Edit tour

Windows Analysis Report
Fa1QSXjTZD.exe

Overview

General Information

Sample name:	Fa1QSXjTZD.exe renamed because original name is a hash value
Original sample name:	43a2789db11a7a83ca1250ffbc135210.exe
Analysis ID:	1540861
MD5:	43a2789db11a7a83ca1250ffbc135210
SHA1:	564b660762081a9c6ef729c0fe388d8465ea05e1
SHA256:	04e4e646de39b18d7a9b4fe567dfdc986e21e469813f0069220649d26aed862d
Tags:	64exe
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Javascript uses Websockets

Machine Learning detection for sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to create an SMB header

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTML page contains hidden javascript code

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Uses Microsoft's Enhanced Cryptographic Provider

Uses insecure TLS / SSL version for HTTPS connection

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

Fa1QSXjTZD.exe (PID: 7472 cmdline: "C:\Users\user\Desktop\Fa1QSXjTZD.exe" MD5: 43A2789DB11A7A83CA1250FFBC135210)

conhost.exe (PID: 7480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7524 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7556 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7604 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7620 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7648 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7664 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7696 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 7712 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 7728 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 7744 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 7760 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 7776 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7792 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7820 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7836 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7900 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7916 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7948 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 7964 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 7980 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 7996 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 8012 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 8036 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 8052 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 8080 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 8096 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 8124 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 8140 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 8172 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 8188 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 7184 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 7224 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 7288 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

chrome.exe (PID: 4848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://discord.gg/privatecommunity MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7592 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1916,i,2913657158474156013,13990504573392746197,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4108 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5732 --field-trial-handle=1916,i,2913657158474156013,13990504573392746197,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4216 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 --field-trial-handle=1916,i,2913657158474156013,13990504573392746197,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Fa1QSXjTZD.exe

ReversingLabs: Detection: 34%

Machine Learning detection for sample

Source: Fa1QSXjTZD.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B29F4D strtol,strchr,strchr,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strchr,_strdup,CertOpenStore,GetLastError,free,free,CryptStringToBinaryA,CertFindCertificateInStore,fopen,fseek,ftell,fseek,malloc,fread,fclose,malloc,MultiByteToWideChar,PFXImportCertStore,free,free,GetLastError,CertFindCertificateInStore,GetLastError,CertCloseStore,CertCloseStore,calloc,CertFreeCertificateContext,fclose,free,CertFreeCertificateContext,free,calloc,	0_2_00007FF7C6B29F4D
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B46400 GetLastError,CreateFileA,GetLastError,GetFileSizeEx,GetLastError,malloc,ReadFile,strstr,strstr,CryptQueryObject,CertAddCertificateContextToStore,CertFreeCertificateContext,GetLastError,GetLastError,GetLastError,CloseHandle,free,	0_2_00007FF7C6B46400
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B2C1D0 CryptAcquireContextA,CryptCreateHash,	0_2_00007FF7C6B2C1D0
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B29310 memset,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF7C6B29310
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B2C220 CryptHashData,	0_2_00007FF7C6B2C220
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B2C230 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF7C6B2C230
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B29240 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,	0_2_00007FF7C6B29240
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B4EF40 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF7C6B4EF40
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B4CE50 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	0_2_00007FF7C6B4CE50
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B45AE0 CertOpenStore,GetLastError,CertCreateCertificateChainEngine,GetLastError,CertGetCertificateChain,GetLastError,CertGetNameStringA,malloc,CertFindExtension,CryptDecodeObjectEx,CertGetNameStringA,CertFindExtension,CryptDecodeObjectEx,CertFreeCertificateChainEngine,CertCloseStore,CertFreeCertificateChain,CertFreeCertificateContext,	0_2_00007FF7C6B45AE0

Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: -----BEGIN PUBLIC KEY-----		0_2_00007FF7C6B0F0F0
Source: Fa1QSXjTZD.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe

Code function: mov dword ptr [rbp+04h], 424D53FFh

0_2_00007FF7C6B38B10

Phishing

Javascript uses Websockets

Source: https://discord.com/invite/privatecommunity

HTTP Parser: !function(){if(null!=window.websocket){if(function(n){try{var o=localstorage.getitem(n);return null==o?null:json.parse(o)}catch(n){return null}}("token")&&!window.__overlay__){var n=null!=window.discordnative||null!=window.require?"etf":"json",o=window.global_env.gateway_endpoint+"/?encoding="+n+"&v="+window.global_env.api_version;null!=window.discordnative&&void 0!==window.uint8array&&void 0!==window.textdecoder?o+="&compress=zstd-stream":void 0!==window.uint8array&&(o+="&compress=zlib-stream"),console.log("[fast connect] "+o+", encoding: "+n+", version: "+window.global_env.api_version);var e=new websocket(o);e.binarytype="arraybuffer";var i=date.now(),w={open:!1,identify:!1,gateway:o,messages:[]};e.onopen=function(){console.log("[fast connect] connected in "+(date.now()-i)+"ms"),w.open=!0},e.onclose=e.onerror=function(){window._ws=null},e.onmessage=function(n){w.messages.push(n)},window._ws={ws:e,state:w}}}}()

Source: https://discord.com/invite/privatecommunity

HTTP Parser: Base64 decoded: 1729754175.000000

Source: unknown

HTTPS traffic detected: 23.206.229.209:443 -> 192.168.2.9:49912 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.9:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.9:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.1.5:443 -> 192.168.2.9:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.9:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.9:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.9:50120 version: TLS 1.2

Source: Fa1QSXjTZD.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\Loader Valorant ESP\x64\Release\EpicGames.pdb source: Fa1QSXjTZD.exe

Source: chrome.exe

Memory has grown: Private usage: 20MB later: 71MB

Source: global traffic

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 58Content-Type: application/x-www-form-urlencoded

Source: Joe Sandbox View	IP Address: 162.159.136.232 162.159.136.232
Source: Joe Sandbox View	IP Address: 104.26.1.5 104.26.1.5
Source: Joe Sandbox View	IP Address: 162.159.128.233 162.159.128.233

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

HTTPS traffic detected: 23.206.229.209:443 -> 192.168.2.9:49912 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45

Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe

Code function: 0_2_00007FF7C6B01540 rand,rand,rand,SetConsoleTitleA,_invalid_parameter_noinfo_noreturn,GetConsoleWindow,GetWindowLongPtrA,SetWindowLongPtrA,SetLayeredWindowAttributes,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A,??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z,URLDownloadToFileA,system,system,Sleep,exit,URLDownloadToFileA,system,system,Sleep,exit,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7C6B01540

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /privatecommunity HTTP/1.1Host: discord.ggConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /invite/privatecommunity HTTP/1.1Host: discord.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/69646.2af8e3f2e60b2cca1cbf.css HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/webMinimal.183cbc8427e6b143ce21.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/sentry.d30fc24f50e5e3e76b3e.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/sentry.d30fc24f50e5e3e76b3e.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/webMinimal.183cbc8427e6b143ce21.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/591980d24607547de30a.css HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/2917679ca8a08c390036.css HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/8234e0a75aa9afb205bd.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/b21c5111a12372139409.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/8bd8143eff37936894aa.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/452d7be36bf4b23241bd.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/48a594e29497835802fe.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /assets/f5b8aa3411dfc24ff2e6.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /api/v9/experiments?with_guild_experiments=true HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Super-Properties: eyJvcyI6IldpbmRvd3MiLCJicm93c2VyIjoiQ2hyb21lIiwiZGV2aWNlIjoiIiwic3lzdGVtX2xvY2FsZSI6ImVuLVVTIiwiYnJvd3Nlcl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2IiwiYnJvd3Nlcl92ZXJzaW9uIjoiMTE3LjAuMC4wIiwib3NfdmVyc2lvbiI6IjEwIiwicmVmZXJyZXIiOiIiLCJyZWZlcnJpbmdfZG9tYWluIjoiIiwicmVmZXJyZXJfY3VycmVudCI6IiIsInJlZmVycmluZ19kb21haW5fY3VycmVudCI6IiIsInJlbGVhc2VfY2hhbm5lbCI6InN0YWJsZSIsImNsaWVudF9idWlsZF9udW1iZXIiOjMzODU0MCwiY2xpZW50X2V2ZW50X3NvdXJjZSI6bnVsbH0=X-Context-Properties: eyJsb2NhdGlvbiI6IkFjY2VwdCBJbnZpdGUgUGFnZSJ9X-Debug-Options: bugReporterEnabledsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Discord-Timezone: America/New_YorkX-Discord-Locale: en-USsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/ac625b77a0bab0ee72df.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/29a63f12209c956d9204.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/55ad931ed92a15c15709.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/5067a2ec1b24a6de868c.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/assets/ac625b77a0bab0ee72df.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/a6f6204cd40c3c5f5c14.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/assets/ac625b77a0bab0ee72df.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/ac625b77a0bab0ee72df.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/29a63f12209c956d9204.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/1f7f046253c197b5a419.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/1bab9b095996b8d024ce.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/assets/ac625b77a0bab0ee72df.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/d67c5e680608266a1f63.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/d86788be99e870993214.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/a14c32460cf87caa605c.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/94ec0c2b39908933eed3.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/36e086bbcea2eace814d.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/6df906184440a6461f5c.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/fdc71c23d09e18e94ce2.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/89b7ddebcacbe8dfbd3a.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/ea8b2ed5e609f40e7f7b.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/af6b8f380faee0e9f47d.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/6674c18c2e4160ceca2d.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/bd0ab83c61025d7c7000.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SvYkLYbatvrvdrc&MD=c99YUR1o HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/b8160243347055e1f278.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/1222195a37d6dd10994e.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/c1b53be672aac192a996.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /api/v9/invites/privatecommunity?with_counts=true&with_expiration=true HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Super-Properties: eyJvcyI6IldpbmRvd3MiLCJicm93c2VyIjoiQ2hyb21lIiwiZGV2aWNlIjoiIiwic3lzdGVtX2xvY2FsZSI6ImVuLVVTIiwiYnJvd3Nlcl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2IiwiYnJvd3Nlcl92ZXJzaW9uIjoiMTE3LjAuMC4wIiwib3NfdmVyc2lvbiI6IjEwIiwicmVmZXJyZXIiOiIiLCJyZWZlcnJpbmdfZG9tYWluIjoiIiwicmVmZXJyZXJfY3VycmVudCI6IiIsInJlZmVycmluZ19kb21haW5fY3VycmVudCI6IiIsInJlbGVhc2VfY2hhbm5lbCI6InN0YWJsZSIsImNsaWVudF9idWlsZF9udW1iZXIiOjMzODU0MCwiY2xpZW50X2V2ZW50X3NvdXJjZSI6bnVsbH0=X-Fingerprint: 1298907928115281940.cAYkMt3Px22XYBub5q1myFVn9esX-Debug-Options: bugReporterEnabledsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Discord-Timezone: America/New_YorkX-Discord-Locale: en-USsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /api/v9/experiments?with_guild_experiments=true HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/ecff74bf4394e6e58dd1.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/55ad931ed92a15c15709.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/5067a2ec1b24a6de868c.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/a6f6204cd40c3c5f5c14.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/1f7f046253c197b5a419.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/1bab9b095996b8d024ce.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/914a97ac83e173c66dd7.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/0e5029fd9cd4812b6712.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/b9995525a52dc58aecf5.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/23a7a3fd6624342117bf.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/assets/591980d24607547de30a.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/d67c5e680608266a1f63.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /api/v9/auth/location-metadata HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Super-Properties: eyJvcyI6IldpbmRvd3MiLCJicm93c2VyIjoiQ2hyb21lIiwiZGV2aWNlIjoiIiwic3lzdGVtX2xvY2FsZSI6ImVuLVVTIiwiYnJvd3Nlcl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2IiwiYnJvd3Nlcl92ZXJzaW9uIjoiMTE3LjAuMC4wIiwib3NfdmVyc2lvbiI6IjEwIiwicmVmZXJyZXIiOiIiLCJyZWZlcnJpbmdfZG9tYWluIjoiIiwicmVmZXJyZXJfY3VycmVudCI6IiIsInJlZmVycmluZ19kb21haW5fY3VycmVudCI6IiIsInJlbGVhc2VfY2hhbm5lbCI6InN0YWJsZSIsImNsaWVudF9idWlsZF9udW1iZXIiOjMzODU0MCwiY2xpZW50X2V2ZW50X3NvdXJjZSI6bnVsbH0=X-Fingerprint: 1298907928115281940.cAYkMt3Px22XYBub5q1myFVn9esX-Debug-Options: bugReporterEnabledsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Discord-Timezone: America/New_YorkX-Discord-Locale: en-USsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/d86788be99e870993214.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/a14c32460cf87caa605c.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/94ec0c2b39908933eed3.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/36e086bbcea2eace814d.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /icons/1230227842877620359/a_75aa56a5faded73ac41ce0fac1e7d74c.webp?size=64 HTTP/1.1Host: cdn.discordapp.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /splashes/1230227842877620359/04b58b5d8c863962ccdac305e5ee1269.jpg?size=1280 HTTP/1.1Host: cdn.discordapp.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/6df906184440a6461f5c.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/05bd1eb5dea5ee3387f4.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/fdc71c23d09e18e94ce2.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/6674c18c2e4160ceca2d.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/af6b8f380faee0e9f47d.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/2597d11c1e039607373e.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/a5ec2b74d0cc337d4481.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/89b7ddebcacbe8dfbd3a.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/5430e9964fe8364e084d.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/ea8b2ed5e609f40e7f7b.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/b8160243347055e1f278.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/ab03f7053698d417194c.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/410a2166a48c9e482e2a.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/9017b7062734e72bb476.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/af5116b1db004acbdb8b.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/ba88bbd1342d3f000e33.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /api/v9/invites/privatecommunity?with_counts=true&with_expiration=true HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/bd0ab83c61025d7c7000.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/0e5029fd9cd4812b6712.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/23a7a3fd6624342117bf.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/b9995525a52dc58aecf5.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /api/v9/auth/location-metadata HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/favicon.ico HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/05bd1eb5dea5ee3387f4.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/a5ec2b74d0cc337d4481.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /icons/1230227842877620359/a_75aa56a5faded73ac41ce0fac1e7d74c.webp?size=64 HTTP/1.1Host: cdn.discordapp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=dutHqVZyGLoECv_xTrVsXDeJI_cxXqn49QpFlp_Q_74-1729754187-1.0.1.1-c2apE46gPAMCgLeZzu5fGMeSBgbIsbkIEK.l2Rm0t2f39CQUsSpPEN689QfJn7znTHohQbxhlll9pknzPgMFPg; _cfuvid=qNuG29U4ReOY_jVbYVEvsDWobQhzGIL1KRcQCowSndU-1729754187986-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js? HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/2597d11c1e039607373e.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/5430e9964fe8364e084d.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/ab03f7053698d417194c.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /splashes/1230227842877620359/04b58b5d8c863962ccdac305e5ee1269.jpg?size=1280 HTTP/1.1Host: cdn.discordapp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=dutHqVZyGLoECv_xTrVsXDeJI_cxXqn49QpFlp_Q_74-1729754187-1.0.1.1-c2apE46gPAMCgLeZzu5fGMeSBgbIsbkIEK.l2Rm0t2f39CQUsSpPEN689QfJn7znTHohQbxhlll9pknzPgMFPg; _cfuvid=qNuG29U4ReOY_jVbYVEvsDWobQhzGIL1KRcQCowSndU-1729754187986-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/410a2166a48c9e482e2a.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/9017b7062734e72bb476.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/ba88bbd1342d3f000e33.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/af5116b1db004acbdb8b.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/favicon.ico HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js? HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/jsd/r/8d782e2e4d124647 HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SvYkLYbatvrvdrc&MD=c99YUR1o HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: keyauth.win
Source: global traffic	DNS traffic detected: DNS query: discord.gg
Source: global traffic	DNS traffic detected: DNS query: discord.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cdn.discordapp.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 58Content-Type: application/x-www-form-urlencoded

Source: Fa1QSXjTZD.exe	String found in binary or memory: http://185.101.104.122/esphvibronkz.exe
Source: Fa1QSXjTZD.exe	String found in binary or memory: http://185.101.104.122/esphvibronkz.exeC:
Source: Fa1QSXjTZD.exe	String found in binary or memory: http://185.101.104.122/espsemhvibronkz.exe
Source: Fa1QSXjTZD.exe	String found in binary or memory: http://185.101.104.122/espsemhvibronkz.exeC:
Source: chromecache_195.39.dr, chromecache_165.39.dr	String found in binary or memory: http://discord.gg/fortnite).
Source: chromecache_181.39.dr	String found in binary or memory: https://cdn.discordapp.com/splashes/1230227842877620359/04b58b5d8c863962ccdac305e5ee1269.jpg?size=51
Source: Fa1QSXjTZD.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: Fa1QSXjTZD.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com
Source: chromecache_195.39.dr, chromecache_165.39.dr	String found in binary or memory: https://discord.com/
Source: chromecache_195.39.dr, chromecache_165.39.dr	String found in binary or memory: https://discord.com/blog/important-policy-updates)
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=ar
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=bg
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=cs
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=da
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=de
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=el
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=en-GB
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=en-US
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=es-419
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=es-ES
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=fi
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=fr
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=he
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=hi
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=hr
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=hu
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=id
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=it
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=ja
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=ko
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=lt
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=nl
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=no
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=pl
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=pt-BR
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=ro
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=ru
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=sv-SE
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=th
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=tr
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=uk
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=vi
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=zh-CN
Source: chromecache_181.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=zh-TW
Source: Fa1QSXjTZD.exe, 00000000.00000002.1447749371.0000022204C29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunity
Source: Fa1QSXjTZD.exe, 00000000.00000002.1447749371.0000022204C5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunityC
Source: Fa1QSXjTZD.exe, 00000000.00000002.1447749371.0000022204C5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunityI
Source: Fa1QSXjTZD.exe, 00000000.00000002.1447749371.0000022204C5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunityX
Source: Fa1QSXjTZD.exe, 00000000.00000002.1447749371.0000022204C5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunityt
Source: chromecache_181.39.dr	String found in binary or memory: https://discordapp.com
Source: Fa1QSXjTZD.exe, 00000000.00000002.1447749371.0000022204C29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/
Source: Fa1QSXjTZD.exe, 00000000.00000002.1447749371.0000022204C29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/ace
Source: Fa1QSXjTZD.exe, 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmp, Fa1QSXjTZD.exe, 00000000.00000002.1447749371.0000022204C29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/
Source: Fa1QSXjTZD.exe, 00000000.00000002.1447749371.0000022204C29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/=U
Source: chromecache_195.39.dr, chromecache_165.39.dr	String found in binary or memory: https://support.discord.com/hc/en-us/articles/4410339366295-Paid-Services-Terms).
Source: chromecache_195.39.dr, chromecache_165.39.dr	String found in binary or memory: https://twitter.com/discord).

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443

Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.9:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.9:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.1.5:443 -> 192.168.2.9:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.9:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.9:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.9:50120 version: TLS 1.2

Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe

Code function: 0_2_00007FF7C6B4CE50 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,

0_2_00007FF7C6B4CE50

Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B1F5A0	0_2_00007FF7C6B1F5A0
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B01540	0_2_00007FF7C6B01540
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B29F4D	0_2_00007FF7C6B29F4D
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B17CD0	0_2_00007FF7C6B17CD0
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B18990	0_2_00007FF7C6B18990
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B16990	0_2_00007FF7C6B16990
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6AF974B	0_2_00007FF7C6AF974B
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B228A0	0_2_00007FF7C6B228A0
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B19850	0_2_00007FF7C6B19850
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B2C5E0	0_2_00007FF7C6B2C5E0
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B10610	0_2_00007FF7C6B10610
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B415C0	0_2_00007FF7C6B415C0
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B40590	0_2_00007FF7C6B40590
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B39530	0_2_00007FF7C6B39530
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6AF956D	0_2_00007FF7C6AF956D
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B253F0	0_2_00007FF7C6B253F0
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B13340	0_2_00007FF7C6B13340
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B3D230	0_2_00007FF7C6B3D230
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6AFD260	0_2_00007FF7C6AFD260
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B2A00C	0_2_00007FF7C6B2A00C
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B2A015	0_2_00007FF7C6B2A015
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6AF1000	0_2_00007FF7C6AF1000
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6AFDDF0	0_2_00007FF7C6AFDDF0
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B4EED0	0_2_00007FF7C6B4EED0
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B4CE50	0_2_00007FF7C6B4CE50
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6AFAC0D	0_2_00007FF7C6AFAC0D
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6AFEB80	0_2_00007FF7C6AFEB80
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B27CD0	0_2_00007FF7C6B27CD0
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B34A00	0_2_00007FF7C6B34A00
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B089A0	0_2_00007FF7C6B089A0
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B45AE0	0_2_00007FF7C6B45AE0

Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: String function: 00007FF7C6B15B00 appears 326 times
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: String function: 00007FF7C6B1A420 appears 34 times
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: String function: 00007FF7C6B15980 appears 380 times
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: String function: 00007FF7C6B03040 appears 49 times
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: String function: 00007FF7C6B18E90 appears 36 times
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: String function: 00007FF7C6B1A340 appears 33 times
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: String function: 00007FF7C6B1A2B0 appears 37 times
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: String function: 00007FF7C6B10250 appears 70 times
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: String function: 00007FF7C6B50246 appears 47 times
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: String function: 00007FF7C6B18DC0 appears 46 times

Source: classification engine

Classification label: mal56.phis.winEXE@88/176@15/12

Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe

Code function: 0_2_00007FF7C6B02650 GetLastError,_errno,FormatMessageA,strchr,_errno,_errno,GetLastError,SetLastError,

0_2_00007FF7C6B02650

Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7480:120:WilError_03

Source: Fa1QSXjTZD.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Fa1QSXjTZD.exe

ReversingLabs: Detection: 34%

Source: Fa1QSXjTZD.exe

String found in binary or memory: iphlpapi.dllif_nametoindexkernel32LoadLibraryExA\/AddDllDirectory0123456789abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ(nil)(nil)I32I64%ld.%ld$@

Source: unknown	Process created: C:\Users\user\Desktop\Fa1QSXjTZD.exe "C:\Users\user\Desktop\Fa1QSXjTZD.exe"
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://discord.gg/privatecommunity
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1916,i,2913657158474156013,13990504573392746197,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5732 --field-trial-handle=1916,i,2913657158474156013,13990504573392746197,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 --field-trial-handle=1916,i,2913657158474156013,13990504573392746197,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://discord.gg/privatecommunity	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1916,i,2913657158474156013,13990504573392746197,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5732 --field-trial-handle=1916,i,2913657158474156013,13990504573392746197,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 --field-trial-handle=1916,i,2913657158474156013,13990504573392746197,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1A66AEDC-93C3-4ACC-BA96-08F5716429F7}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.37.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.37.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.37.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.37.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.37.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.37.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Access\Capabilities\UrlAssociations

Jump to behavior

Source: Fa1QSXjTZD.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Fa1QSXjTZD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Fa1QSXjTZD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Fa1QSXjTZD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Fa1QSXjTZD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Fa1QSXjTZD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Fa1QSXjTZD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Fa1QSXjTZD.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Fa1QSXjTZD.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\Loader Valorant ESP\x64\Release\EpicGames.pdb source: Fa1QSXjTZD.exe

Source: Fa1QSXjTZD.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Fa1QSXjTZD.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Fa1QSXjTZD.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Fa1QSXjTZD.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Fa1QSXjTZD.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe

Code function: 0_2_00007FF7C6B18670 GetModuleHandleA,GetProcAddress,strpbrk,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,malloc,GetSystemDirectoryA,LoadLibraryA,free,

0_2_00007FF7C6B18670

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro

Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe

API coverage: 4.2 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: Fa1QSXjTZD.exe, 00000000.00000002.1447749371.0000022204C5D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}K
Source: Fa1QSXjTZD.exe, 00000000.00000002.1447749371.0000022204C29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllo
Source: Fa1QSXjTZD.exe, 00000000.00000002.1447749371.0000022204C5D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}e
Source: Fa1QSXjTZD.exe, 00000000.00000002.1447749371.0000022204C5D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: Fa1QSXjTZD.exe, 00000000.00000002.1447749371.0000022204C5D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}e2

Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe

Code function: 0_2_00007FF7C6B500F8 memset,GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF7C6B500F8

Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe

Code function: 0_2_00007FF7C6B500F8 memset,GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF7C6B500F8

Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe

Code function: 0_2_00007FF7C6B18670 GetModuleHandleA,GetProcAddress,strpbrk,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,malloc,GetSystemDirectoryA,LoadLibraryA,free,

0_2_00007FF7C6B18670

Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B4FD5C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7C6B4FD5C
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B4FF04 SetUnhandledExceptionFilter,	0_2_00007FF7C6B4FF04
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B4FA04 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7C6B4FA04

Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://discord.gg/privatecommunity	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T

Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe

Code function: 0_2_00007FF7C6B4FF74 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7C6B4FF74

Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B24A70 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,memcmp,closesocket,closesocket,closesocket,closesocket,	0_2_00007FF7C6B24A70
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B3B760 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF7C6B3B760
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B17640 memset,strncmp,strncmp,strchr,htons,atoi,htons,htons,bind,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	0_2_00007FF7C6B17640
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B3B500 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF7C6B3B500
Source: C:\Users\user\Desktop\Fa1QSXjTZD.exe	Code function: 0_2_00007FF7C6B34A00 calloc,strchr,strncpy,strchr,strncpy,strchr,strtoul,strchr,strtoul,getsockname,WSAGetLastError,free,WSAGetLastError,memcpy,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,free,	0_2_00007FF7C6B34A00

