 202354b76d7e74c13590d7f3782b1e24d2abc1a90c19ffc2e004b6f02e85b64a
Opcode Fuzzy Hash: bf33a82e6db0119f0b5f8e71d19135bdba5c9901a767a2e5b31d644474056036
Instruction Fuzzy Hash: 8FF05E17B2D64386FB204B679858675769CAF45BDCF0C5131C95EC22A2CE9CD214DF10

Function 00007FF6729991FA Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF672998FD8), ref: 00007FF672999125
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF672998FD8), ref: 00007FF67299913F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF672999182

Strings

I64, xrefs: 00007FF672999135
I32, xrefs: 00007FF672999115

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: afc1249cfcb7523b1457074938ff3c85ab7d664e055c1a5a50af9a83a164a02e
Instruction ID: 7ea17960afd18f93d661fb5ec4a63b1179db1c2ea59d2443871922b1ca16436c
Opcode Fuzzy Hash: afc1249cfcb7523b1457074938ff3c85ab7d664e055c1a5a50af9a83a164a02e
Instruction Fuzzy Hash: 4DF05E27B2D64386FA204B679858675769CAF45BDCF0C5131C95EC22A2CE9CD214DF10

Function 00007FF6729C11F0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 227COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF6729965A6), ref: 00007FF6729C1204

Strings

%lx, xrefs: 00007FF6729C14EA

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _errno
String ID: %lx
API String ID: 2918714741-1448181948
Opcode ID: 49234e15e8b09268ce86568750e4ed68840964f3b8f9b4aa4731865c16da9bc6
Instruction ID: d1311828310648d8ed72474d6fffcc9a25fc0e3dbd25aca44ca4eb39f28ee411
Opcode Fuzzy Hash: 49234e15e8b09268ce86568750e4ed68840964f3b8f9b4aa4731865c16da9bc6
Instruction Fuzzy Hash: 4F811963A2C1D185E7688A3694503797AD0EB85B98F1C5335E69FC22C6DEBCD881CF04

Function 00007FF6729BE78F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6729BE885
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729BE8E7

Strings

%ld, xrefs: 00007FF6729BE7BC

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdupfree
String ID: %ld
API String ID: 1865132094-1112595699
Opcode ID: f272a2ff3f0033cfea3fa2b91cb4f5473845a2023055426d2eb0aa0e1a8fe125
Instruction ID: e5947033dab1c40ea5901973fa18dc324a5da9a9c8ec5f2da8bcab472ccbbd46
Opcode Fuzzy Hash: f272a2ff3f0033cfea3fa2b91cb4f5473845a2023055426d2eb0aa0e1a8fe125
Instruction Fuzzy Hash: 20318323E29AC6C1FE65CB5291643796394AF4475CF8D0031DE8D87696EFBCE844CB10

Function 00007FF67299A6B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67299A729
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67299A7C2

Strings

identity, xrefs: 00007FF67299A6E4, 00007FF67299A753, 00007FF67299A7BB

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdupmalloc
String ID: identity
API String ID: 3515966317-1788209604
Opcode ID: df6872db47cafa8dff06a387f5addb0dbecae5f8e9a437aaf4ed239cb3972b05
Instruction ID: 36eb0c838b66179e831880ace8e0283598806b79b065229125710c8c3c1f6c49
Opcode Fuzzy Hash: df6872db47cafa8dff06a387f5addb0dbecae5f8e9a437aaf4ed239cb3972b05
Instruction Fuzzy Hash: 4F31C863E19A4286EB018B169450368A7A0EF94FB8F0D4231CEAD83396DEBDD4518700

Function 00007FF672998D20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672998D40
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672998D9B

Strings

, xrefs: 00007FF672998D53

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: mallocrealloc
String ID:
API String ID: 948496778-3916222277
Opcode ID: a67b52fd0683e3614a5c599cb136438b70bc80eeb823c18120832fc5c8c0abba
Instruction ID: e7bd95413a593e51bda3fdd61a2ff95dd88ac49d9390a1e30e00adc9b2dfc5cb
Opcode Fuzzy Hash: a67b52fd0683e3614a5c599cb136438b70bc80eeb823c18120832fc5c8c0abba
Instruction Fuzzy Hash: 1C11AFB3619B8181DB448F16E000269B3A1FF58BE8F484539DA9E4779AEF78D5A0C740

Function 00007FF6729954F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF672995535
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF67299555C

Strings

%I64d-, xrefs: 00007FF672995547

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: _strdupfree
String ID: %I64d-
API String ID: 1865132094-19666937
Opcode ID: ba72fc65aa6b9bf5ee81f4faa960dad831f094d783c9da241ee26807e1fbd575
Instruction ID: 6769789bc807c4d9141afad0aa019477beba3362bf6efe680b26aa16a9506693
Opcode Fuzzy Hash: ba72fc65aa6b9bf5ee81f4faa960dad831f094d783c9da241ee26807e1fbd575
Instruction Fuzzy Hash: 3A11E5B3E1AA82C5EB14CB6684053F523A2FF94B5CF1C4035C94C8E263DE6C94A6C721

Function 00007FF672988550 Relevance: 5.3, APIs: 4, Instructions: 287COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298881A
memcpy.VCRUNTIME140 ref: 00007FF67298894C
memcpy.VCRUNTIME140 ref: 00007FF672988968

Part of subcall function 00007FF67299DE00: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672986723,?,?,00000000,00007FF672990FF2,?,?,00000000,00007FF672991625), ref: 00007FF67299DE3C