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Windows Service	1 Windows Service	1 Masquerading	OS Credential Dumping	1 System Time Discovery	1 Exploitation of Remote Services	12 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	11 Process Injection	Security Account Manager	4 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Native API	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Extra Window Memory Injection	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Fa1QSXjTZD.exe	34%	ReversingLabs	Win64.Trojan.Generic
Fa1QSXjTZD.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://curl.haxx.se/docs/http-cookies.html	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
discord.gg	162.159.130.234	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	unknown
keyauth.win	104.26.1.5	true	false	unknown
discord.com	162.159.128.233	true	false	unknown
cdn.discordapp.com	162.159.133.233	true	false	unknown
www.google.com	142.250.185.228	true	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://discord.com/assets/9017b7062734e72bb476.svg	false	unknown
https://a.nel.cloudflare.com/report/v4?s=zYMoHwiT6J2kGsdyjeD%2FlnSjwWx84xWsVCHB02MEXMSUATESBiCsfX2kvyZwKJik5m5kPKcSdhAnaGgzirMmBhFPqyNY28WmN5T21F0xQ4KCteZWyIEIeWTbcXB%2B	false	unknown
https://discord.com/assets/5067a2ec1b24a6de868c.js	false	unknown
https://discord.com/assets/a5ec2b74d0cc337d4481.svg	false	unknown
https://discord.com/assets/ea8b2ed5e609f40e7f7b.js	false	unknown
https://discord.com/assets/23a7a3fd6624342117bf.svg	false	unknown
https://discord.com/assets/1f7f046253c197b5a419.js	false	unknown
https://discord.com/assets/5430e9964fe8364e084d.svg	false	unknown
https://discord.com/assets/ecff74bf4394e6e58dd1.woff2	false	unknown
https://discord.com/assets/d86788be99e870993214.js	false	unknown
https://discord.com/assets/1222195a37d6dd10994e.woff2	false	unknown
https://discord.gg/privatecommunity	false	unknown
https://discord.com/assets/af5116b1db004acbdb8b.svg	false	unknown
https://discord.com/assets/webMinimal.183cbc8427e6b143ce21.js	false	unknown
https://discord.com/assets/f5b8aa3411dfc24ff2e6.woff2	false	unknown
https://discord.com/assets/af6b8f380faee0e9f47d.js	false	unknown
https://discord.com/assets/c1b53be672aac192a996.woff2	false	unknown
https://discord.com/cdn-cgi/challenge-platform/h/g/jsd/r/8d782e2e4d124647	false	unknown
https://discord.com/assets/sentry.d30fc24f50e5e3e76b3e.js	false	unknown
https://discord.com/assets/914a97ac83e173c66dd7.woff2	false	unknown
https://discord.com/assets/591980d24607547de30a.css	false	unknown
https://discord.com/api/v9/auth/location-metadata	false	unknown
https://discord.com/assets/8234e0a75aa9afb205bd.woff2	false	unknown
https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css	false	unknown
https://cdn.discordapp.com/icons/1230227842877620359/a_75aa56a5faded73ac41ce0fac1e7d74c.webp?size=64	false	unknown
https://discord.com/api/v9/science	false	unknown
https://discord.com/assets/b21c5111a12372139409.woff2	false	unknown
https://discord.com/assets/89b7ddebcacbe8dfbd3a.js	false	unknown
https://discord.com/assets/b8160243347055e1f278.js	false	unknown
https://cdn.discordapp.com/splashes/1230227842877620359/04b58b5d8c863962ccdac305e5ee1269.jpg?size=1280	false	unknown
https://discord.com/assets/2597d11c1e039607373e.svg	false	unknown
https://discord.com/assets/2917679ca8a08c390036.css	false	unknown
https://discord.com/assets/410a2166a48c9e482e2a.svg	false	unknown
https://discord.com/assets/94ec0c2b39908933eed3.js	false	unknown
https://discord.com/assets/a6f6204cd40c3c5f5c14.js	false	unknown
https://discord.com/assets/a14c32460cf87caa605c.js	false	unknown
https://discord.com/invite/privatecommunity	true	unknown
https://discord.com/assets/05bd1eb5dea5ee3387f4.js	false	unknown
https://discord.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js?	false	unknown
https://discord.com/assets/0e5029fd9cd4812b6712.svg	false	unknown
https://discord.com/assets/8bd8143eff37936894aa.woff2	false	unknown
https://discord.com/assets/6df906184440a6461f5c.js	false	unknown
https://discord.com/assets/55ad931ed92a15c15709.js	false	unknown
https://discord.com/assets/452d7be36bf4b23241bd.woff2	false	unknown
https://discord.com/assets/d67c5e680608266a1f63.js	false	unknown
https://discord.com/assets/ab03f7053698d417194c.svg	false	unknown
https://discord.com/assets/fdc71c23d09e18e94ce2.js	false	unknown
https://discord.com/assets/favicon.ico	false	unknown
https://discord.com/assets/29a63f12209c956d9204.js	false	unknown
https://keyauth.win/api/1.1/	false	unknown
https://discord.com/assets/bd0ab83c61025d7c7000.js	false	unknown
https://discord.com/assets/36e086bbcea2eace814d.js	false	unknown
https://discord.com/assets/6674c18c2e4160ceca2d.js	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://twitter.com/discord).	chromecache_195.39.dr, chromecache_165.39.dr	false		unknown
https://discordapp.com	chromecache_181.39.dr	false		unknown
https://discord.com/invite/privatecommunity?locale=ko	chromecache_181.39.dr	true		unknown
https://discord.com/	chromecache_195.39.dr, chromecache_165.39.dr	false		unknown
https://keyauth.win/api/1.1/ace	Fa1QSXjTZD.exe, 00000000.00000002.1447749371.0000022204C29000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://curl.haxx.se/docs/http-cookies.html#	Fa1QSXjTZD.exe	false		unknown
https://discord.com/invite/privatecommunity?locale=es-419	chromecache_181.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=ar	chromecache_181.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=ro	chromecache_181.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=ja	chromecache_181.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=ru	chromecache_181.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=bg	chromecache_181.39.dr	true		unknown
https://keyauth.win/api/1.2/=U	Fa1QSXjTZD.exe, 00000000.00000002.1447749371.0000022204C29000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://keyauth.win/api/1.2/	Fa1QSXjTZD.exe, 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmp, Fa1QSXjTZD.exe, 00000000.00000002.1447749371.0000022204C29000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.discord.com/hc/en-us/articles/4410339366295-Paid-Services-Terms).	chromecache_195.39.dr, chromecache_165.39.dr	false		unknown
https://discord.com	chromecache_181.39.dr	false		unknown
https://discord.com/invite/privatecommunity?locale=uk	chromecache_181.39.dr	true		unknown
http://185.101.104.122/espsemhvibronkz.exeC:	Fa1QSXjTZD.exe	false		unknown
https://discord.com/invite/privatecommunity?locale=pt-BR	chromecache_181.39.dr	true		unknown
https://discord.com/blog/important-policy-updates)	chromecache_195.39.dr, chromecache_165.39.dr	false		unknown
https://discord.com/invite/privatecommunity?locale=el	chromecache_181.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=th	chromecache_181.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=cs	chromecache_181.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=da	chromecache_181.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=tr	chromecache_181.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=zh-CN	chromecache_181.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=de	chromecache_181.39.dr	true		unknown
http://discord.gg/fortnite).	chromecache_195.39.dr, chromecache_165.39.dr	false		unknown
https://discord.com/invite/privatecommunity?locale=lt	chromecache_181.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=en-GB	chromecache_181.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=zh-TW	chromecache_181.39.dr	true		unknown
https://discord.gg/privatecommunityt	Fa1QSXjTZD.exe, 00000000.00000002.1447749371.0000022204C5D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://curl.haxx.se/docs/http-cookies.html	Fa1QSXjTZD.exe	false	URL Reputation: safe	unknown
https://discord.com/invite/privatecommunity?locale=en-US	chromecache_181.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=vi	chromecache_181.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=nl	chromecache_181.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=fi	chromecache_181.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=sv-SE	chromecache_181.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=no	chromecache_181.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=fr	chromecache_181.39.dr	true		unknown
http://185.101.104.122/esphvibronkz.exe	Fa1QSXjTZD.exe	false		unknown
http://185.101.104.122/espsemhvibronkz.exe	Fa1QSXjTZD.exe	false		unknown
https://discord.gg/privatecommunityC	Fa1QSXjTZD.exe, 00000000.00000002.1447749371.0000022204C5D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://discord.com/invite/privatecommunity?locale=es-ES	chromecache_181.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=id	chromecache_181.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=it	chromecache_181.39.dr	true		unknown
https://cdn.discordapp.com/splashes/1230227842877620359/04b58b5d8c863962ccdac305e5ee1269.jpg?size=51	chromecache_181.39.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.159.136.232	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.185.228	www.google.com	United States	15169	GOOGLEUS	false
104.26.1.5	keyauth.win	United States	13335	CLOUDFLARENETUS	false
162.159.128.233	discord.com	United States	13335	CLOUDFLARENETUS	false
162.159.133.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
162.159.130.234	discord.gg	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
162.159.129.233	unknown	United States	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.7
192.168.2.9
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540861
Start date and time:	2024-10-24 09:15:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	49
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Fa1QSXjTZD.exe renamed because original name is a hash value
Original Sample Name:	43a2789db11a7a83ca1250ffbc135210.exe
Detection:	MAL
Classification:	mal56.phis.winEXE@88/176@15/12
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 43 Number of non-executed functions: 236
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.67, 142.250.186.78, 108.177.15.84, 34.104.35.123, 192.229.221.95, 142.250.186.106, 142.250.74.202, 142.250.181.234, 142.250.186.138, 142.250.186.170, 216.58.206.74, 142.250.185.234, 172.217.16.202, 142.250.186.74, 142.250.184.234, 172.217.16.138, 142.250.184.202, 172.217.18.10, 142.250.185.170, 142.250.186.42, 172.217.18.106, 142.250.185.195, 142.250.185.238
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, clients2.google.com, ocsp.digicert.com, accounts.google.com, edgedl.me.gvt1.com, content-autofill.googleapis.com, slscr.update.microsoft.com, update.googleapis.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Fa1QSXjTZD.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.136.232	S23UhdW5DH.exe	Get hash	malicious	LummaC, Glupteba, SmokeLoader, Socks5Systemz, Stealc	Browse	discord.com/administrator/index.php
104.26.1.5	SecuriteInfo.com.Win64.Evo-gen.6030.29502.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Generic.36879400.484.7364.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.6639.30242.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.Evo-gen.24402.15705.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.25010.24037.exe	Get hash	malicious	Unknown	Browse
	lvXRlexBnb.exe	Get hash	malicious	Unknown	Browse
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse
	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse
	Frozen_Slotted.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.DropperX-gen.8093.16745.exe	Get hash	malicious	Unknown	Browse
162.159.128.233	file.exe	Get hash	malicious	LummaC, Glupteba, PureLog Stealer, RisePro Stealer, SmokeLoader, Stealc, zgRAT	Browse	discord.com/phpMyAdmin/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
discord.gg	SecuriteInfo.com.Win64.MalwareX-gen.18133.14409.exe	Get hash	malicious	Discord Rat	Browse	162.159.130.234
	EUOgPjsBTC.exe	Get hash	malicious	Unknown	Browse	162.159.135.234
	SecuriteInfo.com.Win64.MalwareX-gen.20317.810.exe	Get hash	malicious	Unknown	Browse	162.159.134.234
	SecuriteInfo.com.Win64.Evo-gen.30154.6249.exe	Get hash	malicious	Unknown	Browse	162.159.134.234
	BX7yRz7XqF.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	162.159.135.234
	jKSjtQ8W7O.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	162.159.135.234
	U7TJ7Rq13y.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	162.159.133.234
	Sv6eQZzG0Z.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	162.159.135.234
	https://bafybeihwopeeamsw6gk3vbg3wbftvt3n2qngbzo5a4hlnpvlv4hc3vvmyy.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse	162.159.136.234
	http://bafybeid2klgyiphng6ifws5s35aor57wfi3so6koe2w4ggoacn6gqghegm.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse	162.159.135.234
keyauth.win	4aOgNkVU5z.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	xVmySfWfcW.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	dGuXzI4UlT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	vjlICWbvGT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.7613.15918.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.31663.10814.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	SecuriteInfo.com.Win64.MalwareX-gen.27133.15456.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.7443.30781.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.11163.24254.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	SecuriteInfo.com.FileRepMalware.12632.12594.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
discord.com	https://github.com/Matty77o/malware-samples-m-h/raw/refs/heads/main/TheTrueFriend.exe	Get hash	malicious	Unknown	Browse	162.159.135.232
	570ZenR882.exe	Get hash	malicious	Unknown	Browse	162.159.135.232
	570ZenR882.exe	Get hash	malicious	Unknown	Browse	162.159.137.232
	Ff0ZjqSI9Y.exe	Get hash	malicious	Unknown	Browse	162.159.137.232
	SecuriteInfo.com.Win32.MalwareX-gen.3620.22364.exe	Get hash	malicious	Unknown	Browse	162.159.137.232
	SecuriteInfo.com.Win32.MalwareX-gen.3620.22364.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	Y41oVdYohe.exe	Get hash	malicious	Unknown	Browse	162.159.135.232
	EUOgPjsBTC.exe	Get hash	malicious	Unknown	Browse	162.159.137.232
	webhook.ps1	Get hash	malicious	Unknown	Browse	162.159.137.232
	S_code_runner.ps1	Get hash	malicious	Unknown	Browse	162.159.138.232

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	4aOgNkVU5z.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	xVmySfWfcW.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	dGuXzI4UlT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	vjlICWbvGT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	BT-036016002U_RFQ 014-010-02024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3
	Orden de Compra No. 78986756565344657.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	188.114.96.3
	VM2ICvV5qQ.pdf	Get hash	malicious	Unknown	Browse	104.17.24.14
	EL-25-536_40005512_Le Cuivre_23102024.vbe	Get hash	malicious	GuLoader	Browse	104.21.70.11
CLOUDFLARENETUS	4aOgNkVU5z.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	xVmySfWfcW.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	dGuXzI4UlT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	vjlICWbvGT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	BT-036016002U_RFQ 014-010-02024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3
	Orden de Compra No. 78986756565344657.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	188.114.96.3
	VM2ICvV5qQ.pdf	Get hash	malicious	Unknown	Browse	104.17.24.14
	EL-25-536_40005512_Le Cuivre_23102024.vbe	Get hash	malicious	GuLoader	Browse	104.21.70.11
CLOUDFLARENETUS	4aOgNkVU5z.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	xVmySfWfcW.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	dGuXzI4UlT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	vjlICWbvGT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	BT-036016002U_RFQ 014-010-02024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3
	Orden de Compra No. 78986756565344657.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	188.114.96.3
	VM2ICvV5qQ.pdf	Get hash	malicious	Unknown	Browse	104.17.24.14
	EL-25-536_40005512_Le Cuivre_23102024.vbe	Get hash	malicious	GuLoader	Browse	104.21.70.11
CLOUDFLARENETUS	4aOgNkVU5z.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	xVmySfWfcW.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	dGuXzI4UlT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	vjlICWbvGT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	BT-036016002U_RFQ 014-010-02024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3
	Orden de Compra No. 78986756565344657.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	188.114.96.3
	VM2ICvV5qQ.pdf	Get hash	malicious	Unknown	Browse	104.17.24.14
	EL-25-536_40005512_Le Cuivre_23102024.vbe	Get hash	malicious	GuLoader	Browse	104.21.70.11

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	https://linkednnn.weebly.com/	Get hash	malicious	Unknown	Browse	23.206.229.209
	Douglas County Government.pdf	Get hash	malicious	Unknown	Browse	23.206.229.209
	https://email.email.pandadoc.net/c/eJxUkE9r4zwQxj-NdUuQR5ItHXQobfwG3rLQsmHbXspIGjeqE8m1FYfm0y-B7f65DcP8ht_zBOsa4XrNQvanI6XyGoPN-f7_7ilGN8iYdk8Pn-dxt_vOyNYtmMZwDpztLRpXK45GaGy9C943vK2NJgTDG-WQRQscZM1B1AJaztfS904pGYLuOTQtVZLTEeNhPWIKGLJfJyoszq9lQk_oDmTLdCJ2sPtSxrkSNxV0FXQ4jn8Qn48VdF_6FXQLVKIreaBUiTvSzgiJNQeJqLDhSoJpBAanJYFWrZO1kb6uRMdSLrGPHkvM6VqDaxuBBtpVCyBWEkW9wkbTCsko1-galQ4sT2-Y4uU39N85y5jEfDMn83C50P6beDlv2WTDe040V5K702Ggj9NhvKqziZY4_2J_iM3H6W67XV7Uop9j2dyq0D-yYr_S_TWuCk5v9M9mvl4sFtg5T8M8oqfrU_W4od1nvwdHIdy798HfDs_6ZwAAAP__1K2kLg	Get hash	malicious	Unknown	Browse	23.206.229.209
	juwXcVX5AK.exe	Get hash	malicious	Unknown	Browse	23.206.229.209
	qBtDOzhQnS.exe	Get hash	malicious	Unknown	Browse	23.206.229.209
	https://email.email.pandadoc.net/c/eJxUkMtu2zoQhp9G3NkQhxQlLbRIjo8QpKjRS5qi3QTD4TCmZYuyRNm1nr4w0PSyGwzmG3z_7xprlPWVcJHmI_fpJbjmguOnLn78cm0vTw-4fw8_dttdENzIEmoji9oYsWsAtST2VKmiVOSoJqdyVNYa9pUnKUIDOWiZA0hTgDZrUNoXnphIopaly3TORwyH9YC9Qxdp3XMSYXpJIxKjPXCTxpnFodmlNEyZusugzaDFYfiDUDxm0L7pZ9CeIVNtih33mdpIlF4hGzaGIM8ta2mV83UNlbFYlJCbQhsoM9WKPqbgA2EKsb_VACXX1jKtlM9hpQHcqiKvVsZXuvB16WTBIo6v2IflN7T_8Ly_7-p6G_bz4wbM8n1Sp6MYG7ePPU-Zzu186Pg0H4abuhj5HKZfrF4mPLvT5vndMpR0h183E0MpUvOW7q9xlXB85X820-3i3IC4xLGbBiS-Pf3v-o2eUuge_l-21bG_2vt-fvz8MwAA__9XraZ6	Get hash	malicious	Unknown	Browse	23.206.229.209
	otq9AG1EIk.exe	Get hash	malicious	Unknown	Browse	23.206.229.209
	KO8mPIAMHh.exe	Get hash	malicious	Unknown	Browse	23.206.229.209
	https://app.oneflow.com/api/agreements/8821185/assets/b81e65c04f5acdc6369b89fe6d9aba378483abd6.pdf?at=490c38a4784c740c75de3531f3291888226b3acd	Get hash	malicious	Unknown	Browse	23.206.229.209
	https://app.creatopy.com/share/d/qvnqyxdo8o7m	Get hash	malicious	Unknown	Browse	23.206.229.209
28a2c9bd18a11de089ef85a160da29e4	VM2ICvV5qQ.pdf	Get hash	malicious	Unknown	Browse	52.149.20.212 172.202.163.200 13.107.253.45 184.28.90.27
	https://email.sg.on24event.com/ls/click?upn=u001.7kf5QUY4LGF7Fzt7LGE4bbPPsSPtBC4KXSPVJqWhtiFImaGOc8X-2FzF8FDlXshHtRJ6TIRZ6EeMzJLIlgf-2Fs2kSJOxf8XTG62Elbh9rqy-2FQ2QNZGXB54Mkq5upaOHB9GHJaF-2B3b4F-2FMyEt0RGHLDpLKRhLl9mxjPD0y5Swi37OTA-3DOBST_mhsMQQwIM9hexyWqOlUPbBh1Ydv5cYoDRZfJchLEEeKy4ZjgP9CBDSdvgDFEefqBVXHw4Mv6KQHsP3gT468tApWXvWK-2FeXhqGfYYlnX46U5WmntG47XCU85W-2B7YcCKnv6RkyD-2BGsL6eKQti9UGCTMQ9mNlYRCUnfVenBdKFDHBLCSg5nmfwfVylxfV1LsL0vuEyDgr8SC57Mq-2BhfexPfdy0Rg72muov-2F70SqaHW8j0XfAmx9zQy8hYRRlnIIGbyzjoQcdYcq0btsMQpdS6jNo-2BNvozXopiqu0Jz-2B-2B25Gyoj-2FyIelIDkNiGA84aUyGyfbMNmoNmmLB38ufi9uQKhxSQ-3D-3D	Get hash	malicious	Unknown	Browse	52.149.20.212 172.202.163.200 13.107.253.45 184.28.90.27
	FedEx Shipping Document_pdf.html	Get hash	malicious	Unknown	Browse	52.149.20.212 172.202.163.200 13.107.253.45 184.28.90.27
	MV EAGLE EYE RFQ-92008882920-PDF.vbs	Get hash	malicious	Unknown	Browse	52.149.20.212 172.202.163.200 13.107.253.45 184.28.90.27
	Urgent Quotation documents One Pdf.vbs	Get hash	malicious	AgentTesla	Browse	52.149.20.212 172.202.163.200 13.107.253.45 184.28.90.27
	Circular_no_088_Annexure_pdf.html	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 172.202.163.200 13.107.253.45 184.28.90.27
	RTGS_UCB_DCCB_docx.html	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 172.202.163.200 13.107.253.45 184.28.90.27
	https://t.co/yXelyYqHRk	Get hash	malicious	Unknown	Browse	52.149.20.212 172.202.163.200 13.107.253.45 184.28.90.27
	http://jedox-couriers.com/5g/domain.php/domain..html?#infoland@hdel.co.kr	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 172.202.163.200 13.107.253.45 184.28.90.27
	https://linkednnn.weebly.com/	Get hash	malicious	Unknown	Browse	52.149.20.212 172.202.163.200 13.107.253.45 184.28.90.27
3b5074b1b5d032e5620f69f9f700ff0e	4aOgNkVU5z.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	xVmySfWfcW.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	dGuXzI4UlT.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	vjlICWbvGT.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	BT-036016002U_RFQ 014-010-02024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.1.5
	EL-25-536_40005512_Le Cuivre_23102024.vbe	Get hash	malicious	GuLoader	Browse	104.26.1.5
	OUTSTANDING PAYMENT STATUS 01199241024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.1.5
	scan_doc20241024.vbs	Get hash	malicious	Remcos	Browse	104.26.1.5
	RFQ_64182MR_PDF.R00.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.26.1.5
	FedEx Shipping Document_pdf.html	Get hash	malicious	Unknown	Browse	104.26.1.5

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 06:16:15 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9812484047869026
Encrypted:	false
SSDEEP:	48:8+dajToVmGHDidAKZdA1P4ehwiZUklqehLy+3:8r0pO0y
MD5:	C88C014A58CCBC9F79EB99C68A70E08E
SHA1:	96A5161ED012A55FA920AED65431B1311B8A23A3
SHA-256:	260B0B5A842F1E16ABC82B3D38F9E61850637CD27358420B95E921477B974BA5
SHA-512:	F6D1496D3941BF6C311773C061B53766363D79EF63424BEEB7CEC513CE3ABD8518166A49D696A4AAE97A334B1EFE45B8A6C738BF8A65240CFF3CFE0F6D8796FC
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....+..%....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.IXY.:....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY.:....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VXY.:....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VXY.:.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VXY.:...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............X......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 06:16:14 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9992636720301236
Encrypted:	false
SSDEEP:	48:80dajToVmGHDidAKZdA1+4eh/iZUkAQkqehky+2:8Z0YF9QVy
MD5:	139DE3BD23813F01F6B9F1FB70D2F4AD
SHA1:	C77F149C9C2D4DC7257F8AB8E5D4ABAD10EDF018
SHA-256:	E38D1193681DB23E1F4E60A28268A34BC7A199AF9CD86F2D011A712225FD341F
SHA-512:	F248EF265500072ACFA4268985E365A561CF5CE06430AB8A22699CEEA3BA1D0AC0861F21981C8B3D7CD556B97B6054387B9ED7EFAD1CA62F553B069C5CF723AD
Malicious:	false
Preview:	L..................F.@.. ...$+.,........%....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.IXY.:....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY.:....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VXY.:....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VXY.:.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VXY.:...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............X......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:56:51 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.006523505482383
Encrypted:	false
SSDEEP:	48:8CdajToVHDidAKZdA1404eh7sFiZUkmgqeh7s+y+BX:830nInoy
MD5:	B6A5840F36CCC0B4BD1CBF28DE27B8BB
SHA1:	157DD5E782F46342BB90B358B5519810BFB5E47B
SHA-256:	D70268D30D724696B4CE1AADFD8AC6C02D356A81D942E7F2620A5920FE6F9BDD
SHA-512:	7066C483EF0DA85FA00A26263FAE7225C020A48FC12090B68BCEEB1F95D7BFABC2A6E933A10FEDE51141AA16C6DDD8000F881D9F963C01CBA8BEA901D24CDF0C
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....<}.i.....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.IXY.:....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY.:....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VXY.:....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VXY.:.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VEW.F...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............X......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 06:16:14 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.99588048444586
Encrypted:	false
SSDEEP:	48:8vqdajToVmGHDidAKZdA1p4ehDiZUkwqehAy+R:8v/0v52y
MD5:	A9E41E1B6655C64E73C7F4D69A13DAB7
SHA1:	B28637877B4F103FDB13F8EB7AAC3AE33A657C1F
SHA-256:	1C15FC17679AE799760D2C2C42B44A2E3BB1C03C703126C8CA8BA1E46B9873E0
SHA-512:	ECDBE07CE539506FB97644B8BDF7226EE10F50C8596122460D15379862E44C3D23A4610B942DEB125A089B1012DB7FB7E10C39709D6E6552887C1067DF98D8D1
Malicious:	false
Preview:	L..................F.@.. ...$+.,....y...%....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.IXY.:....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY.:....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VXY.:....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VXY.:.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VXY.:...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............X......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 06:16:15 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9868172885405557
Encrypted:	false
SSDEEP:	48:8HdajToVmGHDidAKZdA1X4ehBiZUk1W1qehyy+C:8E0xb9Sy
MD5:	9E6C34D30B10B178A7B9758439F95940
SHA1:	04CD26EE2751A525F0ED1442B0E14F2B93539AA9
SHA-256:	E006A7EF4EB56220739F59F628C9591E47F73ED26481DDD5EEE836B2D058C992
SHA-512:	8BE9123B6AB8D1FB4055FAE07A8FD704F0E87D90E9FDE7AE8EBCB837DA8D6271DF5A819D6D0F7D91EA2A692B60A1C06D879936F631043B7982E092610F11D500
Malicious:	false
Preview:	L..................F.@.. ...$+.,........%....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.IXY.:....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY.:....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VXY.:....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VXY.:.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VXY.:...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............X......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 06:16:14 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9941101095533367
Encrypted:	false
SSDEEP:	48:8kdajToVmGHDidAKZdA1duTc4ehOuTbbiZUk5OjqehOuTboy+yT+:8p0yTcJTbxWOvTboy7T
MD5:	5AD084E28DF69AE556E37176ECF7FD10
SHA1:	C204699EDB6FB33DD0A8CD203E32FF189F00E8FC
SHA-256:	8D4F9DC178970389A6F11C516CD9A59466C0DA78DC6979E9DD58CED3D7345FDC
SHA-512:	EB81D0D5C523D7CCA8D74ACE4049C0B723F979CC5750AD6EA317B1FA894B8C2015DE8A0EB57682FED16C2226BBFDC62482D3620BD9797D337947AEA100CCC4EB
Malicious:	false
Preview:	L..................F.@.. ...$+.,....5....%....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.IXY.:....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY.:....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VXY.:....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VXY.:.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VXY.:...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............X......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	87973
Entropy (8bit):	5.125806607183933
Encrypted:	false
SSDEEP:	1536:f0kGwo/3g1MGEN6UCSQyYHhU58xxfrDX/5CF+gD58G3LpV9H5B7va:f0kGDZc
MD5:	E05640582E20F17E0F1797160B67DCD4
SHA1:	DCB27383F5836437E5433C7CCB5981E94826EE00
SHA-256:	E9DEEBCC271633C282AB3FE440CE81A196ECE4F402804FE8940030F98C563475
SHA-512:	60CDDA59E85FDED81B351614DAF3D40B30F939F7F8D9B586F516165699822E8F07F344CDD3709DCF6ADA350C725330DF26B6947322F154AB54D02C5AF3AAD71B
Malicious:	false
URL:	https://discord.com/assets/b9995525a52dc58aecf5.svg
Preview:	<svg width="1440" height="900" viewBox="0 0 1440 900" preserveAspectRatio="xMinYMin slice" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#a)"><g clip-path="url(#b)"><path d="M1440 0H0v900h1440V0Z" fill="url(#c)"/><path d="M1440 0H435.551v620.81H1440V0Z" fill="url(#d)"/><path d="M1440 341.601H484.351v558.38H1440v-558.38Z" fill="url(#e)"/><path d="M1440 0H427.5v690.995H1440V0Z" fill="url(#f)"/><path d="M787.663 810.02c330.987-141.179 530.547-416.834 445.727-615.692C1148.57-4.53 811.492-51.288 480.502 89.891 149.512 231.07-50.048 506.725 34.772 705.583c84.821 198.858 421.901 245.616 752.891 104.437Z" fill="url(#g)"/><path d="M1024.18 825.565c290.6-123.952 456.96-386.723 371.57-586.916-85.39-200.193-390.19-261.999-680.792-138.047-290.602 123.952-456.959 386.724-371.569 586.917 85.389 200.193 390.19 261.998 680.791 138.046Z" fill="url(#h)"/><path d="M673.907 771.815c264.238-112.707 429.363-319.136 368.823-461.073-60.538-141.936-323.823-165.631-588.061-52.924C190.431 370.5

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3146
Entropy (8bit):	4.484082045212369
Encrypted:	false
SSDEEP:	48:C4LO/K7oWBkomgBkRzd0kJBJkI8JkINGD/dYk2kahkzd/FnLgkpmZ5ZOE83VCn:RO/IS53JBJbKbN4WQbMRZmEAI
MD5:	81084FF5A27B6E6FF487E479C37D1660
SHA1:	81A274F69A1358F85715A0FEA227730D795CB353
SHA-256:	075DE1D6EA4FB470197A88BA371F60F70B819B250CB5AF8BD6A4794B1A9CA4A1
SHA-512:	CCCD00A5C013B130BE0A8466F903F7EEE9306518DFAA8758849027EBC1829EA2A6B7516E4D2070B110A12EC7EB559E3B75D256AD1B07BE3FD8595C0E430DC0D5
Malicious:	false
URL:	https://discord.com/assets/ba88bbd1342d3f000e33.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 90 59.19">. <defs>. <style>. .cls-1{fill:#6a94ff}.cls-2{fill:#a9c7ff}.cls-3{fill:#202225}. </style>. </defs>. <g id=".._2" data-name=".. 2">. <g id="Layer_1" data-name="Layer 1">. <path class="cls-1" d="M89.59 19.89 84.93 8.38a5.51 5.51 0 0 0-7.19-3l-5.67 2.25A12.42 12.42 0 0 0 56 .91L45.48 5.16c-1.84 4.11-5.48 9.72-11.59 9.52a8.55 8.55 0 0 1-5.51-2.13c-.12-.11-.24-.22-.34-.33l-12.66 5.13a12.42 12.42 0 0 0-6.9 16l-5 2A5.52 5.52 0 0 0 .4 42.61l4.67 11.51a5.51 5.51 0 0 0 7.18 3l5.64-2.28A12.43 12.43 0 0 0 32 58.28l40.54-16.44a12.43 12.43 0 0 0 7.73-12.22l6.28-2.54a5.52 5.52 0 0 0 3.04-7.19ZM11.65 52.94a2.76 2.76 0 0 1-3.59-1.52l-3.63-9A2.76 2.76 0 0 1 6 38.87l4-1.65 5.69 14.07ZM22.33 39.6a3.72 3.72 0 1 1 2.06-4.85 3.71 3.71 0 0 1-2.06 4.85Zm33.36-1.55-11.77 4.77A10.61 10.61 0 0 1 30.11 37l-3.33-8.23A4 4 0 0 1 29 23.56l23.31-9.44a4 4 0 0 1 5.18 2.19l3.63 9a9.8 9.8 0 0 1-5.43 12.74ZM67.49 21a3.73 3.73 0 1 1

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2058
Entropy (8bit):	4.614306214221163
Encrypted:	false
SSDEEP:	48:CVHe7HtOty0VulV1/8CXP0Cjek7aj4clug9ai:iANEyxx8UPTXaj4cogIi
MD5:	E1349377226366F95F85AB9EAC4586D3
SHA1:	9A3A00B6E6AB0A240363F4E4DB2F5288227FF76B
SHA-256:	2CA673A9914A35A230469A8A0FD6B4DB293B236DEA391633B53339AFE577A92E
SHA-512:	7C16967D1960CDE4914F71B6FE347A7764AAED42366A87920597D225F3874B5B34A00C5089564BEBF0A919C419049DB99B27128CC81BC28A1492460FD199F9E7
Malicious:	false
URL:	https://discord.com/assets/a5ec2b74d0cc337d4481.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 45 45" xml:space="preserve">. <defs>. <clipPath id="a" clipPathUnits="userSpaceOnUse">. <path d="M0 36h36V0H0v36Z"/>. </clipPath>. <mask id="b">. <g>. <rect x="0" y="0" width="100" height="100" fill="white" />. <path d="M11.708 29.849a1.296 1.296 0 1 0-2.591-.001 1.296 1.296 0 0 0 2.591 0" fill="black"/>. </g>. </mask>. </defs>. <g>. <g>. <g clip-path="url(#a)" transform="matrix(1.25 0 0 -1.25 0 45)" mask="url(#b)">. <g>. <path d="M12.75 18.25c1.226-2.195 1.855 1.361 9.313 2.625 7.457 1.264 13.728-4.454 13.859-5.413C36.053 14.504 31.474 6 26.459 6h-15.71C6.607 6 3.727 13.224 6.75 17.438c0 0 4.5 3.5 6 .812" fill="white"/>. </g>. <g>. <path d="M13.008 17.864C8.02 10.927 6.968 6 10.75 6c-4.142 0-6.577 6.187-4.468 11.031.463 1.064 1.758 2.492 1.758 2.492l4.18.008c.162-.32.598-1.366.79-1.667" fill="white"/>. </g>. <g>. <path d

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13325)
Category:	dropped
Size (bytes):	13374
Entropy (8bit):	5.33229367944175
Encrypted:	false
SSDEEP:	192:c9jPMDYeG0dPbPDjzw4WDhiElYrskCLdHWQBC7dr1m+8LBpDtOnyUotvLfQE2u:c9jPMRLjZ0usbxwdr1QBpDtOy3JT
MD5:	D0C788B157FF96A2DD902C97BFC889F6
SHA1:	6CDE0BD611B34B15CA15437CA5AC4F77DE01ADA8
SHA-256:	05A00FBAFFC4A7254C9B631FF0E81BE546DC275BE1D6F992C36849222D0B73F7
SHA-512:	170615E3DE829D517662BE32C762B76B013163FA040C2EEDF89C865A9CEE1CEEDA7EE305BE27CD3A724832571A94B5A26FB3BB9D9A1D1C5386081F206A1E1436
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["78187"],{526988:function(t,n,r){var e=r(354848),o=r(938507),i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not a function")}},24033:function(t,n,r){var e=r(622281),o=String,i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not an object")}},953326:function(t,n,r){var e=r(299623),o=r(980855),i=r(49693),u=function(t){return function(n,r,u){var c,f=e(n),a=i(f),s=o(u,a);if(t&&r!=r){for(;a>s;)if((c=f[s++])!=c)return!0}else for(;a>s;s++)if((t\|\|s in f)&&f[s]===r)return t\|\|s\|\|0;return!t&&-1}};t.exports={includes:u(!0),indexOf:u(!1)}},332916:function(t,n,r){var e=r(581031),o=e({}.toString),i=e("".slice);t.exports=function(t){return i(o(t),8,-1)}},381740:function(t,n,r){var e=r(740362),o=r(666061),i=r(347722),u=r(97131);t.exports=function(t,n,r){for(var c=o(n),f=u.f,a=i.f,s=0;s<c.length;s++){var p=c[s];!e(t,p)&&!(r&&e(r,p))&&f(t,p,a(n,p))}}},251069:function(t,n,r){var e=r

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 64x64, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	1066
Entropy (8bit):	7.8048030316845365
Encrypted:	false
SSDEEP:	24:w0Hm4yTnGeVfIFHU9HFbYMdL36oSMkKwzSwgvyQfpbfzu:w0Hm4AxWFHYeMZ36oSMS2wgpnu
MD5:	BD7895F71FAD6D9263981408ECCB3EF2
SHA1:	0DECC92425C58B121B6117B90EBFC89DE7397B8C
SHA-256:	927248AC3A7C831DC3DB7E45CEA4A7112F5BA02309227DDE46454F07CF773DB8
SHA-512:	CE7EBDA208426FBFC7E1A3F00ADD50A3944543385D6D2F0F29C1ABFB1653A1C8539D32C8C41FCA0BA6D71F9C65E09D21C6ADE661CD3719D5E7FF4A372FF0A32F
Malicious:	false
URL:	https://cdn.discordapp.com/icons/1230227842877620359/a_75aa56a5faded73ac41ce0fac1e7d74c.webp?size=64
Preview:	RIFF"...WEBPVP8 .........@.@.>m..F$"..0......l....z..0?K.w....y.s..............S.?......h.....2>......j..{+....`...D. .........&...!..5w.8.S..VH.:b...-l..A_.......NVl0e..t..Q4hl..tCv...cB.&H......0`.>.]..(.n<6L]u.....M...%WN...>.......".../a .7FT.X..-.:....?.6Z[oO=^.==.).............y...Cn.}..0.fh.3.a....=k....O.^J4'..W."W....'...0.3.~.H..=....CT..W.kTVm.1.D.Rx6@.J..<.]~{4..h....u.42P........6vk.S...eF..fL..!..t0zO..h..Z....B....t.e..w:.......)...._.`E..-r..'"O.D..N.e.u..vp@...dd.............H.$.C.........c...ay.....I,c.2i..a.s.H...&..<:.3..!../..............?...rb"..9..r.q..g.{..E.A.].Rk.y..p[%..m.E]._m.........\....."<S.?......^........qU...L......4LE.q...?......E.n.p%5.54...f....5...g]...'...O....S.>+..DM4o.=.=.....[..5b..9...?y..cF.b...1..+.y...o.}.......>T=..........I....uc........^.....yT0...=#..i{....i..M1;...i.....g...3...g.~.].;.....0.Na......0.F....G.....&.[.+..>\|...9=..P......I.A.R.bT....8...C^q.N.....e;[..bm.{}.[P.y...

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	24565
Entropy (8bit):	6.000976601202208
Encrypted:	false
SSDEEP:	384:xakxHbO0x9ipfSEuH44B445H44Q544Aq44Q4P44ZF944Q4Q4424Qb444nxWl444p:xZxH5ripqEuH44B445H44Q544Aq44Q4+
MD5:	EC2C34CADD4B5F4594415127380A85E6
SHA1:	E7E129270DA0153510EF04A148D08702B980B679
SHA-256:	128E20B3B15C65DD470CB9D0DC8FE10E2FF9F72FAC99EE621B01A391EF6B81C7
SHA-512:	C1997779FF5D0F74A7FBB359606DAB83439C143FBDB52025495BDC3A7CB87188085EAF12CC434CBF63B3F8DA5417C8A03F2E64F751C0A63508E4412EA4E7425C
Malicious:	false
Preview:	............ .h...F... .... .........00.... ..%..V......... ..$...:..(....... ..... ..........................................dX2.dX..dW..dW..dX..dX..dX..dX2.........................dW..dW..dX..eX..eX..eX..eX..eX..eX..dW..dW..dW..............dW..dX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eW..........dW..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eW......dX2.dW..eX..eX..\|q......eX..eX..eX..eX......\|q..eX..eX..eX..eX2.dW..eX..eX..........................................eX..eX..eW..dW..eX..eX..........................................eX..eX..dW..dW..eX..eX..............eX..........eX..............eX..eX..dW..dW..eX..eX..........................................eX..eX..dW..dW..eX..eX..~s..................................~s..eX..eX..dW..dW..eX..eX..eX..................................eX..eX..eX..dW..dX2.eX..eX..eX..h[..........{p..{p..........h[..eX..eX..dW..eW2.....dX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eW..........eX..dX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eW..e

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21762)
Category:	dropped
Size (bytes):	21811
Entropy (8bit):	5.462655463719556
Encrypted:	false
SSDEEP:	384:f1bjtqrVapZjquHCWnJcJhcby8XziQBy6HUKVMov5hHKs80K:JjtOVaJDnJcPc+EWQ8EM65RR8l
MD5:	0FBB77D1B69F18DF0FDCF836DE1C4106
SHA1:	E8CE4037B97732809F1E1BF24992959C678F2118
SHA-256:	279E49A00A41A18545CF319B5A8B571FD48CFCC4B78A361BBE75A33CE7A4F71A
SHA-512:	F73E3B25561D0D3307C7DD9D505F84101897CFA70737D757AED8D95BDC6A2CE116FD114674DD0BBE666AABE2176B0EEF150A5D4EE2C7C3CCE815A5CA73215D03
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["71984"],{772425:function(t,r,n){var e=n(933676),o=n(938507),i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not a constructor")}},603528:function(t,r,n){var e=n(838957),o=TypeError;t.exports=function(t,r){if(e(r,t))return t;throw o("Incorrect invocation")}},212036:function(t){t.exports="undefined"!=typeof ArrayBuffer&&"undefined"!=typeof DataView},192291:function(t,r,n){var e,o,i,u=n(212036),f=n(325008),a=n(161581),c=n(354848),s=n(622281),y=n(740362),p=n(974971),h=n(938507),v=n(251069),d=n(859209),g=n(4340),l=n(838957),A=n(144748),w=n(276321),x=n(641236),b=n(457507),T=n(644659),E=T.enforce,I=T.get,R=a.Int8Array,m=R&&R.prototype,O=a.Uint8ClampedArray,M=O&&O.prototype,F=R&&A(R),U=m&&A(m),_=Object.prototype,L=a.TypeError,B=x("toStringTag"),C=b("TYPED_ARRAY_TAG"),S="TypedArrayConstructor",P=u&&!!w&&"Opera"!==p(a.opera),V=!1,N={Int8Array:1,Uint8Array:1,Uint8ClampedArray:1,Int16Array:2,U

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (12394)
Category:	downloaded
Size (bytes):	12443
Entropy (8bit):	5.622820681358379
Encrypted:	false
SSDEEP:	192:KO87cE+wCFgcmzFFLiMx+vomnNST2kYLAZVeOhRido3ARvVppn8pZl:KO6cE+wCFgFLGvomNSBYL1eROY
MD5:	1FB8462302F6FBB9323F187505F5393F
SHA1:	B1FE31671174AA0BC7DFBFCC942AEFBFCBDB55BA
SHA-256:	CBFC3F32A1493FB38FD92BE4BC61035CB4948B6CF91AE5CC0038006AC753EA98
SHA-512:	22B96DA64E536EE01CDC30946AF83FCA8BF939A41443C8E9F7E7D296388FC94E3BED12E1FCE20B7E5E31E7611B1DC4CE235DBD1B3B61CC4A6F77350749C86BFF
Malicious:	false
URL:	https://discord.com/assets/a14c32460cf87caa605c.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["95393"],{392459:function(e){e.exports="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 66 38' width='66' height='38'%3E%3Crect x='0' y='0' width='66' height='38' style='fill: rgb(0, 0, 0); stroke: rgb(0, 0, 0);'%3E%3C/rect%3E%3C/svg%3E"},850259:function(e){e.exports="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='6.122 5.864 259 50' width='259' height='50'%3E%3Cpath fill='%23000000' fill-rule='evenodd' d='M 68.122 11.864 L 192.122 11.864 C 193.779 11.864 195.122 13.207 195.122 14.864 L 195.122 28.864 C 195.122 30.521 193.779 31.864 192.122 31.864 L 68.122 31.864 C 66.465 31.864 65.122 30.521 65.122 28.864 L 65.122 14.864 C 65.122 13.207 66.465 11.864 68.122 11.864 Z M 68.122 35.864 L 262.122 35.864 C 263.779 35.864 265.122 37.207 265.122 38.864 L 265.122 48.864 C 265.122 50.521 263.779 51.864 262.122 51.864 L 68.122 51.864 C 66.465 51.864 65.122 50.521 6

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	168789
Entropy (8bit):	5.612789333447181
Encrypted:	false
SSDEEP:	1536:lvVvKVPI1oqgO/usjA1vkY0JCxf7UG/9rHUQNbsbkb5a05VGOEc2+hzuy6fvxO7a:uVPIgPvEc7N/9rNhbYy6w7XvXcZ
MD5:	3B74671903D935A08DC04ACEF440C188
SHA1:	7B2C8D8AE72E5E2DA1BA4440722810565E11084C
SHA-256:	4AC4D0F31456B9D1741A52E5C54089952219E0C2287D83B81F12C94468DB3B03
SHA-512:	7F465558B1D640EEC9639921A70C0C0A9AE8BD7F95D0EE098B0553A7B84C5B983A9140FA48C45453FD8E39FAB7188000A2A0628300C4CEF9FE3F2742C20F1C62
Malicious:	false
URL:	https://discord.com/assets/bd0ab83c61025d7c7000.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["41315"],{863942:function(e,t,n){var s=n(22092);(0,n(192291).exportTypedArrayStaticMethod)("from",n(12367),s)},70519:function(e){e.exports="/assets/76a4af59aa173c519461.svg"},806848:function(e){e.exports="/assets/6183fdc13d8046fd5bda.svg"},512266:function(e){e.exports="/assets/a2d51a24d014f52f83a6.png"},105020:function(e){e.exports="/assets/89ea0e62d0f8ffa67a17.svg"},211095:function(e){e.exports="/assets/86755fd1deda5cb45518.svg"},640356:function(e){e.exports="/assets/3880dc73d6be9d91ef36.svg"},515695:function(e){e.exports="/assets/450a761db3bfe89ca9b9.png"},892235:function(e){e.exports="/assets/48f03d965f1e82275006.svg"},375673:function(e){e.exports="/assets/3cf7f333e815240d3294.svg"},73962:function(e){e.exports="/assets/ed7318a94c14ce41d11d.svg"},689411:function(e){e.exports="/assets/831c999494cb5e095eae.svg"},2984:function(e){e.exports="/assets/0e5029fd9cd4812b6712.svg"},575703:function(e){e.exports=

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20669)
Category:	dropped
Size (bytes):	20718
Entropy (8bit):	5.5874718820742
Encrypted:	false
SSDEEP:	384:C4bQLjJHzjDcPDvYcJG9SAcksEi4aim6pvnVETji:DbQtjorYqG9e426PEa
MD5:	A2754ACCDA171158F8F581AD49DFBB9C
SHA1:	F619D690525B7ECA8BF70B9C24CBC58A3E092F1F
SHA-256:	606458816E822D1D0904C62D1E90C1595419CD92377055C63812BA63E00C3CDB
SHA-512:	F752422F8DE3B430832E43758F4C117D0D1FFB863CEDB95AA354635CC82DCC73F1371DA51626FFD76345D600970338DA4A2CD8F10739445C0123D990BD732CD5
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["25788"],{533307:function(e,t,n){let i;var s=n(544891),r=n(570140),l=n(728345),o=n(812206),a=n(625128),d=n(335131),u=n(669079),c=n(981631),_=n(474936);async function E(e){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1],n=arguments.length>2&&void 0!==arguments[2]&&arguments[2];r.Z.dispatch({type:"GIFT_CODE_RESOLVE",code:e});try{let i=await (0,u.bT)(e,t,n);if(null!=i.application_id&&i.application_id!==_.CL){let e=o.Z.getApplication(i.application_id);if(null==e)try{await l.ZP.fetchApplication(i.application_id)}catch(e){}}if(i.application_id===c.XAJ)try{await (0,d.jr)(i.sku_id)}catch(e){}return r.Z.dispatch({type:"GIFT_CODE_RESOLVE_SUCCESS",giftCode:i}),{giftCode:i}}catch(t){throw r.Z.dispatch({type:"GIFT_CODE_RESOLVE_FAILURE",code:e,error:t}),t}}i=n(775644).Z,t.Z={resolveGiftCode:E,async fetchUserGiftCodesForSKU(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:null;r.Z.dispatch

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	137
Entropy (8bit):	4.7861988241054
Encrypted:	false
SSDEEP:	3:t6WH7W+IjSKcvUVYEo0LvDmJS4RKb5KVErcHNDPqdcJqGrqL0:t6AbzUOC3mc4slmNDiiAe
MD5:	7D883BA72B5DBC0229F5D1980205EE34
SHA1:	678BDA23DF97E8B9C3B15E71C41E7B215D043F22
SHA-256:	53A0F1F10860A6E4CF9BD3B4949C5DDE68888DBC96BA0DA1020C5958EFC214A5
SHA-512:	E040F62517C951A0AB2ABC5038F22456E5862166E2A2346345464B9C4B63271CFBD1220BB14D2C39D7FACFD008848ACE682420F1EFE9F4F29265D7177A3C7E16
Malicious:	false
Preview:	<svg fill="none" height="12" viewBox="0 0 12 12" width="12" xmlns="http://www.w3.org/2000/svg"><path d="m5 2h2v8h-2z" fill="#fff"/></svg>

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2701)
Category:	dropped
Size (bytes):	2750
Entropy (8bit):	5.460366645013334
Encrypted:	false
SSDEEP:	48:F0fzk02vWrc1AKTMSTEcr9rTOLBsmPBo/6XgpdgwrIsi5dEk+MQwq2kWkGRv6hvr:ek02hfMXcKs+lXyisi5CkiPrWk+Ch/Ew
MD5:	390A7AB1F964AA8CB1B87DD13732C3BC
SHA1:	CEA52AC6FA0CDF49A18D51C8CD8A5C4FB52DEAC9
SHA-256:	BEDD382930BA4E10DFA902BF833195911F82E754223441446E9D7CC45B01110F
SHA-512:	4B799488E35C5B933E9B1BA6AB335E2EAD6D625D3DC1FEC19DD80F48B9B7996171BEC24513095F3F1BAA9C8B7675FA4E527B763AEED26B69273BF2DCED014D3F
Malicious:	false
Preview:	(()=>{"use strict";var t={137920:function(t,r,n){var e,i;n.d(r,{J:function(){return u},z:function(){return e}}),(i=e\|\|(e={}))[i.NONE=0]="NONE",i[i.SOCIAL=1]="SOCIAL",i[i.CASUAL=2]="CASUAL",i[i.COMPETITIVE=3]="COMPETITIVE",i[i.CREATIVE=4]="CREATIVE",i[i.VERY_HARDCORE=5]="VERY_HARDCORE";let u={0:"NONE",4:"NONE",1:"CASUAL",2:"CASUAL",3:"COMPETITIVE",5:"COMPETITIVE"}},945124:function(t,r,n){n.d(r,{y:function(){return i}});var e=n(137920);function i(t,r){let n=0;return null!=r.games&&(n+=2r.games.filter(r=>t.games.includes(r)).length),null!=r.playstyle&&(r.playstyle===t.playstyle?n+=2:e.J[t.playstyle]===e.J[r.playstyle]&&(n+=1)),null!=r.traits&&(n+=2Array.from(r.traits).filter(r=>t.traits.includes(r)).length),n}},866762:function(t,r,n){n(312677);var e=n(945124);self.addEventListener("message",t=>{var r,n;let{data:{unsortedClans:i,id:u,criteria:o}}=t;let a=(r=i,n=o,r.map(t=>({...t,affinity:(0,e.y)(t,n)})).sort((t,r)=>{var i,u;let o=null!==(i=r.affinity)&&void 0!==i?i:(0,e.y)(r,n);return o-

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	113
Entropy (8bit):	4.460750616283363
Encrypted:	false
SSDEEP:	3:YGKjl8jwDEYRrajpHV+wJ6ARORzACDEYkayjY6v:YGKjDRrajpHV9LorMcE
MD5:	30B15D37E2F2C6C09F35BCC56B64571A
SHA1:	A5566ADA13410C39A4059BEC0FF59D51316D89CD
SHA-256:	BE58D93E5BC2C48B3FB9C87BD7140109630195E84CCE67701FCCABCF5256BFE0
SHA-512:	EE8E8192B3120D7A2FC9DCE3585D87FAAF689B2E03046C8B7F533FE3CBA408BF0E8614CA2AACD6ED21A206B4B461ECA507D5B38D01839CA9AC5B93971D1F7B10
Malicious:	false
URL:	https://discord.com/api/v9/auth/location-metadata
Preview:	{"consent_required":false,"country_code":"US","promotional_email_opt_in":{"required":false,"pre_checked":false}}.

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	1108
Entropy (8bit):	5.359578028959659
Encrypted:	false
SSDEEP:	24:Y74WU4bejvfkjyDEfXgAh/4ACjsY384W9iiex4grjh:Y741gerKyDEfbftY384Swx4UN
MD5:	E2CD13D6C4B1EF7E464FD22FBC18BA56
SHA1:	478AC70BFFF328092BC4A88898AD5ECB7232AB23
SHA-256:	B48B77DEC8C7D5A0953A7F8F06E363884387239A5A3BF9B9BD63945B68FE3A2B
SHA-512:	53F927063C760D199A8A11733AF3CB821C53BEF30EFAF4D113970CDE2AA6791E1FBED06EB947A707CC4316CAFA799CAE1B88A00280C05C6AE89BBF48C3B84A4C
Malicious:	false
URL:	https://discord.com/api/v9/invites/privatecommunity?with_counts=true&with_expiration=true
Preview:	{"type":0,"code":"privatecommunity","expires_at":null,"guild":{"id":"1230227842877620359","name":"\ud835\udc0f\ud835\udc11\ud835\udc08\ud835\udc15\ud835\udc00\ud835\udc13\ud835\udc04 \ud835\udc12\ud835\udc13\ud835\udc0e\ud835\udc11\ud835\udc04 \ud83d\udd10","splash":"04b58b5d8c863962ccdac305e5ee1269","banner":"0ada4913f44d405e7a85ad7d492c34fd","description":null,"icon":"a_75aa56a5faded73ac41ce0fac1e7d74c","features":["BANNER","PRIVATE_THREADS","ROLE_ICONS","THREE_DAY_THREAD_ARCHIVE","MEMBER_PROFILES","ENABLED_MODERATION_EXPERIENCE_FOR_NON_COMMUNITY","ANIMATED_BANNER","SOUNDBOARD","COMMUNITY","ANIMATED_ICON","NEWS","INVITE_SPLASH","VANITY_URL","SEVEN_DAY_THREAD_ARCHIVE"],"verification_level":4,"vanity_url_code":"privatecommunity","nsfw_level":0,"nsfw":false,"premium_subscription_count":56},"guild_id":"1230227842877620359","channel":{"id":"1230229306408697856","type":0,"name":"\ud83c\udf10\u30fb\ud835\udc12\ud835\udc08\ud835\udc13\ud835\udc04-\ud835\udc0f\ud835\udc11\ud835\udc08\ud835\ud

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 39424, version 2.66
Category:	downloaded
Size (bytes):	39424
Entropy (8bit):	7.995696618521677
Encrypted:	true
SSDEEP:	768:RtWd6RsrMjeX+oUMPzo4niAVyynUFTyEatQHzV2h2TzpLJD5JoswdZB:/y6RsbDRzookyncNMQHzAALRovL
MD5:	7F63813838E283AEA62F1A68EF1732C2
SHA1:	C855806CB7C3CC1D29546E3E6446732197E25E93
SHA-256:	440AD8B1449985479BC37265E9912BBF2BF56FE9FFD14709358A8E9C2D5F8E5B
SHA-512:	AAEA9683EB6C4A24107FC0576EB68E9002ADB0C58D3B2C88B3F78D833EB24CECDD9FF5C20DABE7438506A44913870A1254416E2C86EC9ACBBCC545BF40EA6D48
Malicious:	false
URL:	https://discord.com/assets/ecff74bf4394e6e58dd1.woff2
Preview:	wOF2..............\|`.......B..........................Z.. .`..P..B..W.....,..U.6.$..`..r.. ..n..F..5[.V...n.<..j.......n....G...T...asj...nV..W........L6.0...U+.....5.M3gx..j.Ic.&..- ...<"....r..N(B..0..2`..(TI0\|.N..n`..W..b....\|.gX....={...S\..C...J...._.RY..dR...\.>.Z...yG.F.9.i...vn..!F.U....1.-u.....Z.S...k....0\|..2.$D..<L..E.....H.p.....]..Lu.......t.2..Mq.B.+..r}.....&XBU/...T."..?U'T.2....\|J]...!....C2e.\I..PQ-+s.....5..G.?b.,`. )....s..A........)..z.".U.=....".M..m...c...HQs..Q...]..bE...8..d8.C233..p..l.&"C../%2R......s.$..@....1....J]U.....w..G0.....l..X......L.......z...)rD../...r.LC.T.$A. .. A.Y!.6...It....jG.t..w./...y.X..;......~_..[...^9'.B...#..Ol.....f....F.b....g?...x.-.....i.-Kx...U.k.JG..6.q:..1.a....?....f......m.....K3...4=UK....t...o..s.Dm.9.n./.._K..JSM...T...3.H........6"3...w..>.Kb.g..............F@..E.R.+%<G..U.\|6.....(S..MRt...zy.O..#P..........X.t.uj...s....#z..F...X..U.5.cT).Q...Y....pa.z.

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 187596, version 2.459
Category:	downloaded
Size (bytes):	187596
Entropy (8bit):	7.998767209907151
Encrypted:	true
SSDEEP:	3072:K0d28YLkf9Vu/DwPCe7XSk5tMaLtI70HVGkQdd7gOnhXfCdFJYC7Ofrgm6ME+y8L:vw8YLkf9Vu/DoXHtMaJI84kQn7gOd6d+
MD5:	E55012627A8F6E7203B72A8DE730C483
SHA1:	4C43B88403EC9C3053D74B4C502BCAF99F594C57
SHA-256:	8390503760C8F26556001A28E7D95E4A237A4780E7CEEEBF0853CE252FDE4BA8
SHA-512:	05BFB6311B7F78F8F85E43F3C9C87447138237B8897C68EFFA4C877509296F0A7252070F8BBA79C6561FF91C6759058F0DA5A10C1DB19C1FF0443FEE49BF62A5
Malicious:	false
URL:	https://discord.com/assets/914a97ac83e173c66dd7.woff2
Preview:	wOF2...............P...j..................................v.`..:..... ....6.$...@...D.. ......\..[.H........{....5....q..eH...Z...x.v..%U....6.~..9 ..Z..v6.(.L.....g.=l..d.....q4....................y..^~...i...LA.j...y "..@p.9.A...(.O,....B.X%O.J.....O.h.`.A..3.-.6.....I......30.Fs.....N.%h..~.8.7...(...Pkq.{...+..$..\k?^@.z>...3.....>r..W....3.nk..Oz.g.F!.v...!...m..".). .u`........._EU....d!...]#.`..}..KsP.]=.k..).N...DE....#Ae......h'..9.V.....N.6.....w....zA%A.. G.G.J1.@..{ym.....Cx......D+UE...:..x.\|r\|fG..0iX..31O/..\..\|...b-.&yIq..].".6].N..!u...5..hG.k..x.Z..Mr.6@2).t..v......T....2<XA.m.c..-....P.g;...H.p....v..0..:.nR.u.~........!..c..-!4..S.J1p....D...z..%......_..,.2..h....W..{..'A..(....9.<...z!B.&.B2....}.(.!$.{./.....K.v7...#..#~.u...b;....2.}0dV.$.y.?.=.....T%`..+........h.Gi\.S.2..G.Y.fp..h..`.9.I..D..G_.OU.<r.<.0.A}..J.2....i..b..4.....Z;..V:+....;......S!..............1..T....0.^bE..Z\|N}..<.....Y..O..>+.ss.y .......~....t...9$.m

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9310)
Category:	downloaded
Size (bytes):	9359
Entropy (8bit):	5.630050363226493
Encrypted:	false
SSDEEP:	192:fcLtSa9QY4Cg9OcfTp1tOxyoZA0ab0KPqO2Lk2mMATw2DxnE7LoT:6WCQdfTLteyoZA0ab0KPqO2Lp+w2DxEo
MD5:	52287A03A33104E4E3508B67501DB130
SHA1:	B131FDFAA0259B1226B6EDF3BF5820C60A25FCAB
SHA-256:	A690D620CF44F9CAEF92F4943B977D45EF082F2280D16B7D6EE3B76157812310
SHA-512:	F4C83E10C7FB93CAA7F0B183D49DEFC53D21B8CC7CABAAD79ED36974F53DF01F87D45CF3452F7F3C2BF86168D3DC488296C6EA57279B4A2CDC083A2747AD97BE
Malicious:	false
URL:	https://discord.com/assets/af6b8f380faee0e9f47d.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["4775"],{292824:function(t){t.exports="/assets/00fe8a6557e204eb9503.svg"},231239:function(t,e,n){var r=n(990547),i=n(283693),l=n(570140),u=n(573261),o=n(981631);e.Z={signup:(t,e)=>u.Z.post({url:o.ANM.HUB_WAITLIST_SIGNUP,body:{email:t,school:e},trackedActionData:{event:r.NetworkActionNames.HUB_WAITLIST_SIGNUP,properties:t=>{var e;let n=!1,r=null==t?void 0:null===(e=t.body)\|\|void 0===e?void 0:e.email_domain;return null!=r&&(n=-1!==r.split(".").indexOf("edu")),(0,i.iG)({is_edu_email:n})}}}),sendVerificationEmail:async(t,e,n)=>(await u.Z.post({url:o.ANM.HUB_EMAIL_VERIFY_SEND,body:{email:t,guild_id:n,allow_multiple_guilds:e,use_verification_code:!0},trackedActionData:{event:r.NetworkActionNames.HUB_EMAIL_VERIFY_SEND,properties:t=>{var e;let n=null==t?void 0:null===(e=t.body)\|\|void 0===e?void 0:e.has_matching_guild;return(0,i.iG)({has_matching_guild:n})}}})).body,async verify(t){if(null!=t)try{var e;let n=awa

Chrome Cache Entry: 150

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	109613
Entropy (8bit):	5.4029332021931715
Encrypted:	false
SSDEEP:	1536:fCBKa1oPP8sGolumyOSsN5VYpLUBDL2QPidmHTRWisxpLAkF+d10J:qB9C81a5YpL5kl9sxpTa10J
MD5:	80F500D4D0495E5C74E9B92CBC26F088
SHA1:	A2C3F68D87AD8F793935FA7B8D05A0A2D635C4E0
SHA-256:	407002AD3FD8CF26EF02A802DD0D4DB7BFF395D8C22F5F8580CA6CE65A797238
SHA-512:	500C40BF257E7F4098B3B64CEDD49D8612FAF8B254CF496019C5B579C784A416F466C6BAC174B5317A663071E736C2DF82D22E6A7F88AF664BC421A974ABDF59
Malicious:	false
URL:	https://discord.com/assets/55ad931ed92a15c15709.js
Preview:	(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["63288"],{473452:function(e,t){"use strict";t.Z=function(e){for(var t,n=e.length,o=n^n,r=0;n>=4;)t=(65535&(t=255&e.charCodeAt(r)\|(255&e.charCodeAt(++r))<<8\|(255&e.charCodeAt(++r))<<16\|(255&e.charCodeAt(++r))<<24))1540483477+(((t>>>16)1540483477&65535)<<16),t^=t>>>24,o=(65535&o)1540483477+(((o>>>16)1540483477&65535)<<16)^(t=(65535&t)1540483477+(((t>>>16)1540483477&65535)<<16)),n-=4,++r;switch(n){case 3:o^=(255&e.charCodeAt(r+2))<<16;case 2:o^=(255&e.charCodeAt(r+1))<<8;case 1:o^=255&e.charCodeAt(r),o=(65535&o)1540483477+(((o>>>16)1540483477&65535)<<16)}return o^=o>>>13,o=(65535&o)1540483477+(((o>>>16)1540483477&65535)<<16),((o^=o>>>15)>>>0).toString(36)}},230371:function(e,t){"use strict";t.Z=function(e){var t={};return function(n){return void 0===t[n]&&(t[n]=e(n)),t[n]}}},184826:function(e,t){"use strict";t.Z=function(e){function t(e,t,o){var r=t.trim().split(h);t=r;var i=r.length,a=e.length;switch(a){case

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 960x540, components 3
Category:	downloaded
Size (bytes):	33094
Entropy (8bit):	7.662961138741444
Encrypted:	false
SSDEEP:	384:lgO9OMfES6EqMU9mmYJIbvXWQGA7DC5QC1QP9HfPt6r5esdEiExCbli1zqlYlBaJ:lJU5zGQswlE1TEx8kzqloBYA8R
MD5:	7E3C950F6514CEAEC263944BB6149A6B
SHA1:	D60A06B2724156F2C808648E8B5D8D543D93B084
SHA-256:	2CFA6F333D5A195FDFC244B2F3FBEDBAC858071EEC196BCA300808BAC20BF273
SHA-512:	AF8A05BDB2900D7D06D782309340941C4A0C6623F60F672AD4342A474F17CC76A987584D7EEB8D64D8960D6126A7A9FDB3E847D70DE8BD06C6BBAC24F6851D77
Malicious:	false
URL:	https://cdn.discordapp.com/splashes/1230227842877620359/04b58b5d8c863962ccdac305e5ee1269.jpg?size=1280
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..Z(...(...E...ZE....Z(...(...O.?AKI.G.(.h...(...).U..........(...(..o.~....O...(...(...(..^....^......(...(...#.....~....(...(...._.-!.ZZ.(...(...F...KH.t.)h...(...(..^....^......(...(...#.....~....(...(...._.-!.Z.Z(...(...F...KH.t.(.h...(...(...E...ZE...Z.(...(...O.?AKI.G.)h...(...(..U..........(...(..o.~....O...(...(...E...ZE....Z(...(...O.?AKI.G.(.h...(...).U.........

Chrome Cache Entry: 152

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (12394)
Category:	dropped
Size (bytes):	12443
Entropy (8bit):	5.622820681358379
Encrypted:	false
SSDEEP:	192:KO87cE+wCFgcmzFFLiMx+vomnNST2kYLAZVeOhRido3ARvVppn8pZl:KO6cE+wCFgFLGvomNSBYL1eROY
MD5:	1FB8462302F6FBB9323F187505F5393F
SHA1:	B1FE31671174AA0BC7DFBFCC942AEFBFCBDB55BA
SHA-256:	CBFC3F32A1493FB38FD92BE4BC61035CB4948B6CF91AE5CC0038006AC753EA98
SHA-512:	22B96DA64E536EE01CDC30946AF83FCA8BF939A41443C8E9F7E7D296388FC94E3BED12E1FCE20B7E5E31E7611B1DC4CE235DBD1B3B61CC4A6F77350749C86BFF
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["95393"],{392459:function(e){e.exports="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 66 38' width='66' height='38'%3E%3Crect x='0' y='0' width='66' height='38' style='fill: rgb(0, 0, 0); stroke: rgb(0, 0, 0);'%3E%3C/rect%3E%3C/svg%3E"},850259:function(e){e.exports="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='6.122 5.864 259 50' width='259' height='50'%3E%3Cpath fill='%23000000' fill-rule='evenodd' d='M 68.122 11.864 L 192.122 11.864 C 193.779 11.864 195.122 13.207 195.122 14.864 L 195.122 28.864 C 195.122 30.521 193.779 31.864 192.122 31.864 L 68.122 31.864 C 66.465 31.864 65.122 30.521 65.122 28.864 L 65.122 14.864 C 65.122 13.207 66.465 11.864 68.122 11.864 Z M 68.122 35.864 L 262.122 35.864 C 263.779 35.864 265.122 37.207 265.122 38.864 L 265.122 48.864 C 265.122 50.521 263.779 51.864 262.122 51.864 L 68.122 51.864 C 66.465 51.864 65.122 50.521 6

Chrome Cache Entry: 153

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1131565
Entropy (8bit):	5.877306362220961
Encrypted:	false
SSDEEP:	12288:BMrA+2Uf/GNe5hxEhraL6OFn7RcYxUgRHp09/V+KtlzJ/871zWUjEG6T7b:BMrZ5fyXvOFn7RfdHp0FV+vzWUoG2
MD5:	4F8F7AC8F509D88D00832626B0034B06
SHA1:	1EB4AA922A3585CF75D1D327456BE75C2D5B7691
SHA-256:	75121705F4F16884C3A4B4E8823088807C10D215EEFB26A8188B8421D8A13D91
SHA-512:	62F992FC3F9C3B1FFA50ECC096C8A117E9B855C4856A9D5413BB9B2EE93A44038D67D097E14CDECABF6E07538A1E1156A78718645272E9496F75B005A4B2A009
Malicious:	false
Preview:	(()=>{var e={654861:function(e,t,r){e=r.nmd(e);var n=function(e){"use strict";var t=s(9007199254740992),r="0123456789abcdefghijklmnopqrstuvwxyz",a="function"==typeof BigInt;function _(e,t,r,n){return void 0===e?_[0]:void 0!==t?10!=+t\|\|r?Y(e,t,r,n):F(e):F(e)}function o(e,t){this.value=e,this.sign=t,this.isSmall=!1}function E(e){this.value=e,this.sign=e<0,this.isSmall=!0}function i(e){this.value=e}function c(e){return -9007199254740992<e&&e<9007199254740992}function s(e){return e<1e7?[e]:e<1e14?[e%1e7,Math.floor(e/1e7)]:[e%1e7,Math.floor(e/1e7)%1e7,Math.floor(e/1e14)]}function l(e){u(e);var r=e.length;if(r<4&&0>g(e,t))switch(r){case 0:return 0;case 1:return e[0];case 2:return e[0]+1e7e[1];default:return e[0]+(e[1]+1e7e[2])*1e7}return e}function u(e){for(var t=e.length;0===e[--t];);e.length=t+1}function I(e){for(var t=Array(e),r=-1;++r<e;)t[r]=0;return t}function R(e){return e>0?Math.floor(e):Math.ceil(e)}function N(e,t){var r,n,a=e.length,_=t.length,o=Array(a),E=0;for(n=0;n<_;n++)E=(r=

Chrome Cache Entry: 154

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11498)
Category:	downloaded
Size (bytes):	11547
Entropy (8bit):	5.654551838352384
Encrypted:	false
SSDEEP:	192:632FaInJkXD9sQex9Wlp4JG+xyhyTBwFRAD0C+eN1Z0:632UK2XD9sQex9Wj4JG+xS0yba0
MD5:	AC6CE4E7FF5F746693AB549F03BE7ADE
SHA1:	2A3F2AFB8955C4218FDE52112D6F2E0E96CBD666
SHA-256:	233B97D0C0F688815243BCED54A8E2B633F60622B8704676F1E7C8F3051E19A1
SHA-512:	6F9EFF5DBC54D96955A801E0BB5A15E08989A8569018C223E0A079BFA03CAB090ADB545A5145EE934B848D2DF677493EF90E8A42D801817A4EA9BCBFC16F5DCD
Malicious:	false
URL:	https://discord.com/assets/fdc71c23d09e18e94ce2.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["90628"],{231443:function(e){e.exports="/assets/e04bcb7316f7205e85fb.svg"},74830:function(e){e.exports="/assets/23a7a3fd6624342117bf.svg"},206818:function(e){e.exports="/assets/17a91e9b4e7eb3921ed5.svg"},73117:function(e,s,n){e.exports=n.p+"39b91170d9f2309e4c5e.mov"},988868:function(e,s,n){e.exports=n.p+"15aad6b83736f221e23b.mp4"},554355:function(e){e.exports="/assets/fb70c6325a7d728cb6d0.png"},991989:function(e,s,n){e.exports=n.p+"48ad19e80083bee682d2.webm"},787462:function(e,s,n){e.exports=n.p+"a476863d4f441618840f.mov"},635507:function(e,s,n){e.exports=n.p+"87c3abd90e246db4b38a.mp4"},470794:function(e){e.exports="/assets/7df11a68a272724be266.png"},886777:function(e,s,n){e.exports=n.p+"b235c36699192662a3fe.webm"},588705:function(e,s,n){n.d(s,{R:function(){return f}}),n(411104);var t=n(200651),a=n(192379),l=n(442837),r=n(481060),i=n(388905),u=n(686546),o=n(925329),c=n(372769),m=n(726745),d=n(973616),I=

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20669)
Category:	downloaded
Size (bytes):	20718
Entropy (8bit):	5.5874718820742
Encrypted:	false
SSDEEP:	384:C4bQLjJHzjDcPDvYcJG9SAcksEi4aim6pvnVETji:DbQtjorYqG9e426PEa
MD5:	A2754ACCDA171158F8F581AD49DFBB9C
SHA1:	F619D690525B7ECA8BF70B9C24CBC58A3E092F1F
SHA-256:	606458816E822D1D0904C62D1E90C1595419CD92377055C63812BA63E00C3CDB
SHA-512:	F752422F8DE3B430832E43758F4C117D0D1FFB863CEDB95AA354635CC82DCC73F1371DA51626FFD76345D600970338DA4A2CD8F10739445C0123D990BD732CD5
Malicious:	false
URL:	https://discord.com/assets/94ec0c2b39908933eed3.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["25788"],{533307:function(e,t,n){let i;var s=n(544891),r=n(570140),l=n(728345),o=n(812206),a=n(625128),d=n(335131),u=n(669079),c=n(981631),_=n(474936);async function E(e){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1],n=arguments.length>2&&void 0!==arguments[2]&&arguments[2];r.Z.dispatch({type:"GIFT_CODE_RESOLVE",code:e});try{let i=await (0,u.bT)(e,t,n);if(null!=i.application_id&&i.application_id!==_.CL){let e=o.Z.getApplication(i.application_id);if(null==e)try{await l.ZP.fetchApplication(i.application_id)}catch(e){}}if(i.application_id===c.XAJ)try{await (0,d.jr)(i.sku_id)}catch(e){}return r.Z.dispatch({type:"GIFT_CODE_RESOLVE_SUCCESS",giftCode:i}),{giftCode:i}}catch(t){throw r.Z.dispatch({type:"GIFT_CODE_RESOLVE_FAILURE",code:e,error:t}),t}}i=n(775644).Z,t.Z={resolveGiftCode:E,async fetchUserGiftCodesForSKU(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:null;r.Z.dispatch

Chrome Cache Entry: 156

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 64x64, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	1066
Entropy (8bit):	7.8048030316845365
Encrypted:	false
SSDEEP:	24:w0Hm4yTnGeVfIFHU9HFbYMdL36oSMkKwzSwgvyQfpbfzu:w0Hm4AxWFHYeMZ36oSMS2wgpnu
MD5:	BD7895F71FAD6D9263981408ECCB3EF2
SHA1:	0DECC92425C58B121B6117B90EBFC89DE7397B8C
SHA-256:	927248AC3A7C831DC3DB7E45CEA4A7112F5BA02309227DDE46454F07CF773DB8
SHA-512:	CE7EBDA208426FBFC7E1A3F00ADD50A3944543385D6D2F0F29C1ABFB1653A1C8539D32C8C41FCA0BA6D71F9C65E09D21C6ADE661CD3719D5E7FF4A372FF0A32F
Malicious:	false
Preview:	RIFF"...WEBPVP8 .........@.@.>m..F$"..0......l....z..0?K.w....y.s..............S.?......h.....2>......j..{+....`...D. .........&...!..5w.8.S..VH.:b...-l..A_.......NVl0e..t..Q4hl..tCv...cB.&H......0`.>.]..(.n<6L]u.....M...%WN...>.......".../a .7FT.X..-.:....?.6Z[oO=^.==.).............y...Cn.}..0.fh.3.a....=k....O.^J4'..W."W....'...0.3.~.H..=....CT..W.kTVm.1.D.Rx6@.J..<.]~{4..h....u.42P........6vk.S...eF..fL..!..t0zO..h..Z....B....t.e..w:.......)...._.`E..-r..'"O.D..N.e.u..vp@...dd.............H.$.C.........c...ay.....I,c.2i..a.s.H...&..<:.3..!../..............?...rb"..9..r.q..g.{..E.A.].Rk.y..p[%..m.E]._m.........\....."<S.?......^........qU...L......4LE.q...?......E.n.p%5.54...f....5...g]...'...O....S.>+..DM4o.=.=.....[..5b..9...?y..cF.b...1..+.y...o.}.......>T=..........I....uc........^.....yT0...=#..i{....i..M1;...i.....g...3...g.~.].;.....0.Na......0.F....G.....&.[.+..>\|...9=..P......I.A.R.bT....8...C^q.N.....e;[..bm.{}.[P.y...

Chrome Cache Entry: 157

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	139
Entropy (8bit):	4.710597482771287
Encrypted:	false
SSDEEP:	3:t6WH7W+lFAATcvdnmFFSDDmJS4RKb5KGMXf/FGc8qQAGrqLW:t6Abli/m03mc4sldMX9QAw
MD5:	72A8B168AD2C7EEA7B2559B5690C7695
SHA1:	85E4F43154EA713C832BA27128A33EB7B2A7CF7A
SHA-256:	1F988D1AD4AB163D61A584254C07D75F3241EB6380BF48BF7D8F981E13C092CD
SHA-512:	11BCB1A3623B97C9DD2F22D0389B3CA05AB4F99596DE5D07C50C1FC83F7532D8C20B58379C54C38F503D86D8C2CAF52AF3B35FFCCDC4750089ABAF86C1C5294E
Malicious:	false
URL:	https://discord.com/assets/2597d11c1e039607373e.svg
Preview:	<svg fill="none" height="8" viewBox="0 0 8 8" width="8" xmlns="http://www.w3.org/2000/svg"><circle cx="4" cy="4" r="4" fill="#fff"/></svg>.

Chrome Cache Entry: 158

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	180
Entropy (8bit):	4.921485085907038
Encrypted:	false
SSDEEP:	3:t6WH7W+ZacvTnARcLnkDmJS4RKb5KVErcHYWNTWi7eLFOyTIXGUNfHFQJJqGrqL0:t6AbZ/Ikn4mc4slmYWBWzLRI2ylQJAe
MD5:	B1D4C5E276E3AAA8EC41E6014DD572B2
SHA1:	B5B63A8B35223277D75C79B2AABD8221FDA383EB
SHA-256:	7CF5996F7AB483BD985B3DE5BFBCF50A2B22A7B473E8011E5C993D9830AF9D12
SHA-512:	8E4C954D96FBDA407E87FA65859FE758FC83F2DA0C6D7C07824926BFB0BCDF4F40DE057C5DD1D7EE0890C5287D2ED2EC8FDEFBDF317B46FE222339894E0A559B
Malicious:	false
URL:	https://discord.com/assets/5430e9964fe8364e084d.svg
Preview:	<svg fill="none" height="9" viewBox="0 0 6 9" width="6" xmlns="http://www.w3.org/2000/svg"><path d="m0 2.83912v3.32176l3 2.83912 3-2.83912v-3.32176l-3-2.83912z" fill="#fff"/></svg>

Chrome Cache Entry: 159

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	137
Entropy (8bit):	4.7861988241054
Encrypted:	false
SSDEEP:	3:t6WH7W+IjSKcvUVYEo0LvDmJS4RKb5KVErcHNDPqdcJqGrqL0:t6AbzUOC3mc4slmNDiiAe
MD5:	7D883BA72B5DBC0229F5D1980205EE34
SHA1:	678BDA23DF97E8B9C3B15E71C41E7B215D043F22
SHA-256:	53A0F1F10860A6E4CF9BD3B4949C5DDE68888DBC96BA0DA1020C5958EFC214A5
SHA-512:	E040F62517C951A0AB2ABC5038F22456E5862166E2A2346345464B9C4B63271CFBD1220BB14D2C39D7FACFD008848ACE682420F1EFE9F4F29265D7177A3C7E16
Malicious:	false
URL:	https://discord.com/assets/ab03f7053698d417194c.svg
Preview:	<svg fill="none" height="12" viewBox="0 0 12 12" width="12" xmlns="http://www.w3.org/2000/svg"><path d="m5 2h2v8h-2z" fill="#fff"/></svg>

Chrome Cache Entry: 160

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2058
Entropy (8bit):	4.614306214221163
Encrypted:	false
SSDEEP:	48:CVHe7HtOty0VulV1/8CXP0Cjek7aj4clug9ai:iANEyxx8UPTXaj4cogIi
MD5:	E1349377226366F95F85AB9EAC4586D3
SHA1:	9A3A00B6E6AB0A240363F4E4DB2F5288227FF76B
SHA-256:	2CA673A9914A35A230469A8A0FD6B4DB293B236DEA391633B53339AFE577A92E
SHA-512:	7C16967D1960CDE4914F71B6FE347A7764AAED42366A87920597D225F3874B5B34A00C5089564BEBF0A919C419049DB99B27128CC81BC28A1492460FD199F9E7
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 45 45" xml:space="preserve">. <defs>. <clipPath id="a" clipPathUnits="userSpaceOnUse">. <path d="M0 36h36V0H0v36Z"/>. </clipPath>. <mask id="b">. <g>. <rect x="0" y="0" width="100" height="100" fill="white" />. <path d="M11.708 29.849a1.296 1.296 0 1 0-2.591-.001 1.296 1.296 0 0 0 2.591 0" fill="black"/>. </g>. </mask>. </defs>. <g>. <g>. <g clip-path="url(#a)" transform="matrix(1.25 0 0 -1.25 0 45)" mask="url(#b)">. <g>. <path d="M12.75 18.25c1.226-2.195 1.855 1.361 9.313 2.625 7.457 1.264 13.728-4.454 13.859-5.413C36.053 14.504 31.474 6 26.459 6h-15.71C6.607 6 3.727 13.224 6.75 17.438c0 0 4.5 3.5 6 .812" fill="white"/>. </g>. <g>. <path d="M13.008 17.864C8.02 10.927 6.968 6 10.75 6c-4.142 0-6.577 6.187-4.468 11.031.463 1.064 1.758 2.492 1.758 2.492l4.18.008c.162-.32.598-1.366.79-1.667" fill="white"/>. </g>. <g>. <path d

Chrome Cache Entry: 161

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17413)
Category:	dropped
Size (bytes):	17462
Entropy (8bit):	5.594711522541062
Encrypted:	false
SSDEEP:	384:iwLnWOUnUuyMNps0HHHsglNzUxBAAdTRIZWiv/XB2kZYP:BLQne0P5UxMXB2kSP
MD5:	3B98C1EF9293D482A5099FDB6984946F
SHA1:	6FEFA9D8FF6B2DB16B5EC2ED5922DA0AE6187448
SHA-256:	A76F75BF6294EEA278F82522810ACBC3BCFA9290006F57746AD79BCA3615AD66
SHA-512:	CE9915807ADC42ECAF18D254091B31BD65CE9A29AF38820ACCC2A5D38BC8AA329471AE1E7F404B6F8D0F85CC643B3616863A70D0E3EA1B8C569AC64A5E889C54
Malicious:	false
Preview:	(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["15812"],{884835:function(t,e,r){"use strict";var o=r(311596);function n(){}function i(){}i.resetWarningCache=n,t.exports=function(){function t(t,e,r,n,i,a){if(a!==o){var u=Error("Calling PropTypes validators directly is not supported by the `prop-types` package. Use PropTypes.checkPropTypes() to call them. Read more at http://fb.me/use-check-prop-types");throw u.name="Invariant Violation",u}}function e(){return t}t.isRequired=t;var r={array:t,bigint:t,bool:t,func:t,number:t,object:t,string:t,symbol:t,any:t,arrayOf:e,element:t,elementType:t,instanceOf:e,node:t,objectOf:e,oneOf:e,oneOfType:e,shape:e,exact:e,checkPropTypes:i,resetWarningCache:n};return r.PropTypes=r,r}},639519:function(t,e,r){t.exports=r(884835)()},311596:function(t){"use strict";t.exports="SECRET_DO_NOT_PASS_THIS_OR_YOU_WILL_BE_FIRED"},58615:function(t,e,r){var o=r(338091);function n(t){this.mode=o.MODE_8BIT_BYTE,this.data=t}n.prototype={getLength:fu

Chrome Cache Entry: 162

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 179380, version 2.459
Category:	downloaded
Size (bytes):	179380
Entropy (8bit):	7.998791638207558
Encrypted:	true
SSDEEP:	3072:IkairG/VFWmVX/55KB+fV6ZNTJuvdeDsYaZQ9aFftKn/zfRoJC1NTuGo5m5Ss9fY:5aD/VEIXs+fVSNTJ8deoYabFftK/VosY
MD5:	7CF1BE7696BF689B97230262EADE8AD8
SHA1:	8EB128F9E3CF364C2FD380EEFAA6397F245A1C82
SHA-256:	A981989AEE5D4479FFADF550D9ECFF24A4AC829483E3E55C07DA3491F84B12BA
SHA-512:	7D7C7DC08001079D93EF447122DEE49ABD2B7A84D1619A055FF3E7EC0009261AB6ADD018560BFD82ED22B29C1915BFD059F02CD83FED2E15E9AF05A5D0654E06
Malicious:	false
URL:	https://discord.com/assets/48a594e29497835802fe.woff2
Preview:	wOF2...............L...Q..............................F...v.`..:.....$....6.$...@...D.. ..Z...\..[lI..<....rs.J.....H.H.G..Lc6.X.......2....1...B...d5.a..1......_(.D..&v.......[...Q=..................K........w'.,yl.`.1x0.Ya..B..Ph..6m.D....kE.B`.zG4...%+..!.J......j.z.......Z.F....~....V.m5...\|Xc.eG.x}C.....[U2..:oZ..b..0j.B......9.w.....Z.:..e.t...7...6\O...5e.KUNU9.P....-W./......A.y..E.#N.........ui@.'.m..~.d.Q..vpBv.+p..9.l...Sb..s%...^2.....Z].\|......=,.....@....^...5..w.6.a.2...$...[v..A..sG.t....T..L..~....H4..&#....]...W..].V.....Pt....o.Y.....T../..qS....c.O(<..-'P.9s.../.t..G .........o..b....83.^"K......J+..z^2x.L.../=Ts.....]E.....s)Y...y...g...$....da.......lA...y..<-KoEP>..I.....T.\I...d75.M...0..q.F.....&......<~..k7.(.}Q.%.q.<...{..9..0>d.VV..ze...I.<..4M.s.$....k....L ..H.B....2e".3..+..]<..m..4...J.......7r....e...KT..7{:.A2..\|...l..m.bS...S+.B..CQ/.d-..;r.>.....=B.o.....!).[..2......a6.q4ak.^..kyk\|.L....{.~..f1..L1..

Chrome Cache Entry: 163

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7679)
Category:	downloaded
Size (bytes):	7728
Entropy (8bit):	5.087323529198084
Encrypted:	false
SSDEEP:	96:wgSRVk6Wg8lh4Nrviiv1aWPRkDhTt9qwqSBtxCMNMRV0IBSAMD9C+m+rmxARJx3t:RSRVmriLDPRkxtRJxNMRV0IZdSL9ilfA
MD5:	1C6B9D0AD743762986197AE0E81874C1
SHA1:	EABACE4131BA74B108FC891EA843B4F85B218808
SHA-256:	2D739091F602476FCF261435B48A1FAFCE2533564FFF0549D27B47E341B4DCBF
SHA-512:	74FDE9F8997087BB107ED5DDC3A4A37BD24793CAAD605FBDCDD54E9D18AF8F44D0C0E92FB2259AA936BD1B20D5537441EF39D9A7F066323911436184B0138111
Malicious:	false
URL:	https://discord.com/assets/d67c5e680608266a1f63.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["75492"],{849146:function(t,e,n){var r=function(){if("undefined"!=typeof Map)return Map;function t(t,e){var n=-1;return t.some(function(t,r){return t[0]===e&&(n=r,!0)}),n}return function(){function e(){this.__entries__=[]}return Object.defineProperty(e.prototype,"size",{get:function(){return this.__entries__.length},enumerable:!0,configurable:!0}),e.prototype.get=function(e){var n=t(this.__entries__,e),r=this.__entries__[n];return r&&r[1]},e.prototype.set=function(e,n){var r=t(this.__entries__,e);~r?this.__entries__[r][1]=n:this.__entries__.push([e,n])},e.prototype.delete=function(e){var n=this.__entries__,r=t(n,e);~r&&n.splice(r,1)},e.prototype.has=function(e){return!!~t(this.__entries__,e)},e.prototype.clear=function(){this.__entries__.splice(0)},e.prototype.forEach=function(t,e){void 0===e&&(e=null);for(var n=0,r=this.__entries__;n<r.length;n++){var i=r[n];t.call(e,i[1],i[0])}},e}()}(),i="undefined"!

Chrome Cache Entry: 164

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1131565
Entropy (8bit):	5.877306362220961
Encrypted:	false
SSDEEP:	12288:BMrA+2Uf/GNe5hxEhraL6OFn7RcYxUgRHp09/V+KtlzJ/871zWUjEG6T7b:BMrZ5fyXvOFn7RfdHp0FV+vzWUoG2
MD5:	4F8F7AC8F509D88D00832626B0034B06
SHA1:	1EB4AA922A3585CF75D1D327456BE75C2D5B7691
SHA-256:	75121705F4F16884C3A4B4E8823088807C10D215EEFB26A8188B8421D8A13D91
SHA-512:	62F992FC3F9C3B1FFA50ECC096C8A117E9B855C4856A9D5413BB9B2EE93A44038D67D097E14CDECABF6E07538A1E1156A78718645272E9496F75B005A4B2A009
Malicious:	false
URL:	https://discord.com/assets/sentry.d30fc24f50e5e3e76b3e.js
Preview:	(()=>{var e={654861:function(e,t,r){e=r.nmd(e);var n=function(e){"use strict";var t=s(9007199254740992),r="0123456789abcdefghijklmnopqrstuvwxyz",a="function"==typeof BigInt;function _(e,t,r,n){return void 0===e?_[0]:void 0!==t?10!=+t\|\|r?Y(e,t,r,n):F(e):F(e)}function o(e,t){this.value=e,this.sign=t,this.isSmall=!1}function E(e){this.value=e,this.sign=e<0,this.isSmall=!0}function i(e){this.value=e}function c(e){return -9007199254740992<e&&e<9007199254740992}function s(e){return e<1e7?[e]:e<1e14?[e%1e7,Math.floor(e/1e7)]:[e%1e7,Math.floor(e/1e7)%1e7,Math.floor(e/1e14)]}function l(e){u(e);var r=e.length;if(r<4&&0>g(e,t))switch(r){case 0:return 0;case 1:return e[0];case 2:return e[0]+1e7e[1];default:return e[0]+(e[1]+1e7e[2])*1e7}return e}function u(e){for(var t=e.length;0===e[--t];);e.length=t+1}function I(e){for(var t=Array(e),r=-1;++r<e;)t[r]=0;return t}function R(e){return e>0?Math.floor(e):Math.ceil(e)}function N(e,t){var r,n,a=e.length,_=t.length,o=Array(a),E=0;for(n=0;n<_;n++)E=(r=

Chrome Cache Entry: 165

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	14624305
Entropy (8bit):	5.854943527266922
Encrypted:	false
SSDEEP:	196608:r6lXgFXaYzjupIEtYW4sZoymJBkD/skskv:rXXaYzjupIEtYW4sZ9mJBkDks
MD5:	216CB783D60A3E7C57C9D9FFEA99DC3F
SHA1:	C645D044161C447B84CBA1E62FCB018B5A7D6066
SHA-256:	48D0B669FD29BF3D5A6552EBD89B2048FBB6D58F824E8DD1F92772AC5821D716
SHA-512:	54F12CC52FBCAE1DF1575969CD269E75795B6D469B2C5CB0854D5A242A9A460CFBC8A9C9DCBDF4A7B7CEBC9EEC2EFC54A714C9CB6DB68974173DA2AC4E01E84B
Malicious:	false
URL:	https://discord.com/assets/webMinimal.183cbc8427e6b143ce21.js
Preview:	(()=>{var e={385007:function(e,t,n){var r={"./de.jsona":["644753","30244"],"./zh-CN.jsona":["494062","56446"],"./da.jsona":["44867","57387"],"./el.jsona":["581144","55601"],"./tr.jsona":["146878","84385"],"./es-ES.jsona":["872550","45747"],"./hr.jsona":["403530","29924"],"./cs.jsona":["753771","87233"],"./fi.jsona":["554545","7402"],"./es-419.jsona":["39227","59729"],"./ja.jsona":["516722","7728"],"./pt-BR.jsona":["246297","394"],"./ro.jsona":["37190","53269"],"./sv-SE.jsona":["335417","11193"],"./ru.jsona":["809464","12611"],"./vi.jsona":["139107","45576"],"./id.jsona":["492248","77800"],"./it.jsona":["515630","78670"],"./uk.jsona":["167111","58548"],"./lt.jsona":["877749","44754"],"./pl.jsona":["477384","60878"],"./hu.jsona":["107425","98570"],"./nl.jsona":["432763","41588"],"./th.jsona":["182260","49827"],"./bg.jsona":["251927","20575"],"./fr.jsona":["570173","99450"],"./zh-TW.jsona":["592369","30684"],"./hi.jsona":["629869","22732"],"./en-GB.jsona":["569249","99339"],"./ko.jsona":[

Chrome Cache Entry: 166

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	395
Entropy (8bit):	4.646873794844198
Encrypted:	false
SSDEEP:	6:tnrVzUOtumc4slvIl4slvUldboLYPsd9IZI0OuFxMdIr0a/NdpVo4a38n:trVzNtuCHvOdELYPsuI09z9LdYr38n
MD5:	E843C51C0EEC3801B70CAE5C45AD343F
SHA1:	AD735360ECFA829DB9D6C48F1A671A99BFCE1D2A
SHA-256:	F860149A77A53D43396F3AEC9377B9A0DD6C5D84459079C5D393F6343EC253FB
SHA-512:	2AF4816580FD02A2AE107914D967AF966CA97E137434E2668C7A430D34168E150F668AE3A3B005BFF7070D50A0FD89BD0B5A351F5E3DB6F6B167998378308F71
Malicious:	false
URL:	https://discord.com/assets/410a2166a48c9e482e2a.svg
Preview:	<svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M2.9932 7.49727C5.48073 7.49727 7.49727 5.48073 7.49727 2.9932C7.49727 1.84421 7.06704 0.795708 6.35889 0C9.50595 0.188323 12 2.80018 12 5.99456C12 9.31127 9.31127 12 5.99456 12C2.80018 12 0.188323 9.50595 0 6.35889C0.795708 7.06704 1.84421 7.49727 2.9932 7.49727Z" fill="#FFFFFF"/>.</svg>.

Chrome Cache Entry: 167

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9319)
Category:	dropped
Size (bytes):	9368
Entropy (8bit):	5.515903871543996
Encrypted:	false
SSDEEP:	96:i5FOdCCCb5Ui4C5wOjggHurX0W89VSIFIUpSpWgAUcnNyeVjAZ2dQTK0ne+6ACub:iSbuIAr3gKYa48OwaUDhQDFRtQS
MD5:	484B9F4BDA963A4ADE71A4EB95D2538F
SHA1:	C381C9D9C91D4256D92E2480CB9DF1A0F090F7D6
SHA-256:	EA87CB393653DF89EF7B31DD35BC78C5DBA14B5F5BEC401153A3C51CD566C923
SHA-512:	D18D67D5B5FC1FDBE61C6728B7104A5589837A32D6D20BF59B0405DB4093FBAF3FBF961DBC24158B5C21147945941D75ECBADF264857EAB722C9511F70D0988B
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["84956"],{986197:function(e,t,n){var i=n(990547),o=n(544891),a=n(570140),s=n(881052),r=n(626135),u=n(573261),l=n(545851),g=n(109488),d=n(794099),c=n(981631),m=n(689938);n(135200);t.Z={resetSuggestions:()=>a.Z.dispatch({type:"POMELO_SUGGESTIONS_RESET"}),async fetchSuggestionsRegistration(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:1500;if(!!(0,d.vc)()){a.Z.dispatch({type:"POMELO_SUGGESTIONS_RESET"});try{var n;let i=await o.tn.get({url:c.ANM.POMELO_SUGGESTIONS_UNAUTHED,query:null==e?void 0:{global_name:e},timeout:t});if(i.ok&&(null===(n=i.body)\|\|void 0===n?void 0:n.username)!=null)return a.Z.dispatch({type:"POMELO_REGISTRATION_SUGGESTIONS_SUCCESS",suggestion:i.body,source:e})}catch(e){return}}},async fetchSuggestions(e){if(!!(0,g.P)())try{var t;a.Z.dispatch({type:"POMELO_SUGGESTIONS_FETCH",usernameSuggestionLoading:!0});let n=await o.tn.get({url:c.ANM.POMELO_SUGGESTIONS,timeout:e});if(

Chrome Cache Entry: 168

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	395
Entropy (8bit):	4.646873794844198
Encrypted:	false
SSDEEP:	6:tnrVzUOtumc4slvIl4slvUldboLYPsd9IZI0OuFxMdIr0a/NdpVo4a38n:trVzNtuCHvOdELYPsuI09z9LdYr38n
MD5:	E843C51C0EEC3801B70CAE5C45AD343F
SHA1:	AD735360ECFA829DB9D6C48F1A671A99BFCE1D2A
SHA-256:	F860149A77A53D43396F3AEC9377B9A0DD6C5D84459079C5D393F6343EC253FB
SHA-512:	2AF4816580FD02A2AE107914D967AF966CA97E137434E2668C7A430D34168E150F668AE3A3B005BFF7070D50A0FD89BD0B5A351F5E3DB6F6B167998378308F71
Malicious:	false
Preview:	<svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M2.9932 7.49727C5.48073 7.49727 7.49727 5.48073 7.49727 2.9932C7.49727 1.84421 7.06704 0.795708 6.35889 0C9.50595 0.188323 12 2.80018 12 5.99456C12 9.31127 9.31127 12 5.99456 12C2.80018 12 0.188323 9.50595 0 6.35889C0.795708 7.06704 1.84421 7.49727 2.9932 7.49727Z" fill="#FFFFFF"/>.</svg>.

Chrome Cache Entry: 169

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9310)
Category:	dropped
Size (bytes):	9359
Entropy (8bit):	5.630050363226493
Encrypted:	false
SSDEEP:	192:fcLtSa9QY4Cg9OcfTp1tOxyoZA0ab0KPqO2Lk2mMATw2DxnE7LoT:6WCQdfTLteyoZA0ab0KPqO2Lp+w2DxEo
MD5:	52287A03A33104E4E3508B67501DB130
SHA1:	B131FDFAA0259B1226B6EDF3BF5820C60A25FCAB
SHA-256:	A690D620CF44F9CAEF92F4943B977D45EF082F2280D16B7D6EE3B76157812310
SHA-512:	F4C83E10C7FB93CAA7F0B183D49DEFC53D21B8CC7CABAAD79ED36974F53DF01F87D45CF3452F7F3C2BF86168D3DC488296C6EA57279B4A2CDC083A2747AD97BE
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["4775"],{292824:function(t){t.exports="/assets/00fe8a6557e204eb9503.svg"},231239:function(t,e,n){var r=n(990547),i=n(283693),l=n(570140),u=n(573261),o=n(981631);e.Z={signup:(t,e)=>u.Z.post({url:o.ANM.HUB_WAITLIST_SIGNUP,body:{email:t,school:e},trackedActionData:{event:r.NetworkActionNames.HUB_WAITLIST_SIGNUP,properties:t=>{var e;let n=!1,r=null==t?void 0:null===(e=t.body)\|\|void 0===e?void 0:e.email_domain;return null!=r&&(n=-1!==r.split(".").indexOf("edu")),(0,i.iG)({is_edu_email:n})}}}),sendVerificationEmail:async(t,e,n)=>(await u.Z.post({url:o.ANM.HUB_EMAIL_VERIFY_SEND,body:{email:t,guild_id:n,allow_multiple_guilds:e,use_verification_code:!0},trackedActionData:{event:r.NetworkActionNames.HUB_EMAIL_VERIFY_SEND,properties:t=>{var e;let n=null==t?void 0:null===(e=t.body)\|\|void 0===e?void 0:e.has_matching_guild;return(0,i.iG)({has_matching_guild:n})}}})).body,async verify(t){if(null!=t)try{var e;let n=awa

Chrome Cache Entry: 170

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18134)
Category:	dropped
Size (bytes):	18183
Entropy (8bit):	5.745446950417671
Encrypted:	false
SSDEEP:	384:M7+ek/HNfVFGOSH4vgk+l/HyHOC7CmA5h4m4C2xYtL5c299H0KkBijYpthjDh2P1:g+ek/7VwEgkK/SuC7Cx5G1C2xYtL5c2R
MD5:	CB2E31554EC3CE69856DD70C281A6DB7
SHA1:	53524C140D3B966DFA9ADAF06A1AD062CC5FB9E1
SHA-256:	A4E79A1E245BDE12C9A8FE50342E450213CB0F3002D0453DE8FDEDE75630F2D2
SHA-512:	FB5D9629793FA3A432D955AE2193504445464719C92B7281612DC83912FCF1150A07F2BEDEDADFB102D8FC0D54980B769C933D4D99DEDAD0AFC14E3065ABE6FC
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["10778"],{418757:function(e){e.exports="/assets/b7d1dc6b0746101719c5.png"},494207:function(e){e.exports="/assets/85153fe71873da0f5802.svg"},320440:function(e){e.exports="/assets/4676f063fb9f129e9fdb.svg"},561030:function(e){e.exports="/assets/75c80c4160a66983ae66.svg"},419185:function(e){e.exports="/assets/47e72e6360ce185adab6.svg"},826806:function(e){e.exports="/assets/fb418059f41b569abca4.svg"},123013:function(e){e.exports="/assets/98cacc492d985565ed4f.png"},540909:function(e){e.exports="/assets/2a5176cf2bd0ccdf0e7b.svg"},232454:function(e){e.exports="/assets/ad2027f11792ba8c0e7f.svg"},526916:function(e){e.exports="/assets/f38b6aefa24dc9a54765.svg"},29654:function(e){e.exports="/assets/dde11474b0623b723861.svg"},820160:function(e,s,a){a.d(s,{Z:function(){return L}});var E=a(200651);a(192379);var _=a(481060),t=a(813197),n=a(689938),r=a(510186);function L(e){let{icon:s,onChange:a}=e;return(0,E.jsx)(_.Fo

Chrome Cache Entry: 171

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8056), with no line terminators
Category:	dropped
Size (bytes):	8056
Entropy (8bit):	5.752809686834693
Encrypted:	false
SSDEEP:	96:hWxdw2oQbw2hb2f2V226BKgIsgo6hgK3MvdCSsR6YenpB1QIHp4CiHKZcRCfFGQX:WoYhzsBKtsgfb3ME7R6vp/LHIH/RvQLT
MD5:	DCCAC072254178F164D9CFA3D312EF58
SHA1:	4057E89FBAC5E45FD4ADAB0A295F69DF800CF799
SHA-256:	E2201F03A3F05CB5DECAB841BC19300DE8E62A4E733A93FD940E4C7ED68F1B4F
SHA-512:	A0DA02314CEBD7180BF587E02BAC4CAE9233BDE2E2988451B16F47DCE85C0B2FA9F79B3316D86BFEE4155138AD77CFF3BABB646A1DBCB0FE24ACE0F43AF26BEF
Malicious:	false
Preview:	window._cf_chl_opt={cFPWv:'g'};~function(V,h,i,n,o,s,z,A){V=b,function(c,d,U,e,f){for(U=b,e=c();!![];)try{if(f=-parseInt(U(185))/1(parseInt(U(231))/2)+-parseInt(U(204))/3+parseInt(U(229))/4+parseInt(U(128))/5+-parseInt(U(153))/6(parseInt(U(222))/7)+parseInt(U(196))/8*(-parseInt(U(166))/9)+parseInt(U(136))/10,f===d)break;else e.push(e.shift())}catch(D){e.push(e.shift())}}(a,321071),h=this\|\|self,i=h[V(212)],n=function(a0,d,e,f){return a0=V,d=String[a0(209)],e={'h':function(D){return D==null?'':e.g(D,6,function(E,a1){return a1=b,a1(207)[a1(208)](E)})},'g':function(D,E,F,a2,G,H,I,J,K,L,M,N,O,P,Q,R,S,T){if(a2=a0,null==D)return'';for(H={},I={},J='',K=2,L=3,M=2,N=[],O=0,P=0,Q=0;Q<D[a2(195)];Q+=1)if(R=D[a2(208)](Q),Object[a2(184)][a2(177)][a2(173)](H,R)\|\|(H[R]=L++,I[R]=!0),S=J+R,Object[a2(184)][a2(177)][a2(173)](H,S))J=S;else{if(Object[a2(184)][a2(177)][a2(173)](I,J)){if(256>J[a2(234)](0)){for(G=0;G<M;O<<=1,E-1==P?(P=0,N[a2(192)](F(O)),O=0):P++,G++);for(T=J[a2(234)](0),G=0;8>G;O=T&1\|O<<1,P==

Chrome Cache Entry: 172

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13325)
Category:	downloaded
Size (bytes):	13374
Entropy (8bit):	5.33229367944175
Encrypted:	false
SSDEEP:	192:c9jPMDYeG0dPbPDjzw4WDhiElYrskCLdHWQBC7dr1m+8LBpDtOnyUotvLfQE2u:c9jPMRLjZ0usbxwdr1QBpDtOy3JT
MD5:	D0C788B157FF96A2DD902C97BFC889F6
SHA1:	6CDE0BD611B34B15CA15437CA5AC4F77DE01ADA8
SHA-256:	05A00FBAFFC4A7254C9B631FF0E81BE546DC275BE1D6F992C36849222D0B73F7
SHA-512:	170615E3DE829D517662BE32C762B76B013163FA040C2EEDF89C865A9CEE1CEEDA7EE305BE27CD3A724832571A94B5A26FB3BB9D9A1D1C5386081F206A1E1436
Malicious:	false
URL:	https://discord.com/assets/5067a2ec1b24a6de868c.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["78187"],{526988:function(t,n,r){var e=r(354848),o=r(938507),i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not a function")}},24033:function(t,n,r){var e=r(622281),o=String,i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not an object")}},953326:function(t,n,r){var e=r(299623),o=r(980855),i=r(49693),u=function(t){return function(n,r,u){var c,f=e(n),a=i(f),s=o(u,a);if(t&&r!=r){for(;a>s;)if((c=f[s++])!=c)return!0}else for(;a>s;s++)if((t\|\|s in f)&&f[s]===r)return t\|\|s\|\|0;return!t&&-1}};t.exports={includes:u(!0),indexOf:u(!1)}},332916:function(t,n,r){var e=r(581031),o=e({}.toString),i=e("".slice);t.exports=function(t){return i(o(t),8,-1)}},381740:function(t,n,r){var e=r(740362),o=r(666061),i=r(347722),u=r(97131);t.exports=function(t,n,r){for(var c=o(n),f=u.f,a=i.f,s=0;s<c.length;s++){var p=c[s];!e(t,p)&&!(r&&e(r,p))&&f(t,p,a(n,p))}}},251069:function(t,n,r){var e=r

Chrome Cache Entry: 173

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1189139
Entropy (8bit):	5.20676221692586
Encrypted:	false
SSDEEP:	24576:xAexVV4zeUuKevkJHfJytZemXpvyZTQ02JKdmtWCt3nCxhZyUXQ32N4XhKOXAWbF:xAenVOuKevkJHfJytZemXpvyZTQ02JKw
MD5:	7B173AF12AA2176B69D5656709649AB1
SHA1:	C04DB8B7D3EAE3F4EB8CCCF59F71ED924B87E029
SHA-256:	D92469EE3632C38B4562C947419B685A7A13EFF0E3861DCC383A255C389A5F40
SHA-512:	945BE17823D84E2A6E5BB0852B73FD77B0A292EAF13718F94D3AA8008F33B10A9C6007E2ACFFFE970CC10E9A04227C57BADD5B0C3BF0F46F4EAB98E248455561
Malicious:	false
URL:	https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css
Preview:	@keyframes spinner-wandering-cubes_b6db20{25%{transform:translatex(22px)rotate(-90deg)scale(.5)}50%{transform:translatex(22px)translatey(22px)rotate(-180deg)}75%{transform:translatex(0)translatey(22px)rotate(-270deg)scale(.5)}to{transform:rotate(-360deg)}}@keyframes spinner-chasing-dots-rotate_b6db20{to{transform:rotate(360deg)}}@keyframes spinner-chasing-dots-bounce_b6db20{0%,to{transform:scale(0)}50%{transform:scale(1)}}@keyframes spinner-pulsing-ellipsis_b6db20{0%{transform:scale(1);opacity:1}50%{transform:scale(.8);opacity:.3}to{transform:scale(1);opacity:1}}@keyframes spinner-low-motion_b6db20{0%{opacity:1}50%{opacity:.6}to{opacity:1}}@keyframes spinner-spinning-circle-rotate_b6db20{to{transform:rotate(360deg)}}@keyframes spinner-spinning-circle-dash_b6db20{0%{stroke-dasharray:1,200;stroke-dashoffset:0}50%{stroke-dasharray:130,200}to{stroke-dasharray:130,200;stroke-dashoffset:-124}}.spinner_b6db20{display:flex;justify-content:center;align-items:center}.inner_b6db20{position:relati

Chrome Cache Entry: 174

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	87973
Entropy (8bit):	5.125806607183933
Encrypted:	false
SSDEEP:	1536:f0kGwo/3g1MGEN6UCSQyYHhU58xxfrDX/5CF+gD58G3LpV9H5B7va:f0kGDZc
MD5:	E05640582E20F17E0F1797160B67DCD4
SHA1:	DCB27383F5836437E5433C7CCB5981E94826EE00
SHA-256:	E9DEEBCC271633C282AB3FE440CE81A196ECE4F402804FE8940030F98C563475
SHA-512:	60CDDA59E85FDED81B351614DAF3D40B30F939F7F8D9B586F516165699822E8F07F344CDD3709DCF6ADA350C725330DF26B6947322F154AB54D02C5AF3AAD71B
Malicious:	false
Preview:	<svg width="1440" height="900" viewBox="0 0 1440 900" preserveAspectRatio="xMinYMin slice" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#a)"><g clip-path="url(#b)"><path d="M1440 0H0v900h1440V0Z" fill="url(#c)"/><path d="M1440 0H435.551v620.81H1440V0Z" fill="url(#d)"/><path d="M1440 341.601H484.351v558.38H1440v-558.38Z" fill="url(#e)"/><path d="M1440 0H427.5v690.995H1440V0Z" fill="url(#f)"/><path d="M787.663 810.02c330.987-141.179 530.547-416.834 445.727-615.692C1148.57-4.53 811.492-51.288 480.502 89.891 149.512 231.07-50.048 506.725 34.772 705.583c84.821 198.858 421.901 245.616 752.891 104.437Z" fill="url(#g)"/><path d="M1024.18 825.565c290.6-123.952 456.96-386.723 371.57-586.916-85.39-200.193-390.19-261.999-680.792-138.047-290.602 123.952-456.959 386.724-371.569 586.917 85.389 200.193 390.19 261.998 680.791 138.046Z" fill="url(#h)"/><path d="M673.907 771.815c264.238-112.707 429.363-319.136 368.823-461.073-60.538-141.936-323.823-165.631-588.061-52.924C190.431 370.5

Chrome Cache Entry: 175

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3146
Entropy (8bit):	4.484082045212369
Encrypted:	false
SSDEEP:	48:C4LO/K7oWBkomgBkRzd0kJBJkI8JkINGD/dYk2kahkzd/FnLgkpmZ5ZOE83VCn:RO/IS53JBJbKbN4WQbMRZmEAI
MD5:	81084FF5A27B6E6FF487E479C37D1660
SHA1:	81A274F69A1358F85715A0FEA227730D795CB353
SHA-256:	075DE1D6EA4FB470197A88BA371F60F70B819B250CB5AF8BD6A4794B1A9CA4A1
SHA-512:	CCCD00A5C013B130BE0A8466F903F7EEE9306518DFAA8758849027EBC1829EA2A6B7516E4D2070B110A12EC7EB559E3B75D256AD1B07BE3FD8595C0E430DC0D5
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 90 59.19">. <defs>. <style>. .cls-1{fill:#6a94ff}.cls-2{fill:#a9c7ff}.cls-3{fill:#202225}. </style>. </defs>. <g id=".._2" data-name=".. 2">. <g id="Layer_1" data-name="Layer 1">. <path class="cls-1" d="M89.59 19.89 84.93 8.38a5.51 5.51 0 0 0-7.19-3l-5.67 2.25A12.42 12.42 0 0 0 56 .91L45.48 5.16c-1.84 4.11-5.48 9.72-11.59 9.52a8.55 8.55 0 0 1-5.51-2.13c-.12-.11-.24-.22-.34-.33l-12.66 5.13a12.42 12.42 0 0 0-6.9 16l-5 2A5.52 5.52 0 0 0 .4 42.61l4.67 11.51a5.51 5.51 0 0 0 7.18 3l5.64-2.28A12.43 12.43 0 0 0 32 58.28l40.54-16.44a12.43 12.43 0 0 0 7.73-12.22l6.28-2.54a5.52 5.52 0 0 0 3.04-7.19ZM11.65 52.94a2.76 2.76 0 0 1-3.59-1.52l-3.63-9A2.76 2.76 0 0 1 6 38.87l4-1.65 5.69 14.07ZM22.33 39.6a3.72 3.72 0 1 1 2.06-4.85 3.71 3.71 0 0 1-2.06 4.85Zm33.36-1.55-11.77 4.77A10.61 10.61 0 0 1 30.11 37l-3.33-8.23A4 4 0 0 1 29 23.56l23.31-9.44a4 4 0 0 1 5.18 2.19l3.63 9a9.8 9.8 0 0 1-5.43 12.74ZM67.49 21a3.73 3.73 0 1 1

Chrome Cache Entry: 176

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21762)
Category:	downloaded
Size (bytes):	21811
Entropy (8bit):	5.462655463719556
Encrypted:	false
SSDEEP:	384:f1bjtqrVapZjquHCWnJcJhcby8XziQBy6HUKVMov5hHKs80K:JjtOVaJDnJcPc+EWQ8EM65RR8l
MD5:	0FBB77D1B69F18DF0FDCF836DE1C4106
SHA1:	E8CE4037B97732809F1E1BF24992959C678F2118
SHA-256:	279E49A00A41A18545CF319B5A8B571FD48CFCC4B78A361BBE75A33CE7A4F71A
SHA-512:	F73E3B25561D0D3307C7DD9D505F84101897CFA70737D757AED8D95BDC6A2CE116FD114674DD0BBE666AABE2176B0EEF150A5D4EE2C7C3CCE815A5CA73215D03
Malicious:	false
URL:	https://discord.com/assets/a6f6204cd40c3c5f5c14.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["71984"],{772425:function(t,r,n){var e=n(933676),o=n(938507),i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not a constructor")}},603528:function(t,r,n){var e=n(838957),o=TypeError;t.exports=function(t,r){if(e(r,t))return t;throw o("Incorrect invocation")}},212036:function(t){t.exports="undefined"!=typeof ArrayBuffer&&"undefined"!=typeof DataView},192291:function(t,r,n){var e,o,i,u=n(212036),f=n(325008),a=n(161581),c=n(354848),s=n(622281),y=n(740362),p=n(974971),h=n(938507),v=n(251069),d=n(859209),g=n(4340),l=n(838957),A=n(144748),w=n(276321),x=n(641236),b=n(457507),T=n(644659),E=T.enforce,I=T.get,R=a.Int8Array,m=R&&R.prototype,O=a.Uint8ClampedArray,M=O&&O.prototype,F=R&&A(R),U=m&&A(m),_=Object.prototype,L=a.TypeError,B=x("toStringTag"),C=b("TYPED_ARRAY_TAG"),S="TypedArrayConstructor",P=u&&!!w&&"Opera"!==p(a.opera),V=!1,N={Int8Array:1,Uint8Array:1,Uint8ClampedArray:1,Int16Array:2,U

Chrome Cache Entry: 177

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 38156, version 2.66
Category:	downloaded
Size (bytes):	38156
Entropy (8bit):	7.992862818603593
Encrypted:	true
SSDEEP:	768:YLYEgWfC/zlP948Q4NxhBiMwYatzdYZyXSihSZ9ia6UBJlly12m9U:YLYEszTFQyxfiMwYmxYZ1p9ia6U7r4U
MD5:	3D6549BF2F38372C054EAFB93FA358A9
SHA1:	E7A50F91C7EC5D5D896B55FA964F57EE47E11A1B
SHA-256:	8E401B056DC1EB48D44A01407CEB54372BBC44797D3259069CE96A96DFD8C104
SHA-512:	4BDE638A4111B0D056464CE4FD45861208D1669C117E2632768ACD620FCD924AB6384B3133E4BAF7D537872166EB50CA48899B3909D9DBF2A111A7713322FAD4
Malicious:	false
URL:	https://discord.com/assets/c1b53be672aac192a996.woff2
Preview:	wOF2..............\|T.......B............................. .`..P..<..W.....8..}.6.$..`..r.. ..n..F..v[.Vq...Q.r......9.../h....r~..y...)Jv.._@....Z...cm.z.(...u..#EMKK..e.mm..2,.FK...Y..mk].{...[.^UR......8p.jD.n.t..k.....b!.C...&8...._.-n69(...N....o..w..1...\|.i....!..\...n.^.Kq..../]x.........x..N...=.^".ZF.L.6lD...X..[u.-.............y....\...%.q.....u~.y.K..>.d{...P..BU..2..p.nO.z....y~.....#DT...S.(d-~E.m...][..s...\..+.t..\!H.......'V...@.w..r['bc:V...X.d.86..c.......Xd<..p..N".9...X6..(\|.C..t....0x.E.....8_.....Xs..8(...4I.X2J,Y[[....U..^I.y.#...w.R.....).o..i.....a......t+...Pz.%..FB..&.$.dS.!$...iM;....K....;M....z`iw..j;.Su.I...O.Z9.....d....-2.Y2k.5....M.g..1u.$....T../.K.R1... ..?....C.&.wk..N.X....h.B.......};K@S...@'..4.;...\|x.I.R....zj..Ph....\7...<.m~U ......Hu.(\|SV<...?$.....MO.9.....H..z~R..9rD..y..H........N..i....}.."23.+........\|i.[..\|w..=.a-..E4...f..[....O9..g....x.0.c.f4..p[m.e/...)P......5.M......../..6.&..5.Rw

Chrome Cache Entry: 178

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11118)
Category:	downloaded
Size (bytes):	11167
Entropy (8bit):	5.535074023387345
Encrypted:	false
SSDEEP:	192:YVQA29dyFDfqMgeYTllT06FJLviKriLZErOWD8yLg6T06oGL3rOhzus:QazsqP116In4zn
MD5:	8AAA605C48DC545F185CA77C921139D3
SHA1:	D2481F19DC4D8F4B161D3DD0B35B446FDC505446
SHA-256:	9ADEBA0225F0D293B735E83C05D1BB063F750C439CE8BCD7ED362D795CFD39B1
SHA-512:	469573F4D8F912DC151474F9ACA815F2A686C590408B20733E58C1C21F8DC71A26B2569B8052A8B67331D2DD2FA4E54AD7B4D953FEBC2DCA0676827AC0EFD377
Malicious:	false
URL:	https://discord.com/assets/6df906184440a6461f5c.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["52030"],{48550:function(e,t,s){s.d(t,{P:function(){return l}});var n=s(689938);let l={get webauthn(){return n.Z.Messages.MFA_V2_WEBAUTHN_NAME},get totp(){return n.Z.Messages.MFA_V2_TOTP_NAME},get sms(){return n.Z.Messages.MFA_V2_SMS_NAME},get password(){return n.Z.Messages.MFA_V2_PASSWORD_NAME},get backup(){return n.Z.Messages.MFA_V2_BACKUP_NAME}}},124860:function(e,t,s){s.d(t,{Cd:function(){return f},YR:function(){return S}}),s(47120),s(411104);var n=s(200651),l=s(192379),i=s(481060),r=s(447097),o=s(873124),a=s(248902),d=s(160511),u=s(51693),c=s(973810),h=s(689938);function f(e){var t,s;let{mfaChallenge:h,mfaFinish:f,onEarlyClose:m,onClose:S,width:_=440}=e,[g,x]=l.useState(null!==(s=null===(t=h.methods[0])\|\|void 0===t?void 0:t.type)&&void 0!==s?s:"select"),[E,C]=l.useState(g),p=async e=>{let{mfaType:t,data:s}=e;await f({mfaType:t,data:s,ticket:h.ticket}),null!=S&&S()},v={mfaChallenge:h,finish:p,setSli

Chrome Cache Entry: 179

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9319)
Category:	downloaded
Size (bytes):	9368
Entropy (8bit):	5.515903871543996
Encrypted:	false
SSDEEP:	96:i5FOdCCCb5Ui4C5wOjggHurX0W89VSIFIUpSpWgAUcnNyeVjAZ2dQTK0ne+6ACub:iSbuIAr3gKYa48OwaUDhQDFRtQS
MD5:	484B9F4BDA963A4ADE71A4EB95D2538F
SHA1:	C381C9D9C91D4256D92E2480CB9DF1A0F090F7D6
SHA-256:	EA87CB393653DF89EF7B31DD35BC78C5DBA14B5F5BEC401153A3C51CD566C923
SHA-512:	D18D67D5B5FC1FDBE61C6728B7104A5589837A32D6D20BF59B0405DB4093FBAF3FBF961DBC24158B5C21147945941D75ECBADF264857EAB722C9511F70D0988B
Malicious:	false
URL:	https://discord.com/assets/6674c18c2e4160ceca2d.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["84956"],{986197:function(e,t,n){var i=n(990547),o=n(544891),a=n(570140),s=n(881052),r=n(626135),u=n(573261),l=n(545851),g=n(109488),d=n(794099),c=n(981631),m=n(689938);n(135200);t.Z={resetSuggestions:()=>a.Z.dispatch({type:"POMELO_SUGGESTIONS_RESET"}),async fetchSuggestionsRegistration(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:1500;if(!!(0,d.vc)()){a.Z.dispatch({type:"POMELO_SUGGESTIONS_RESET"});try{var n;let i=await o.tn.get({url:c.ANM.POMELO_SUGGESTIONS_UNAUTHED,query:null==e?void 0:{global_name:e},timeout:t});if(i.ok&&(null===(n=i.body)\|\|void 0===n?void 0:n.username)!=null)return a.Z.dispatch({type:"POMELO_REGISTRATION_SUGGESTIONS_SUCCESS",suggestion:i.body,source:e})}catch(e){return}}},async fetchSuggestions(e){if(!!(0,g.P)())try{var t;a.Z.dispatch({type:"POMELO_SUGGESTIONS_FETCH",usernameSuggestionLoading:!0});let n=await o.tn.get({url:c.ANM.POMELO_SUGGESTIONS,timeout:e});if(

Chrome Cache Entry: 180

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11498)
Category:	dropped
Size (bytes):	11547
Entropy (8bit):	5.654551838352384
Encrypted:	false
SSDEEP:	192:632FaInJkXD9sQex9Wlp4JG+xyhyTBwFRAD0C+eN1Z0:632UK2XD9sQex9Wj4JG+xS0yba0
MD5:	AC6CE4E7FF5F746693AB549F03BE7ADE
SHA1:	2A3F2AFB8955C4218FDE52112D6F2E0E96CBD666
SHA-256:	233B97D0C0F688815243BCED54A8E2B633F60622B8704676F1E7C8F3051E19A1
SHA-512:	6F9EFF5DBC54D96955A801E0BB5A15E08989A8569018C223E0A079BFA03CAB090ADB545A5145EE934B848D2DF677493EF90E8A42D801817A4EA9BCBFC16F5DCD
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["90628"],{231443:function(e){e.exports="/assets/e04bcb7316f7205e85fb.svg"},74830:function(e){e.exports="/assets/23a7a3fd6624342117bf.svg"},206818:function(e){e.exports="/assets/17a91e9b4e7eb3921ed5.svg"},73117:function(e,s,n){e.exports=n.p+"39b91170d9f2309e4c5e.mov"},988868:function(e,s,n){e.exports=n.p+"15aad6b83736f221e23b.mp4"},554355:function(e){e.exports="/assets/fb70c6325a7d728cb6d0.png"},991989:function(e,s,n){e.exports=n.p+"48ad19e80083bee682d2.webm"},787462:function(e,s,n){e.exports=n.p+"a476863d4f441618840f.mov"},635507:function(e,s,n){e.exports=n.p+"87c3abd90e246db4b38a.mp4"},470794:function(e){e.exports="/assets/7df11a68a272724be266.png"},886777:function(e,s,n){e.exports=n.p+"b235c36699192662a3fe.webm"},588705:function(e,s,n){n.d(s,{R:function(){return f}}),n(411104);var t=n(200651),a=n(192379),l=n(442837),r=n(481060),i=n(388905),u=n(686546),o=n(925329),c=n(372769),m=n(726745),d=n(973616),I=

Chrome Cache Entry: 181

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1232)
Category:	downloaded
Size (bytes):	11667
Entropy (8bit):	5.447742211537145
Encrypted:	false
SSDEEP:	96:oTwUTwJTwcUqMJ5DdEQwS1skjTOfRr8LCz35Re5mvtgCsXe5oEMQZOCKHnx/IJ:vz6cCrDYtkjERr803eoVNhZKHnx/0
MD5:	CC77F9605614F59A3D781DEA26C64E22
SHA1:	50CA0E2F95486ABD9B7BAC468329B2A4976BB2C1
SHA-256:	93C2B5B58DEE027B6A8FFDCCC0696B8194E16BE6A57BDB08C3FD356C12AB82BD
SHA-512:	45F37FD66B9B8E1177DE16FA482DC2387104EC5EDC9E7E424974EDE72B7D1E4BC1A2B7C26954A840B2D48EB1A6F447789654D8256A925F959F9BB475CDF845C1
Malicious:	false
URL:	https://discord.com/invite/privatecommunity
Preview:	<!DOCTYPE html>.<html>.<head> <meta charset="utf-8">. <meta content="width=device-width,initial-scale=1,maximum-scale=3" name="viewport">.<meta name="description" content="Check out the .............. .......... .. community on Discord - hang out with 2638 other members and enjoy free voice and text chat." />.<meta name="twitter:card" content="summary_large_image" />.<meta name="twitter:site" content="@discord" />.<meta name="twitter:title" content="Join the .............. .......... .. Discord Server!" />.<meta name="twitter:description" content="Check out the .............. .......... .. community on Discord - hang out with 2638 other members and enjoy free voice and text chat." />.<meta property="og:title" content="Join the .............. .......... .. Discord Server!" />.<meta property="og:url" content="https://discord.com/invite/privatecommunity" />.<meta property="og:desc

Chrome Cache Entry: 182

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4246
Entropy (8bit):	4.103696787604314
Encrypted:	false
SSDEEP:	96:K9F4GfkbfNyN48/E8jfsrKk1Z/eO4oSgT3I/VcbQokvBD:KnqbfQ48/BfsrKYZ/eOBe9FJD
MD5:	DDA77F765068E4450D3545A40B777663
SHA1:	63AE45EF489734D09D3AEA98E016C0DD1BC733F9
SHA-256:	A644A9364BE96AD0A72F8E24397322B4D0646563A11E8FF76191A9239A561AC9
SHA-512:	D88521109D4AC8EA200F644973A7A554C1A6B8E0AE4658C7F0E3FAFBEE40A1CB8A6A75BECB2A49AE3B8D226BEE36CD8CA63B492FABC2BF034D6A295349567946
Malicious:	false
Preview:	<svg width="124" height="24" viewBox="0 0 124 24" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#a)"><g clip-path="url(#b)" fill="#fff"><path d="M26.242 2.01A25.218 25.218 0 0 0 19.851 0a18.718 18.718 0 0 0-.819 1.701 23.45 23.45 0 0 0-7.083 0A18.2 18.2 0 0 0 11.121 0a25.13 25.13 0 0 0-6.396 2.015C.68 8.132-.417 14.097.132 19.978c2.682 2.005 5.282 3.223 7.838 4.02A19.514 19.514 0 0 0 9.65 21.23a16.507 16.507 0 0 1-2.644-1.287c.222-.165.439-.337.648-.513 5.098 2.386 10.636 2.386 15.673 0 .211.177.428.348.648.513-.839.505-1.726.939-2.649 1.29A19.432 19.432 0 0 0 23.004 24c2.558-.797 5.16-2.015 7.843-4.022.643-6.817-1.099-12.728-4.605-17.968ZM10.343 16.361c-1.53 0-2.785-1.43-2.785-3.17 0-1.741 1.228-3.174 2.785-3.174 1.557 0 2.812 1.43 2.785 3.174.003 1.74-1.228 3.17-2.785 3.17Zm10.293 0c-1.53 0-2.786-1.43-2.786-3.17 0-1.741 1.228-3.174 2.785-3.174 1.557 0 2.812 1.43 2.785 3.174 0 1.74-1.228 3.17-2.785 3.17ZM41.629 6.122h6.652c1.603 0 2.958.257 4.069.767 1.109.51 1.94 1

Chrome Cache Entry: 183

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7029)
Category:	downloaded
Size (bytes):	7078
Entropy (8bit):	5.693672087902241
Encrypted:	false
SSDEEP:	192:EDHGzBioMyirXyf70li//fZc8Twtv1T5aLdMu951f54aH8L:EDmlioLirXyfYlw/xHWOyuB+acL
MD5:	45A3EE5FF96BDB2DD7FBB2846B5EA494
SHA1:	795E2BB4E00AB75A91BDBA9A4C7D9E2B2E0CD905
SHA-256:	08F280458FAB95C2E5754187C406458A8FE69A1C12329C8EF6CB801067E00BB6
SHA-512:	D545E8F9FE857A5A3AC908E1CCDA13ADCD19EFA78AE34143BCB36080C228090B8C5AE446EFE51C4A87A22BD9403B6E851219B331274D8929EB20AF81E9B159F8
Malicious:	false
URL:	https://discord.com/assets/1bab9b095996b8d024ce.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["43222"],{340618:function(r,t,o){var e=o(354848),n=String,c=TypeError;r.exports=function(r){if("object"==typeof r\|\|e(r))return r;throw c("Can't set "+n(r)+" as a prototype")}},442975:function(r,t,o){var e=o(936940);r.exports=!e(function(){function r(){}return r.prototype.constructor=null,Object.getPrototypeOf(new r)!==r.prototype})},33995:function(r){r.exports={IndexSizeError:{s:"INDEX_SIZE_ERR",c:1,m:1},DOMStringSizeError:{s:"DOMSTRING_SIZE_ERR",c:2,m:0},HierarchyRequestError:{s:"HIERARCHY_REQUEST_ERR",c:3,m:1},WrongDocumentError:{s:"WRONG_DOCUMENT_ERR",c:4,m:1},InvalidCharacterError:{s:"INVALID_CHARACTER_ERR",c:5,m:1},NoDataAllowedError:{s:"NO_DATA_ALLOWED_ERR",c:6,m:0},NoModificationAllowedError:{s:"NO_MODIFICATION_ALLOWED_ERR",c:7,m:1},NotFoundError:{s:"NOT_FOUND_ERR",c:8,m:1},NotSupportedError:{s:"NOT_SUPPORTED_ERR",c:9,m:1},InUseAttributeError:{s:"INUSE_ATTRIBUTE_ERR",c:10,m:1},InvalidStateError:{

Chrome Cache Entry: 184

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 43364, version 3.131
Category:	downloaded
Size (bytes):	43364
Entropy (8bit):	7.995499053027601
Encrypted:	true
SSDEEP:	768:fQelRMAMlg6keZjHGyL9BFjYBuukYbpX4Qb0NJ4rLU7KoYVZ:fQeTWlg6kON8cubbpIb+ggf
MD5:	281BBA49537CF936D1A0DF10FB719F63
SHA1:	4085AD185C5902AFD273E3E92296A4DE3DC19EDD
SHA-256:	B78FB569265B01789E7EDD88CFE02ECB2C3FEE5E1999678255F9B78A3B2CC4E8
SHA-512:	AF988371DB77831F76EDF95A50B9DDF1E957F0230404C8307914F11211E01CC95C61E0768D55AA4347F24E856D226F7E07AC21C09880E49DBD6346D1760B8BFF
Malicious:	false
URL:	https://discord.com/assets/8234e0a75aa9afb205bd.woff2
Preview:	wOF2.......d.......8..............................x...@..\.`..X..>...........".6.$........ .....K...[.q...c...5.nC...U....?...q.zn.<..-...a..C..J;..8.....s......M.@5.u.F....).'.N..9{U.'..u...\|.;W....gz;m.o..&A.....o.........Vm/....a.VNF......T/$..iM......".J(...:.F1.x.}.F....%..Xb.3d%....)Yv..'.th..}..&......k.f..%'..i=@..p..wr.<.i.;...c...13..........i....{.F...&{.....A.]....-...?.....<.....J?.9B.&.f.d.).T...S.. n...g7N...w.=...\|.!......b..s.........qI<F:...p...y...2.h.+1L.,.mG\..4.E%+r...........o#7F..H.-.h..R..EXdHY.......(....-J....Mg..%m.5I....]rQo.$M..m..m...dL.m.n.~....clT.m..=.(..3....Cz..p........k...dF?......s...rQ.)}....LS....}._.5......z.....P.B$.T.D..OX.r.5..-1.H..pD..L../.........'....&'\.T.N...........-.}J..Z....y.d!t..#....@.].!P5..S.`.A.`....E.y...k..*d.......p..O.H.7...P...q......4.....U.Y2.w4..E. Y]$Y.R...x.=..+...T7.-O..yH.0/.&....E.q1[.uOO[..=\Q"...,..W\q1\a..).......`acasaacc4s...XXX....e..v.-N.oh)...E%..D......#..CL

Chrome Cache Entry: 185

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.460750616283363
Encrypted:	false
SSDEEP:	3:YGKjl8jwDEYRrajpHV+wJ6ARORzACDEYkayjY6v:YGKjDRrajpHV9LorMcE
MD5:	30B15D37E2F2C6C09F35BCC56B64571A
SHA1:	A5566ADA13410C39A4059BEC0FF59D51316D89CD
SHA-256:	BE58D93E5BC2C48B3FB9C87BD7140109630195E84CCE67701FCCABCF5256BFE0
SHA-512:	EE8E8192B3120D7A2FC9DCE3585D87FAAF689B2E03046C8B7F533FE3CBA408BF0E8614CA2AACD6ED21A206B4B461ECA507D5B38D01839CA9AC5B93971D1F7B10
Malicious:	false
Preview:	{"consent_required":false,"country_code":"US","promotional_email_opt_in":{"required":false,"pre_checked":false}}.

Chrome Cache Entry: 186

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5552)
Category:	dropped
Size (bytes):	5601
Entropy (8bit):	5.7655360019382895
Encrypted:	false
SSDEEP:	96:2XobeWK+r3kiJfaaLUmbybQSfuaVRbm0HMgFfgWuAyEdVAmefr4/8VZPUGky:qobvfaa9DSfXDbXMaYPAyEdLefr4/YMe
MD5:	13FF42A071C43FA5521C11EB2F2EA914
SHA1:	B97D6318B384D57DEFD41EC4DEBF9D7DE198537C
SHA-256:	6B8776086567649C2432023184979BB8244A268C081FC1D478D834BF50A169F9
SHA-512:	F38C1D3760B23A65EACDB8214424227BDFE638C4A86E6DB89D8D86E29A820060165583FB7794E77935E52B62A6FE09567FC71FB44986D0FBD473F54DEBC56202
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["46369"],{438820:function(e,t,n){var i,a=n(442837),c=n(570140);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}let s={canPlayWowMoment:!1,isFetchingWowMomentMedia:!1,wowMomentWumpusMediaUrl:null};class d extends(i=a.ZP.PersistedStore){initialize(e){null!=e&&(s=e),s.canPlayWowMoment=!1,s.isFetchingWowMomentMedia=!1,s.wowMomentWumpusMediaUrl=null}getState(){return s}get canPlayWowMoment(){return s.canPlayWowMoment}get isFetchingWowMomentMedia(){return s.isFetchingWowMomentMedia}get wowMomentWumpusMedia(){return s.wowMomentWumpusMediaUrl}}o(d,"displayName","PurchasedItemsFestivityStore"),o(d,"persistKey","PurchasedItemsFestivityStore"),o(d,"migrations",[e=>({...e})]),t.Z=new d(c.Z,{LOGOUT:function(){s={canPlayWowMoment:!1,isFetchingWowMomentMedia:!1,wowMomentWumpusMediaUrl:null}},PURCHASED_ITEMS_FESTIVITY_SET_CAN_PLAY_WOW_MOMENT:functi

Chrome Cache Entry: 187

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (28804)
Category:	dropped
Size (bytes):	28805
Entropy (8bit):	4.499383148508616
Encrypted:	false
SSDEEP:	384:40ELbA31CcPtMjBuvLTBrqDoiba+h3pjeuOXPRTpCLhuYNWGLk:40f3ku3UDbzU9JYcOLk
MD5:	72BD72A7C74DD581FF8ABCD04A511975
SHA1:	0EF2F09F057D9D4D6BC9669E4D26406E57A70319
SHA-256:	EF25E951849699739DB0D01D5B92B0FBFDAB36129340512DC73ED2B0ED88D890
SHA-512:	C61DACE657303FCB732D1688A6C2530E3B6525F4EBBCB7A9692BBFE4972D8DDE348B1240CFDFBE9514339449E201345517073AA55754D586C343428230ECCD80
Malicious:	false
Preview:	{"fingerprint":"1298907944330723329.t6tc3XD8aO1_VPYaKqCI_v6B110","assignments":[[2810205487,1,1,-1,3,107,0,0],[2617218444,4,1,-1,2,2478,0,0],[3035674767,0,1,-1,0,469,0,0],[1609782151,0,1,-1,2,5123,0,0],[3643362751,0,1,-1,0,7964,0,0],[3753034466,1,2,-1,0,6998,0,0],[1913882179,0,1,-1,2,1531,0,0],[1567199723,0,1,-1,1,5684,0,0],[454783470,4,1,-1,0,3776,0,0],[3450899088,1,1,-1,0,5463,0,0],[3656796460,3,3,-1,3,8695,0,0],[1814483290,0,1,-1,0,4340,0,0],[4221006726,0,1,-1,0,8390,0,0],[1398673921,1,1,-1,0,2735,0,0],[2532700533,0,1,-1,0,4469,0,0],[3557480712,0,1,-1,0,8664,0,0],[853403133,4,1,-1,0,2340,0,0],[2491005019,4,1,-1,0,7485,0,0],[3889077804,2,1,-1,0,589,0,0],[4079214319,2,1,-1,0,7441,0,0],[1034661306,0,1,-1,0,3013,0,0],[828251710,2,1,-1,1,8264,0,0],[3124003316,1,1,-1,0,1743,0,0],[2676348506,0,1,-1,0,4310,0,0],[4136574802,0,1,-1,1,9767,0,0],[4049571159,0,1,-1,0,1059,0,0],[3182051840,0,1,-1,0,4871,0,0],[2539540256,0,1,-1,3,3457,0,0],[3991298449,2,1,-1,2,9964,0,0],[472975400,6,1,-1,0,7323,0,

Chrome Cache Entry: 188

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 45868, version 3.131
Category:	downloaded
Size (bytes):	45868
Entropy (8bit):	7.995149406203617
Encrypted:	true
SSDEEP:	768:7T3lyZzszaXGZG8vNh620Ph+EdGcNo3ITx62hw4oZkha6UK5+Ubp7tSSC5Zn/pf8:7TVyZwzQZ8vNd0Ph9/Nuo6GPUK5+UbJz
MD5:	D295C40AF6FCA08F8E0EB5425351F431
SHA1:	1D246A1E54B3A1F2428883D8C911AF73EDDFFCA6
SHA-256:	5D225B25D66B30563A00F395476ED701130D3F749620A63531CEA09FC537164E
SHA-512:	9C9F23CB775244EB10F83F964B36224AD2CD5152CFA5AB82928F68ED1CB49BE4156F887CC40A857B72EFD0833014E4366BF136689A717DD58828A1B195ED486E
Malicious:	false
URL:	https://discord.com/assets/8bd8143eff37936894aa.woff2
Preview:	wOF2.......,......................................x......\.`..X..@........T..@.6.$........ ..a..K..x[T...5...(..V.M..m...{.9....s49..ybj.......>}.m......O&r.%.T..Q....5.43.yD..u.%.S.w^.B....1p\|b2..g...Wuq.B...2.e~.3..>.I..TLP..c.....c$8..Tle.......U:6Wl.=.....U..V............W .iH8..7...r..~.eo.A......8..T.`.o........&.L".o.E..v....+B...N"].p...d [ ..Z_.w....s....L......,.E..=+.y3l...-......K..5..6....~.r.f..5D..U\|W.$...n.f.(6..j.\|....B...]..-....]"..5..[g.B..[s..% .[/.D..m.../...U}d....T.<....b......\|..Fc..K..2Y..pb}m\..p.....:.hn.6$F..F..1"E*.h+......&5r..(...\|\|g.N\T.....I.4KD[U.^V..y.{.n%j3.k.....E%...@...<(j.......O....K...0 L...QD.......Q.xzQ...[Y..".1F..1j0F...C.."e.i.wN/<.(...k.".++....`........UW.K3.......}...u+I%........y.o.v.ym....D\|f2.cWr@...l;.L.Y..~.&..g.... b[......j..I.i.H.{4n....s.y.`_v7..,...Z...".S.t.J3.[...t+.'b..F.6...Q`.!..B...N.0L.,<.:>......:@.SP..9@2.....rvr0.oJ,.5..p'..V.Js@.....L..%[.%#=.y3.\|..V.fa.m;).....G....._

Chrome Cache Entry: 189

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2701)
Category:	downloaded
Size (bytes):	2750
Entropy (8bit):	5.460366645013334
Encrypted:	false
SSDEEP:	48:F0fzk02vWrc1AKTMSTEcr9rTOLBsmPBo/6XgpdgwrIsi5dEk+MQwq2kWkGRv6hvr:ek02hfMXcKs+lXyisi5CkiPrWk+Ch/Ew
MD5:	390A7AB1F964AA8CB1B87DD13732C3BC
SHA1:	CEA52AC6FA0CDF49A18D51C8CD8A5C4FB52DEAC9
SHA-256:	BEDD382930BA4E10DFA902BF833195911F82E754223441446E9D7CC45B01110F
SHA-512:	4B799488E35C5B933E9B1BA6AB335E2EAD6D625D3DC1FEC19DD80F48B9B7996171BEC24513095F3F1BAA9C8B7675FA4E527B763AEED26B69273BF2DCED014D3F
Malicious:	false
URL:	https://discord.com/assets/29a63f12209c956d9204.js
Preview:	(()=>{"use strict";var t={137920:function(t,r,n){var e,i;n.d(r,{J:function(){return u},z:function(){return e}}),(i=e\|\|(e={}))[i.NONE=0]="NONE",i[i.SOCIAL=1]="SOCIAL",i[i.CASUAL=2]="CASUAL",i[i.COMPETITIVE=3]="COMPETITIVE",i[i.CREATIVE=4]="CREATIVE",i[i.VERY_HARDCORE=5]="VERY_HARDCORE";let u={0:"NONE",4:"NONE",1:"CASUAL",2:"CASUAL",3:"COMPETITIVE",5:"COMPETITIVE"}},945124:function(t,r,n){n.d(r,{y:function(){return i}});var e=n(137920);function i(t,r){let n=0;return null!=r.games&&(n+=2r.games.filter(r=>t.games.includes(r)).length),null!=r.playstyle&&(r.playstyle===t.playstyle?n+=2:e.J[t.playstyle]===e.J[r.playstyle]&&(n+=1)),null!=r.traits&&(n+=2Array.from(r.traits).filter(r=>t.traits.includes(r)).length),n}},866762:function(t,r,n){n(312677);var e=n(945124);self.addEventListener("message",t=>{var r,n;let{data:{unsortedClans:i,id:u,criteria:o}}=t;let a=(r=i,n=o,r.map(t=>({...t,affinity:(0,e.y)(t,n)})).sort((t,r)=>{var i,u;let o=null!==(i=r.affinity)&&void 0!==i?i:(0,e.y)(r,n);return o-

Chrome Cache Entry: 190

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	168789
Entropy (8bit):	5.612789333447181
Encrypted:	false
SSDEEP:	1536:lvVvKVPI1oqgO/usjA1vkY0JCxf7UG/9rHUQNbsbkb5a05VGOEc2+hzuy6fvxO7a:uVPIgPvEc7N/9rNhbYy6w7XvXcZ
MD5:	3B74671903D935A08DC04ACEF440C188
SHA1:	7B2C8D8AE72E5E2DA1BA4440722810565E11084C
SHA-256:	4AC4D0F31456B9D1741A52E5C54089952219E0C2287D83B81F12C94468DB3B03
SHA-512:	7F465558B1D640EEC9639921A70C0C0A9AE8BD7F95D0EE098B0553A7B84C5B983A9140FA48C45453FD8E39FAB7188000A2A0628300C4CEF9FE3F2742C20F1C62
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["41315"],{863942:function(e,t,n){var s=n(22092);(0,n(192291).exportTypedArrayStaticMethod)("from",n(12367),s)},70519:function(e){e.exports="/assets/76a4af59aa173c519461.svg"},806848:function(e){e.exports="/assets/6183fdc13d8046fd5bda.svg"},512266:function(e){e.exports="/assets/a2d51a24d014f52f83a6.png"},105020:function(e){e.exports="/assets/89ea0e62d0f8ffa67a17.svg"},211095:function(e){e.exports="/assets/86755fd1deda5cb45518.svg"},640356:function(e){e.exports="/assets/3880dc73d6be9d91ef36.svg"},515695:function(e){e.exports="/assets/450a761db3bfe89ca9b9.png"},892235:function(e){e.exports="/assets/48f03d965f1e82275006.svg"},375673:function(e){e.exports="/assets/3cf7f333e815240d3294.svg"},73962:function(e){e.exports="/assets/ed7318a94c14ce41d11d.svg"},689411:function(e){e.exports="/assets/831c999494cb5e095eae.svg"},2984:function(e){e.exports="/assets/0e5029fd9cd4812b6712.svg"},575703:function(e){e.exports=

Chrome Cache Entry: 191

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	24565
Entropy (8bit):	6.000976601202208
Encrypted:	false
SSDEEP:	384:xakxHbO0x9ipfSEuH44B445H44Q544Aq44Q4P44ZF944Q4Q4424Qb444nxWl444p:xZxH5ripqEuH44B445H44Q544Aq44Q4+
MD5:	EC2C34CADD4B5F4594415127380A85E6
SHA1:	E7E129270DA0153510EF04A148D08702B980B679
SHA-256:	128E20B3B15C65DD470CB9D0DC8FE10E2FF9F72FAC99EE621B01A391EF6B81C7
SHA-512:	C1997779FF5D0F74A7FBB359606DAB83439C143FBDB52025495BDC3A7CB87188085EAF12CC434CBF63B3F8DA5417C8A03F2E64F751C0A63508E4412EA4E7425C
Malicious:	false
URL:	https://discord.com/assets/favicon.ico
Preview:	............ .h...F... .... .........00.... ..%..V......... ..$...:..(....... ..... ..........................................dX2.dX..dW..dW..dX..dX..dX..dX2.........................dW..dW..dX..eX..eX..eX..eX..eX..eX..dW..dW..dW..............dW..dX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eW..........dW..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eW......dX2.dW..eX..eX..\|q......eX..eX..eX..eX......\|q..eX..eX..eX..eX2.dW..eX..eX..........................................eX..eX..eW..dW..eX..eX..........................................eX..eX..dW..dW..eX..eX..............eX..........eX..............eX..eX..dW..dW..eX..eX..........................................eX..eX..dW..dW..eX..eX..~s..................................~s..eX..eX..dW..dW..eX..eX..eX..................................eX..eX..eX..dW..dX2.eX..eX..eX..h[..........{p..{p..........h[..eX..eX..dW..eW2.....dX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eW..........eX..dX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eW..e

Chrome Cache Entry: 192

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8712)
Category:	downloaded
Size (bytes):	8761
Entropy (8bit):	5.595354119822134
Encrypted:	false
SSDEEP:	96:7YoXmoXiURhBU9QCy4WqAVMF+FW91nuFua4MDeTVPpz6jid6ftysD9g9u6EPaLil:7YoXmoXE9xUFEuTKt2lyLkTp/os
MD5:	102FE4FDEC4447C9891C9F3FAEAE0474
SHA1:	3FA3BAF1DCED3A39DF8599BEEFA5180B436A782C
SHA-256:	E45508538EE1AB34F520303F7D1A9A7F5CB5D99FF34CE7E5EB64EB32EF6F19F9
SHA-512:	97942EEC44A5F613A45A514E355F26EC3B2458BA497009D4D70D88FF3562C94212DFB424AF0CE37BE880F3528446B28BBAB6F77C2717F0C16BF1317AFBC030D4
Malicious:	false
URL:	https://discord.com/assets/d86788be99e870993214.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["18543"],{725436:function(e,t,n){n.d(t,{m:function(){return u}});var s=n(454585),a=n(551452),l=n(532901);let r={...s.Z.guildEventRules.link,react:(0,l.Z)({enableBuildOverrides:!1,mustConfirmExternalLink:!0}).react},i={...s.Z.guildEventRules.channelMention,react:(0,a.Z)({enableBuildOverrides:!1,shouldCloseDefaultModals:!0,shouldStopPropagation:!0}).react},u=s.Z.reactParserFor({...s.Z.guildEventRules,link:r,channelMention:i})},315416:function(e,t,n){n.d(t,{Z:function(){return i}});var s=n(192379),a=n(442837),l=n(897285),r=n(924301);function i(e,t,n){let i=(0,a.e7)([r.ZP],()=>r.ZP.getUserCount(t,n));return(0,s.useEffect)(()=>{null!=e&&null!=t&&l.Z.getGuildEventUserCounts(e,t,null!=n?[n]:[])},[t,e,n]),i}},405613:function(e,t,n){n.d(t,{Z:function(){return l}});var s=n(134432),a=n(981631);function l(e,t){let n;if(null==e.image)return null;null==t&&(t=window.screen.width*(0,s.x_)()),t=(0,s.oO)(t);let l=window.

Chrome Cache Entry: 193

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7679)
Category:	dropped
Size (bytes):	7728
Entropy (8bit):	5.087323529198084
Encrypted:	false
SSDEEP:	96:wgSRVk6Wg8lh4Nrviiv1aWPRkDhTt9qwqSBtxCMNMRV0IBSAMD9C+m+rmxARJx3t:RSRVmriLDPRkxtRJxNMRV0IZdSL9ilfA
MD5:	1C6B9D0AD743762986197AE0E81874C1
SHA1:	EABACE4131BA74B108FC891EA843B4F85B218808
SHA-256:	2D739091F602476FCF261435B48A1FAFCE2533564FFF0549D27B47E341B4DCBF
SHA-512:	74FDE9F8997087BB107ED5DDC3A4A37BD24793CAAD605FBDCDD54E9D18AF8F44D0C0E92FB2259AA936BD1B20D5537441EF39D9A7F066323911436184B0138111
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["75492"],{849146:function(t,e,n){var r=function(){if("undefined"!=typeof Map)return Map;function t(t,e){var n=-1;return t.some(function(t,r){return t[0]===e&&(n=r,!0)}),n}return function(){function e(){this.__entries__=[]}return Object.defineProperty(e.prototype,"size",{get:function(){return this.__entries__.length},enumerable:!0,configurable:!0}),e.prototype.get=function(e){var n=t(this.__entries__,e),r=this.__entries__[n];return r&&r[1]},e.prototype.set=function(e,n){var r=t(this.__entries__,e);~r?this.__entries__[r][1]=n:this.__entries__.push([e,n])},e.prototype.delete=function(e){var n=this.__entries__,r=t(n,e);~r&&n.splice(r,1)},e.prototype.has=function(e){return!!~t(this.__entries__,e)},e.prototype.clear=function(){this.__entries__.splice(0)},e.prototype.forEach=function(t,e){void 0===e&&(e=null);for(var n=0,r=this.__entries__;n<r.length;n++){var i=r[n];t.call(e,i[1],i[0])}},e}()}(),i="undefined"!

Chrome Cache Entry: 194

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 39724, version 2.66
Category:	downloaded
Size (bytes):	39724
Entropy (8bit):	7.994965715436545
Encrypted:	true
SSDEEP:	768:w35mZVsqT7RAo+6tbgLdolT9YSswcTWa+O/dm8ae41u37qt+:1xTO3kb0dolT998WhO/Hae4jt+
MD5:	FF5ECCDE83F118CEA0224EBBB9DC3179
SHA1:	0AD305614C46BDB6B7BB3445C2430E12AECEE879
SHA-256:	13DA02CE62B1A388A7C8D6F3BD286FE774EE2B91AC63D281523E80B2A8A063BC
SHA-512:	03DC88F429DD72D9433605C7C0F5659AD8D72F222DA0BB6BF03B46F4A509B17EC2181AF5DB180C2F6D11C02F39A871C651BE82E28FB5859037E1BBF6A7A20F6B
Malicious:	false
URL:	https://discord.com/assets/b21c5111a12372139409.woff2
Preview:	wOF2.......,......\|P.......B............................. .`..P..@..W........<.6.$..`..r.. ..<..F..`[pVq..w.SI..+.S.f;dS.i.. C.bj.6..w;./......OM&..[.mo-......4F`...SeR.XzP.g..j..L.....S.T(a..y.D...od./).....\|l...zn...T..OpZP....c\....%.H..y..g.!..!..\|._........O._.[.nJS..]..H....rd..#.?.n#.B.w.w...":.u...\|.a..#.#N...q.z.Z.....".5...X...3\|O...8>......(...H....M\|.w.o.%.%..\|5.'L.a.N.) ..G`.(1.je.#.~_.......!...7.e.......s.\.`G.^...h.B....tR.N..+"xU....3.F}0....z...@^..iB^....u&....._{.$]..........8k....?.c...^.~...A2...T.$.i.....Ycx!b~.x...3:g.[.!.X...fgt.duf.....uZW!....y..(].$.If_....g69.Ef.'{.ndC..Yt6...;..\..M......E'.^I....rFJ..)1\|...q......!.m~......../M.........7!I.E...U..!"....:...T9{!=.+... ..es2.2.%.Ll.t.j.D .p..<...$.....%...IB"'..#H.D............;OWk..G.Y.V....\&.U{.V....N.h....S[Yg(......f..Uu......z2.(.r..3...,-...G....c.9^"..:..>.......Q....S......]D'.,.@4..w./S.ep`...].sGR....Vc.j...-.\|..}_...&.eg.G..e.u...(./S..+H.'.9\.k%..

Chrome Cache Entry: 195

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	14624305
Entropy (8bit):	5.854943527266922
Encrypted:	false
SSDEEP:	196608:r6lXgFXaYzjupIEtYW4sZoymJBkD/skskv:rXXaYzjupIEtYW4sZ9mJBkDks
MD5:	216CB783D60A3E7C57C9D9FFEA99DC3F
SHA1:	C645D044161C447B84CBA1E62FCB018B5A7D6066
SHA-256:	48D0B669FD29BF3D5A6552EBD89B2048FBB6D58F824E8DD1F92772AC5821D716
SHA-512:	54F12CC52FBCAE1DF1575969CD269E75795B6D469B2C5CB0854D5A242A9A460CFBC8A9C9DCBDF4A7B7CEBC9EEC2EFC54A714C9CB6DB68974173DA2AC4E01E84B
Malicious:	false
Preview:	(()=>{var e={385007:function(e,t,n){var r={"./de.jsona":["644753","30244"],"./zh-CN.jsona":["494062","56446"],"./da.jsona":["44867","57387"],"./el.jsona":["581144","55601"],"./tr.jsona":["146878","84385"],"./es-ES.jsona":["872550","45747"],"./hr.jsona":["403530","29924"],"./cs.jsona":["753771","87233"],"./fi.jsona":["554545","7402"],"./es-419.jsona":["39227","59729"],"./ja.jsona":["516722","7728"],"./pt-BR.jsona":["246297","394"],"./ro.jsona":["37190","53269"],"./sv-SE.jsona":["335417","11193"],"./ru.jsona":["809464","12611"],"./vi.jsona":["139107","45576"],"./id.jsona":["492248","77800"],"./it.jsona":["515630","78670"],"./uk.jsona":["167111","58548"],"./lt.jsona":["877749","44754"],"./pl.jsona":["477384","60878"],"./hu.jsona":["107425","98570"],"./nl.jsona":["432763","41588"],"./th.jsona":["182260","49827"],"./bg.jsona":["251927","20575"],"./fr.jsona":["570173","99450"],"./zh-TW.jsona":["592369","30684"],"./hi.jsona":["629869","22732"],"./en-GB.jsona":["569249","99339"],"./ko.jsona":[

Chrome Cache Entry: 196

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 137140, version 2.459
Category:	downloaded
Size (bytes):	137140
Entropy (8bit):	7.998481140044296
Encrypted:	true
SSDEEP:	3072:kX89D4n2tV29WN9z2uXw/hqzr7IbI1O1KfB9Bk8WnRSqv2WDc+FC5:kn2tS/IzXIbIo1KZWUqv2W8
MD5:	F9BF0F65660D23C6F359D22720FC55AE
SHA1:	9FA19AB7EA56165E2138C443816C278D5752DD08
SHA-256:	426AE06CD942849AB48B84C287C760F3701B603EBCC5C9AAA4A89923EF5F058E
SHA-512:	436019A96E47848533684A34E3C360F516C29B2AA2473D0A05D50C0FD3AD19EAC39DF2DE12B6EC1C6760493EFB5ABF58E6A54D32080226FA1765983435634D88
Malicious:	false
URL:	https://discord.com/assets/f5b8aa3411dfc24ff2e6.woff2
Preview:	wOF2..............0....U..........................f........`........$..U.6.$..T..X.. ......[..[.;......w.N....ZjU...]".u..$.k..<..1...3@i...6.I.X......@ydf.h#..................{I~<:..I..C_........#.]7i..q[.+PF.U...x.......1..b..31Va....aB......n.V..&.Q.3cc.L...1f6.-:x.G..`EE.....r ......6..r..F.u..<\|..aEX.V......c.L.,....RX....V....FQ.u..q.^.{q.]#.y..I.....19c$..j...k...W.......+.....H.dy....-.c.....X<<.....@.Q=.........:....+....F..z.K..Y..{t..{..p..".I......M.X\|t........}......nk42...S\.....$H...0...m......#f>EU..-z.k\|.. ..Y.'..;<?.......S.C...............weU"...ES.2.>.%...O..q.@....F...0.aR.F\|[a..Vq...z\|HQ_m-j.3x1.XX.p...T./...z.p\|..<-...%;Fx.....8CG&d..FQ.{.'..1...1#7..a?.;.G.....~U..4.F.....Q.f...3..t:.~..o};"+...O....>D.x)%.. .O:.x.`N..]..uG.....C.!......%z..g...ZT.p.........5.......@!.S#/6$.k%..]...b=. $0gOC.]G\..lU....DH...(..;.e.B.!GH.5.eY.eY...-.m.....\..&.KYF3...-..........-......d..V.&w..... ..{..C.SZ...p)...d.w,...<....}.@

Chrome Cache Entry: 197

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18413)
Category:	dropped
Size (bytes):	18462
Entropy (8bit):	5.313916053766187
Encrypted:	false
SSDEEP:	384:r0Q0mLG04pG+rx1GoKoLItuPVMWpUdq3FYbNbeka5xeWoY/La0WMTUbbbutFY/GU:r0PmLGTGGDGoRstuKFNCQ/ORQL
MD5:	DC15D17D50A8A78E8C593E27FA1EAF57
SHA1:	42BD0149308EEBA00FF841AC13E5AB6DC7659513
SHA-256:	FFE3FB22E7E5528DA94902D66D2C834C448E7AC03896B63886E08CECCFC26A35
SHA-512:	4FF0AF46A6E692365F6037AD1778652A05401DBF3C2C042BF75B3AED44F37D642D63967FE65720176B3513E2791DC1DF9C784D0C9A3C2BF380832B4216569A5E
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["20011"],{482682:function(t){t.exports="/assets/ebb5b41de823fbc19d12.png"},450125:function(t){t.exports="/assets/1e4932a7afbb1fcdba2d.png"},733949:function(t){t.exports="/assets/e1ce6b38901837435ec5.png"},877604:function(t,i,e){e(411104);var s,n=e(200651),h=e(192379),a=e(120356),r=e.n(a),l=e(111543);function o(t,i,e){return i in t?Object.defineProperty(t,i,{value:e,enumerable:!0,configurable:!0,writable:!0}):t[i]=e,t}let d=t=>new Promise((i,e)=>{null==t&&e(Error("No image src passed"));let s=new Image;s.src=t,s.onload=()=>i(s),s.onerror=t=>e(t)});class u extends(s=h.PureComponent){componentDidUpdate(t){t.src!==this.props.src&&this.setState({loaded:!1},()=>this.initialize())}initialize(){d(this.props.src).then(()=>{!this.unmounting&&this.setState({loaded:!0})})}componentWillUnmount(){this.unmounting=!0}render(){let{className:t,src:i,alt:e,width:s,height:h,onLoad:a,style:o,imageClassName:d}=this.props,{lo

Chrome Cache Entry: 198

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18413)
Category:	downloaded
Size (bytes):	18462
Entropy (8bit):	5.313916053766187
Encrypted:	false
SSDEEP:	384:r0Q0mLG04pG+rx1GoKoLItuPVMWpUdq3FYbNbeka5xeWoY/La0WMTUbbbutFY/GU:r0PmLGTGGDGoRstuKFNCQ/ORQL
MD5:	DC15D17D50A8A78E8C593E27FA1EAF57
SHA1:	42BD0149308EEBA00FF841AC13E5AB6DC7659513
SHA-256:	FFE3FB22E7E5528DA94902D66D2C834C448E7AC03896B63886E08CECCFC26A35
SHA-512:	4FF0AF46A6E692365F6037AD1778652A05401DBF3C2C042BF75B3AED44F37D642D63967FE65720176B3513E2791DC1DF9C784D0C9A3C2BF380832B4216569A5E
Malicious:	false
URL:	https://discord.com/assets/89b7ddebcacbe8dfbd3a.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["20011"],{482682:function(t){t.exports="/assets/ebb5b41de823fbc19d12.png"},450125:function(t){t.exports="/assets/1e4932a7afbb1fcdba2d.png"},733949:function(t){t.exports="/assets/e1ce6b38901837435ec5.png"},877604:function(t,i,e){e(411104);var s,n=e(200651),h=e(192379),a=e(120356),r=e.n(a),l=e(111543);function o(t,i,e){return i in t?Object.defineProperty(t,i,{value:e,enumerable:!0,configurable:!0,writable:!0}):t[i]=e,t}let d=t=>new Promise((i,e)=>{null==t&&e(Error("No image src passed"));let s=new Image;s.src=t,s.onload=()=>i(s),s.onerror=t=>e(t)});class u extends(s=h.PureComponent){componentDidUpdate(t){t.src!==this.props.src&&this.setState({loaded:!1},()=>this.initialize())}initialize(){d(this.props.src).then(()=>{!this.unmounting&&this.setState({loaded:!0})})}componentWillUnmount(){this.unmounting=!0}render(){let{className:t,src:i,alt:e,width:s,height:h,onLoad:a,style:o,imageClassName:d}=this.props,{lo

Chrome Cache Entry: 199

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	5.359578028959659
Encrypted:	false
SSDEEP:	24:Y74WU4bejvfkjyDEfXgAh/4ACjsY384W9iiex4grjh:Y741gerKyDEfbftY384Swx4UN
MD5:	E2CD13D6C4B1EF7E464FD22FBC18BA56
SHA1:	478AC70BFFF328092BC4A88898AD5ECB7232AB23
SHA-256:	B48B77DEC8C7D5A0953A7F8F06E363884387239A5A3BF9B9BD63945B68FE3A2B
SHA-512:	53F927063C760D199A8A11733AF3CB821C53BEF30EFAF4D113970CDE2AA6791E1FBED06EB947A707CC4316CAFA799CAE1B88A00280C05C6AE89BBF48C3B84A4C
Malicious:	false
Preview:	{"type":0,"code":"privatecommunity","expires_at":null,"guild":{"id":"1230227842877620359","name":"\ud835\udc0f\ud835\udc11\ud835\udc08\ud835\udc15\ud835\udc00\ud835\udc13\ud835\udc04 \ud835\udc12\ud835\udc13\ud835\udc0e\ud835\udc11\ud835\udc04 \ud83d\udd10","splash":"04b58b5d8c863962ccdac305e5ee1269","banner":"0ada4913f44d405e7a85ad7d492c34fd","description":null,"icon":"a_75aa56a5faded73ac41ce0fac1e7d74c","features":["BANNER","PRIVATE_THREADS","ROLE_ICONS","THREE_DAY_THREAD_ARCHIVE","MEMBER_PROFILES","ENABLED_MODERATION_EXPERIENCE_FOR_NON_COMMUNITY","ANIMATED_BANNER","SOUNDBOARD","COMMUNITY","ANIMATED_ICON","NEWS","INVITE_SPLASH","VANITY_URL","SEVEN_DAY_THREAD_ARCHIVE"],"verification_level":4,"vanity_url_code":"privatecommunity","nsfw_level":0,"nsfw":false,"premium_subscription_count":56},"guild_id":"1230227842877620359","channel":{"id":"1230229306408697856","type":0,"name":"\ud83c\udf10\u30fb\ud835\udc12\ud835\udc08\ud835\udc13\ud835\udc04-\ud835\udc0f\ud835\udc11\ud835\udc08\ud835\ud

Chrome Cache Entry: 200

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7029)
Category:	dropped
Size (bytes):	7078
Entropy (8bit):	5.693672087902241
Encrypted:	false
SSDEEP:	192:EDHGzBioMyirXyf70li//fZc8Twtv1T5aLdMu951f54aH8L:EDmlioLirXyfYlw/xHWOyuB+acL
MD5:	45A3EE5FF96BDB2DD7FBB2846B5EA494
SHA1:	795E2BB4E00AB75A91BDBA9A4C7D9E2B2E0CD905
SHA-256:	08F280458FAB95C2E5754187C406458A8FE69A1C12329C8EF6CB801067E00BB6
SHA-512:	D545E8F9FE857A5A3AC908E1CCDA13ADCD19EFA78AE34143BCB36080C228090B8C5AE446EFE51C4A87A22BD9403B6E851219B331274D8929EB20AF81E9B159F8
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["43222"],{340618:function(r,t,o){var e=o(354848),n=String,c=TypeError;r.exports=function(r){if("object"==typeof r\|\|e(r))return r;throw c("Can't set "+n(r)+" as a prototype")}},442975:function(r,t,o){var e=o(936940);r.exports=!e(function(){function r(){}return r.prototype.constructor=null,Object.getPrototypeOf(new r)!==r.prototype})},33995:function(r){r.exports={IndexSizeError:{s:"INDEX_SIZE_ERR",c:1,m:1},DOMStringSizeError:{s:"DOMSTRING_SIZE_ERR",c:2,m:0},HierarchyRequestError:{s:"HIERARCHY_REQUEST_ERR",c:3,m:1},WrongDocumentError:{s:"WRONG_DOCUMENT_ERR",c:4,m:1},InvalidCharacterError:{s:"INVALID_CHARACTER_ERR",c:5,m:1},NoDataAllowedError:{s:"NO_DATA_ALLOWED_ERR",c:6,m:0},NoModificationAllowedError:{s:"NO_MODIFICATION_ALLOWED_ERR",c:7,m:1},NotFoundError:{s:"NOT_FOUND_ERR",c:8,m:1},NotSupportedError:{s:"NOT_SUPPORTED_ERR",c:9,m:1},InUseAttributeError:{s:"INUSE_ATTRIBUTE_ERR",c:10,m:1},InvalidStateError:{

Chrome Cache Entry: 201

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (35363)
Category:	downloaded
Size (bytes):	35364
Entropy (8bit):	4.4322536273427415
Encrypted:	false
SSDEEP:	384:2rmgxkYCBbfgeUQHJf1CcPtMjBupLTBr3DozAbb2S+h3pjeuOzPRTfZoDpavLhuL:2Tx2Bbn3ku1BVbbqUNJgacuLk
MD5:	2CB2777A4388CE2B906F33EFDBE21552
SHA1:	CA888C355242F6CB0D7641F1EA16BC2D9758F87D
SHA-256:	DDC8CFE49A154F796A4C559AF6C732600B59E6FE887FD36EF880893CAC9EDEC1
SHA-512:	2B1EDEEAE070E8D9739D566CABACF8254914090EE3A7D9811F56F75FD1FE6985823A820B6BFA1B44B5F422CA9135AEC102763E2E5083D1CC5A26AB7488C455CD
Malicious:	false
URL:	https://discord.com/api/v9/experiments?with_guild_experiments=true
Preview:	{"fingerprint":"1298907928115281940.cAYkMt3Px22XYBub5q1myFVn9es","assignments":[[2810205487,1,1,-1,3,7959,0,0],[2617218444,4,1,-1,2,9239,0,0],[3035674767,0,1,-1,0,8380,0,0],[1609782151,0,1,-1,2,4272,0,0],[3643362751,0,1,-1,0,721,0,0],[3753034466,1,2,-1,0,5528,0,0],[1913882179,0,1,-1,2,6194,0,0],[1567199723,0,1,-1,1,4215,0,0],[3091068323,0,2,-1,10,3989,0,0],[454783470,4,1,-1,0,3183,0,0],[3450899088,1,1,-1,0,1817,0,0],[3656796460,3,3,-1,3,7755,0,0],[2519288568,0,1,-1,4,4719,0,0],[1814483290,0,1,-1,0,1118,0,0],[4221006726,0,1,-1,0,5100,0,0],[1398673921,1,1,-1,0,2626,0,0],[2532700533,0,1,-1,0,9220,0,0],[3557480712,0,1,-1,0,5439,0,0],[853403133,4,1,-1,0,3535,0,0],[2491005019,4,1,-1,0,4141,0,0],[3889077804,2,1,-1,0,6314,0,0],[4079214319,2,1,-1,0,1150,0,0],[1532280548,16,1,-1,5,3363,0,0],[1095779154,0,1,-1,4,4284,0,0],[1398007839,0,1,-1,2,8713,0,0],[1034661306,0,1,-1,0,6879,0,0],[1944696695,0,1,-1,0,9674,0,0],[828251710,2,1,-1,1,6622,0,0],[3124003316,1,1,-1,0,5215,0,0],[2676348506,0,1,-1,0,81

Chrome Cache Entry: 202

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3481)
Category:	dropped
Size (bytes):	3530
Entropy (8bit):	5.525597791927395
Encrypted:	false
SSDEEP:	48:4SloopsVL5u5CfGRxnDFzmThAlvnPE17cXfXTrI1iQhTTrUE7qp6upMNqsykTHuV:CokFVfMD04DvEbrOp6udE6ezfkjj
MD5:	BE6064FF8C1D480AFB80FE48762A06C1
SHA1:	F832A784FAEDB0BCFEE78661031D3C23C622501A
SHA-256:	3666E614B6564F13247BF5E53B0DD5C57F27ED75F397AA839F4B75BF55177203
SHA-512:	78E847E48E1A509B9E01550B10A94EA77D4D6BD9208131DD52FFAA379150660A2B7BA11750CA87173FDE4EB75A99512BC98ABDD6593D47DC1A0B8886905DF08E
Malicious:	false
Preview:	(()=>{"use strict";var r={504053:function(r,t,e){e.d(t,{F:function(){return o}}),e(518263),e(970173),e(520712),e(268111),e(941497),e(32026),e(480839),e(744285),e(492257),e(873817),e(863942),e(642549),e(653041);var n=e(788900);function o(r){let t=function(r){let{detail:t=1,pop:e=1}=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{},{PI:o,min:f,max:i,cos:u,round:a}=Math,c=r[0]\|r[1]<<8\|r[2]<<16,l=r[3]\|r[4]<<8,s=(63&c)/63,p=(c>>6&63)/31.5-1,d=(c>>12&63)/31.5-1,v=c>>23,h=l>>15,b=i(3,h?v?5:7:7&l),g=i(3,h?7&l:v?5:7),y=v?(15&r[5])/15:1,O=(r[5]>>4)/15,m=v?6:5,w=0,x=(t,e,n)=>{let o=[];for(let f=0;f<e;f++)for(let i=f?0:1;ie<t(e-f);i++)o.push(((r[m+(w>>1)]>>((1&w++)<<2)&15)/7.5-1)n);return o},j=x(b,g,(c>>18&31)/31/2),k=x(3,3,(l>>3&63)/63e),P=x(3,3,(l>>9&63)/63e),_=v?x(5,5,O):[],A=(0,n.UN)(r),C=a(A>1?32:32A),F=a(A>1?32/A:32),M=new Uint8Array(CF4),U=[],T=[];for(let r=0,e=0;r<F;r++)for(let n=0;n<C;n++,e+=4){let a=s,c=p,l=d,h=y;for(let r=0,t=i(b,v?5:3);r<t;r++)U[r]=u(o/C(n+.5)r);for(l

Chrome Cache Entry: 203

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	688
Entropy (8bit):	4.422809447424027
Encrypted:	false
SSDEEP:	12:t6AbzVKIh4zXvVg/jzDJU0uE2pLAZTX9D1jPb1qcNRxU7EK53TQke:tDbzVKwkXveLPC0uWZjR1LhFFkxhe
MD5:	C6CE0010471B65C0FAEDA6C53AB297BD
SHA1:	8735052DE92D694B4EA91CECCAB0E7E8F75A3CC7
SHA-256:	862046FEE1B4F3744F000347CC0B337871967B2BD9471BCB6DDED2A49A61C527
SHA-512:	7A054A7E19F80F7735CCDBC13E9CAFA13A779764C1725161B4EC7D3C793CFFB2E56C61109AA5F09A21E9DE3FD46B2E2EC756A6B03E46F4760125D282C14273C4
Malicious:	false
Preview:	<svg fill="none" height="12" viewBox="0 0 13 12" width="13" xmlns="http://www.w3.org/2000/svg"><path d="m5.39011.540027c.35536-.720037 1.38211-.720036 1.73747.000002l1.18359 2.398201c.14111.28593.41388.48411.72942.52996l2.64661.38457c.7946.11546 1.1119 1.09196.5369 1.65243l-1.9151 1.86674c-.2283.22257-.33252.54323-.2786.8575l.4521 2.63587c.1357.7914-.69496 1.3949-1.40567 1.0213l-2.36717-1.2445c-.28223-.1484-.6194-.1484-.90162 0l-2.36717 1.2445c-.71072.3736-1.54138-.2299-1.40565-1.0213l.45209-2.63587c.0539-.31427-.05029-.63493-.27861-.8575l-1.915083-1.86674c-.574984-.56047-.2576998-1.53697.536908-1.65243l2.646575-.38457c.31554-.04585.58831-.24403.72943-.52996z" fill="#fff"/></svg>

Chrome Cache Entry: 204

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	137
Entropy (8bit):	4.832107377824175
Encrypted:	false
SSDEEP:	3:t6WH7W+lFAATcvcmJDmJS4RKb5KVErcHrFvR8hiJqGrqL0:t6Abli/c8mc4slmrFv2hiAe
MD5:	70275FE3104CF1D3388586AD8FFD478E
SHA1:	473EA46F5B22B5C7D14C39EE9C0C82811593883B
SHA-256:	3269CF3FDA7681388472225BAD39B6BB3B26088A0A03B6CD5796195F0114CE13
SHA-512:	044C0F8F1583FAEBA3A23FF2DF821A5A0E79C548DB3A6474614894DA2CB125476227407F865CF20D32DC7E4D9ADE09EBA6317EFB787EEED2570C0EBDFC401D2A
Malicious:	false
URL:	https://discord.com/assets/af5116b1db004acbdb8b.svg
Preview:	<svg fill="none" height="8" viewBox="0 0 9 8" width="9" xmlns="http://www.w3.org/2000/svg"><path d="m4.5 0 4.5 8h-9z" fill="#fff"/></svg>

Chrome Cache Entry: 205

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	109613
Entropy (8bit):	5.4029332021931715
Encrypted:	false
SSDEEP:	1536:fCBKa1oPP8sGolumyOSsN5VYpLUBDL2QPidmHTRWisxpLAkF+d10J:qB9C81a5YpL5kl9sxpTa10J
MD5:	80F500D4D0495E5C74E9B92CBC26F088
SHA1:	A2C3F68D87AD8F793935FA7B8D05A0A2D635C4E0
SHA-256:	407002AD3FD8CF26EF02A802DD0D4DB7BFF395D8C22F5F8580CA6CE65A797238
SHA-512:	500C40BF257E7F4098B3B64CEDD49D8612FAF8B254CF496019C5B579C784A416F466C6BAC174B5317A663071E736C2DF82D22E6A7F88AF664BC421A974ABDF59
Malicious:	false
Preview:	(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["63288"],{473452:function(e,t){"use strict";t.Z=function(e){for(var t,n=e.length,o=n^n,r=0;n>=4;)t=(65535&(t=255&e.charCodeAt(r)\|(255&e.charCodeAt(++r))<<8\|(255&e.charCodeAt(++r))<<16\|(255&e.charCodeAt(++r))<<24))1540483477+(((t>>>16)1540483477&65535)<<16),t^=t>>>24,o=(65535&o)1540483477+(((o>>>16)1540483477&65535)<<16)^(t=(65535&t)1540483477+(((t>>>16)1540483477&65535)<<16)),n-=4,++r;switch(n){case 3:o^=(255&e.charCodeAt(r+2))<<16;case 2:o^=(255&e.charCodeAt(r+1))<<8;case 1:o^=255&e.charCodeAt(r),o=(65535&o)1540483477+(((o>>>16)1540483477&65535)<<16)}return o^=o>>>13,o=(65535&o)1540483477+(((o>>>16)1540483477&65535)<<16),((o^=o>>>15)>>>0).toString(36)}},230371:function(e,t){"use strict";t.Z=function(e){var t={};return function(n){return void 0===t[n]&&(t[n]=e(n)),t[n]}}},184826:function(e,t){"use strict";t.Z=function(e){function t(e,t,o){var r=t.trim().split(h);t=r;var i=r.length,a=e.length;switch(a){case

Chrome Cache Entry: 206

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (905)
Category:	downloaded
Size (bytes):	957
Entropy (8bit):	5.034768569958886
Encrypted:	false
SSDEEP:	12:Bw1JU1t21f1C1bA19RAHxrV1e7Co1RSg341Nzg5mBU9K9K/sSelw1NeVE:BgJ0t2DKeAtG1Es4Fg57Xeis+
MD5:	20DDAA519E404695D0657D3868D2701F
SHA1:	0BDF7AD9C1F272B72FD83741504A39D5E8097901
SHA-256:	808A1D58F797547FE5A8ACDC841C6CA36E7440E1DCFFF9CB40497CAE9ED11143
SHA-512:	3D556D1EA31E803BB1E4EE11F68DAFC2FD0121E1A0E7EBE0BEDD1AFDFD646B05357842C825FFA0909492BA7FA00530C8B79BCD7A3778CF5B663194DF6D3BC227
Malicious:	false
URL:	https://discord.com/assets/2917679ca8a08c390036.css
Preview:	.wrapper_cd22e7,.activeWrapper_cd22e7{height:100%;left:0;position:absolute;top:0;width:100%;z-index:1002}.wrapper_cd22e7{pointer-events:none}.videoWrapper_cd22e7{position:absolute;transform:translate(-50%,-50%);top:50%;left:50%;z-index:200;pointer-events:none;width:auto;height:100%}@media(min-aspect-ratio:2880/2048){.videoWrapper_cd22e7{width:100%;height:auto}}.videoWrapperForHelper_cd22e7{position:absolute;pointer-events:none;z-index:200;top:0;left:0;width:100%;height:100%}.gadientHighlight_cd22e7{position:absolute;width:100%;height:100%;pointer-events:none;background-image:linear-gradient(90deg,var(--premium-tier-2-purple-for-gradients)0%,var(--premium-tier-2-purple-for-gradients-2)50%,var(--premium-tier-2-pink-for-gradients)100%)}.swipeWrapper_cd22e7{position:absolute;width:100%;height:100%;pointer-events:none}.swipe_cd22e7{position:absolute;height:100%;opacity:.1;width:auto;right:0;top:0}./# sourceMappingURL=2917679ca8a08c390036.css.map/

Chrome Cache Entry: 207

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3481)
Category:	downloaded
Size (bytes):	3530
Entropy (8bit):	5.525597791927395
Encrypted:	false
SSDEEP:	48:4SloopsVL5u5CfGRxnDFzmThAlvnPE17cXfXTrI1iQhTTrUE7qp6upMNqsykTHuV:CokFVfMD04DvEbrOp6udE6ezfkjj
MD5:	BE6064FF8C1D480AFB80FE48762A06C1
SHA1:	F832A784FAEDB0BCFEE78661031D3C23C622501A
SHA-256:	3666E614B6564F13247BF5E53B0DD5C57F27ED75F397AA839F4B75BF55177203
SHA-512:	78E847E48E1A509B9E01550B10A94EA77D4D6BD9208131DD52FFAA379150660A2B7BA11750CA87173FDE4EB75A99512BC98ABDD6593D47DC1A0B8886905DF08E
Malicious:	false
URL:	https://discord.com/assets/ac625b77a0bab0ee72df.js
Preview:	(()=>{"use strict";var r={504053:function(r,t,e){e.d(t,{F:function(){return o}}),e(518263),e(970173),e(520712),e(268111),e(941497),e(32026),e(480839),e(744285),e(492257),e(873817),e(863942),e(642549),e(653041);var n=e(788900);function o(r){let t=function(r){let{detail:t=1,pop:e=1}=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{},{PI:o,min:f,max:i,cos:u,round:a}=Math,c=r[0]\|r[1]<<8\|r[2]<<16,l=r[3]\|r[4]<<8,s=(63&c)/63,p=(c>>6&63)/31.5-1,d=(c>>12&63)/31.5-1,v=c>>23,h=l>>15,b=i(3,h?v?5:7:7&l),g=i(3,h?7&l:v?5:7),y=v?(15&r[5])/15:1,O=(r[5]>>4)/15,m=v?6:5,w=0,x=(t,e,n)=>{let o=[];for(let f=0;f<e;f++)for(let i=f?0:1;ie<t(e-f);i++)o.push(((r[m+(w>>1)]>>((1&w++)<<2)&15)/7.5-1)n);return o},j=x(b,g,(c>>18&31)/31/2),k=x(3,3,(l>>3&63)/63e),P=x(3,3,(l>>9&63)/63e),_=v?x(5,5,O):[],A=(0,n.UN)(r),C=a(A>1?32:32A),F=a(A>1?32/A:32),M=new Uint8Array(CF4),U=[],T=[];for(let r=0,e=0;r<F;r++)for(let n=0;n<C;n++,e+=4){let a=s,c=p,l=d,h=y;for(let r=0,t=i(b,v?5:3);r<t;r++)U[r]=u(o/C(n+.5)r);for(l

Chrome Cache Entry: 208

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17413)
Category:	downloaded
Size (bytes):	17462
Entropy (8bit):	5.594711522541062
Encrypted:	false
SSDEEP:	384:iwLnWOUnUuyMNps0HHHsglNzUxBAAdTRIZWiv/XB2kZYP:BLQne0P5UxMXB2kSP
MD5:	3B98C1EF9293D482A5099FDB6984946F
SHA1:	6FEFA9D8FF6B2DB16B5EC2ED5922DA0AE6187448
SHA-256:	A76F75BF6294EEA278F82522810ACBC3BCFA9290006F57746AD79BCA3615AD66
SHA-512:	CE9915807ADC42ECAF18D254091B31BD65CE9A29AF38820ACCC2A5D38BC8AA329471AE1E7F404B6F8D0F85CC643B3616863A70D0E3EA1B8C569AC64A5E889C54
Malicious:	false
URL:	https://discord.com/assets/1f7f046253c197b5a419.js
Preview:	(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["15812"],{884835:function(t,e,r){"use strict";var o=r(311596);function n(){}function i(){}i.resetWarningCache=n,t.exports=function(){function t(t,e,r,n,i,a){if(a!==o){var u=Error("Calling PropTypes validators directly is not supported by the `prop-types` package. Use PropTypes.checkPropTypes() to call them. Read more at http://fb.me/use-check-prop-types");throw u.name="Invariant Violation",u}}function e(){return t}t.isRequired=t;var r={array:t,bigint:t,bool:t,func:t,number:t,object:t,string:t,symbol:t,any:t,arrayOf:e,element:t,elementType:t,instanceOf:e,node:t,objectOf:e,oneOf:e,oneOfType:e,shape:e,exact:e,checkPropTypes:i,resetWarningCache:n};return r.PropTypes=r,r}},639519:function(t,e,r){t.exports=r(884835)()},311596:function(t){"use strict";t.exports="SECRET_DO_NOT_PASS_THIS_OR_YOU_WILL_BE_FIRED"},58615:function(t,e,r){var o=r(338091);function n(t){this.mode=o.MODE_8BIT_BYTE,this.data=t}n.prototype={getLength:fu

Chrome Cache Entry: 209

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18134)
Category:	downloaded
Size (bytes):	18183
Entropy (8bit):	5.745446950417671
Encrypted:	false
SSDEEP:	384:M7+ek/HNfVFGOSH4vgk+l/HyHOC7CmA5h4m4C2xYtL5c299H0KkBijYpthjDh2P1:g+ek/7VwEgkK/SuC7Cx5G1C2xYtL5c2R
MD5:	CB2E31554EC3CE69856DD70C281A6DB7
SHA1:	53524C140D3B966DFA9ADAF06A1AD062CC5FB9E1
SHA-256:	A4E79A1E245BDE12C9A8FE50342E450213CB0F3002D0453DE8FDEDE75630F2D2
SHA-512:	FB5D9629793FA3A432D955AE2193504445464719C92B7281612DC83912FCF1150A07F2BEDEDADFB102D8FC0D54980B769C933D4D99DEDAD0AFC14E3065ABE6FC
Malicious:	false
URL:	https://discord.com/assets/36e086bbcea2eace814d.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["10778"],{418757:function(e){e.exports="/assets/b7d1dc6b0746101719c5.png"},494207:function(e){e.exports="/assets/85153fe71873da0f5802.svg"},320440:function(e){e.exports="/assets/4676f063fb9f129e9fdb.svg"},561030:function(e){e.exports="/assets/75c80c4160a66983ae66.svg"},419185:function(e){e.exports="/assets/47e72e6360ce185adab6.svg"},826806:function(e){e.exports="/assets/fb418059f41b569abca4.svg"},123013:function(e){e.exports="/assets/98cacc492d985565ed4f.png"},540909:function(e){e.exports="/assets/2a5176cf2bd0ccdf0e7b.svg"},232454:function(e){e.exports="/assets/ad2027f11792ba8c0e7f.svg"},526916:function(e){e.exports="/assets/f38b6aefa24dc9a54765.svg"},29654:function(e){e.exports="/assets/dde11474b0623b723861.svg"},820160:function(e,s,a){a.d(s,{Z:function(){return L}});var E=a(200651);a(192379);var _=a(481060),t=a(813197),n=a(689938),r=a(510186);function L(e){let{icon:s,onChange:a}=e;return(0,E.jsx)(_.Fo

Chrome Cache Entry: 210

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	688
Entropy (8bit):	4.422809447424027
Encrypted:	false
SSDEEP:	12:t6AbzVKIh4zXvVg/jzDJU0uE2pLAZTX9D1jPb1qcNRxU7EK53TQke:tDbzVKwkXveLPC0uWZjR1LhFFkxhe
MD5:	C6CE0010471B65C0FAEDA6C53AB297BD
SHA1:	8735052DE92D694B4EA91CECCAB0E7E8F75A3CC7
SHA-256:	862046FEE1B4F3744F000347CC0B337871967B2BD9471BCB6DDED2A49A61C527
SHA-512:	7A054A7E19F80F7735CCDBC13E9CAFA13A779764C1725161B4EC7D3C793CFFB2E56C61109AA5F09A21E9DE3FD46B2E2EC756A6B03E46F4760125D282C14273C4
Malicious:	false
URL:	https://discord.com/assets/9017b7062734e72bb476.svg
Preview:	<svg fill="none" height="12" viewBox="0 0 13 12" width="13" xmlns="http://www.w3.org/2000/svg"><path d="m5.39011.540027c.35536-.720037 1.38211-.720036 1.73747.000002l1.18359 2.398201c.14111.28593.41388.48411.72942.52996l2.64661.38457c.7946.11546 1.1119 1.09196.5369 1.65243l-1.9151 1.86674c-.2283.22257-.33252.54323-.2786.8575l.4521 2.63587c.1357.7914-.69496 1.3949-1.40567 1.0213l-2.36717-1.2445c-.28223-.1484-.6194-.1484-.90162 0l-2.36717 1.2445c-.71072.3736-1.54138-.2299-1.40565-1.0213l.45209-2.63587c.0539-.31427-.05029-.63493-.27861-.8575l-1.915083-1.86674c-.574984-.56047-.2576998-1.53697.536908-1.65243l2.646575-.38457c.31554-.04585.58831-.24403.72943-.52996z" fill="#fff"/></svg>

Chrome Cache Entry: 211

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 139388, version 2.459
Category:	downloaded
Size (bytes):	139388
Entropy (8bit):	7.99804629870967
Encrypted:	true
SSDEEP:	3072:Q69dyqPSD49z56qcFxDiYZHYj3pU5qJvdzqC3dZIwv82phTFsZ:yUSD49d6TDiYZ8pU4Jvlnd42vmZ
MD5:	DB985AAA3C64F10506D96D876E350D47
SHA1:	AAD4A93575E59643FED7617E2FEB893DD763D801
SHA-256:	234FEB9A8A2C759D00A4959506A3B9CB94C772186A2D117AED973347C7EF1891
SHA-512:	300D0D35EBB9E27D66489FFB3E5502A4DCD3AF032FB0F672D4F004E3846FB795772B6938C99DAFED6FAD0C25DA8412D6F6A7B0221EB2540E84527703DB5B7073
Malicious:	false
URL:	https://discord.com/assets/452d7be36bf4b23241bd.woff2
Preview:	wOF2...... \|......9... ...........................f...v....`...........e.6.$..T..X.. ..\|...[..[.B...c.{....:.w..T.l...C.T+...G.......F.\s...m..J.n`....y..6.<.................c......#............m..n...u..#$H..+....1).oq.l.@...U...#TpP...C..Xk.`.k.....(!...1k0....2f.W^.&hw.hF&h...v.[dA..Y