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: freememcpy
String ID:
API String ID: 3223336191-0
Opcode ID: b8973818c2b322ceb1299944271a781d59dc3252e28dfb0e547fd836a66b6ed7
Instruction ID: 7dfed1a65ddb63dcdeb26882a88267950b43b39f14c7a52d34cb789f1d060d34
Opcode Fuzzy Hash: b8973818c2b322ceb1299944271a781d59dc3252e28dfb0e547fd836a66b6ed7
Instruction Fuzzy Hash: 7AC15D33B24A068AEB148B66D4403AC73B1BB44BACF084235CE6D977D9DF78D446CB50

Function 00007FF6729CD2A0 Relevance: 5.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6729C03D8), ref: 00007FF6729CD2D1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF6729C03D8), ref: 00007FF6729CD2E4
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6729C03D8), ref: 00007FF6729CD30B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF6729C03D8), ref: 00007FF6729CD318

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: 401fd561d18a41378e9f1d23ca106fa73c096c2596b837a7fe3ed38c712ed293
Instruction ID: 1de8f9a9c18b92be7bbff7fecd4244b474945c1404d75c1a41d75dcfc35d4431
Opcode Fuzzy Hash: 401fd561d18a41378e9f1d23ca106fa73c096c2596b837a7fe3ed38c712ed293
Instruction Fuzzy Hash: 3E112433B28B4282E7109F66F55002AA7A1FF48B9CB5C4635DB5D87B55DE7CD5418B00

Function 00007FF67298BC30 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF672985760: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF67298FD60,?,?,?,?,?,?,?,?,?,?,00000000,00007FF672981B91), ref: 00007FF672985787
Part of subcall function 00007FF672985760: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF67298FD60,?,?,?,?,?,?,?,?,?,?,00000000,00007FF672981B91), ref: 00007FF672985793

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298BC66
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298BC76
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF67298BC84
memset.VCRUNTIME140 ref: 00007FF67298BCBF

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free$memset
String ID:
API String ID: 2717317152-0
Opcode ID: 966afde81f55b4a45680f927e29d9bdd61b9446a363dd2483b6ff75bf9856eaf
Instruction ID: feb935f346838c4be82b3f51f06f25d2076d0cc4aea4dbbf2c6959959ff6bae4
Opcode Fuzzy Hash: 966afde81f55b4a45680f927e29d9bdd61b9446a363dd2483b6ff75bf9856eaf
Instruction Fuzzy Hash: 1E21ED33E24B91A3E704CB22D6902A97360F799744F199225EB9D83A62DFB4F1F5C700

Function 00007FF6729B2C30 Relevance: 5.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B2C68
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B2C8E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B2CAA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6729B2CBE

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 3d7bbf7bf85c89656d30906a6a857632f5a45af87e7b9c2b1b6d7b83672e2938
Instruction ID: 3ca125076820f7be3cd7e09073ca59aae5bd095a5141ada2947da227c29df0c7
Opcode Fuzzy Hash: 3d7bbf7bf85c89656d30906a6a857632f5a45af87e7b9c2b1b6d7b83672e2938
Instruction Fuzzy Hash: 1F11F837A24B85C6D740CF66E9802A873A4F784F59F084135DE8E97729CF78E899C750

Function 00007FF6729C4870 Relevance: 5.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729C096E), ref: 00007FF6729C4896
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729C096E), ref: 00007FF6729C48B7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729C096E), ref: 00007FF6729C48D2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6729C096E), ref: 00007FF6729C48E0

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 3712c1340399623fe6935ac307510297d4c592ad3bfc48404f2be848c517c67a
Instruction ID: af36b7c92519d33fbff33a8b36587f4520daf3e61e3c22536bcf02306d0a8c7c
Opcode Fuzzy Hash: 3712c1340399623fe6935ac307510297d4c592ad3bfc48404f2be848c517c67a
Instruction Fuzzy Hash: EE117837A24B81C2DB04DF66E99006CB3A5FF94F99B184526CA4D83769CFB8D895C780

Function 00007FF6729C2210 Relevance: 5.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672998435,?,?,00000000,00007FF6729910F1,?,?,00000000,00007FF672991625), ref: 00007FF6729C2220
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672998435,?,?,00000000,00007FF6729910F1,?,?,00000000,00007FF672991625), ref: 00007FF6729C2246
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672998435,?,?,00000000,00007FF6729910F1,?,?,00000000,00007FF672991625), ref: 00007FF6729C2254
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF672998435,?,?,00000000,00007FF6729910F1,?,?,00000000,00007FF672991625), ref: 00007FF6729C2262

Memory Dump Source

Source File: 00000000.00000002.1430936222.00007FF672971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF672970000, based on PE: true

Associated: 00000000.00000002.1430916771.00007FF672970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430983901.00007FF6729D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431008117.00007FF6729E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431029693.00007FF6729E9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff672970000_xxImTScxAq.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2e813ba0d54f36914a56cfa9236fbf532bfcc7bcbafa9ccb2a0669a6b2df3caf
Instruction ID: 0168cac431b149f7f10a00d84142acce8ff2520bbb50dcb9f1c05dcca0c0e6ff
Opcode Fuzzy Hash: 2e813ba0d54f36914a56cfa9236fbf532bfcc7bcbafa9ccb2a0669a6b2df3caf
Instruction Fuzzy Hash: 77F0C937A24B41C2DB04CF62E994068B3B4FB98F89B154531CE9E83769CF78C4A5C740

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Tactics:	Lateral Movement
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report xxImTScxAq.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Phishing

Compliance

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Windows Analysis Report
xxImTScxAq.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre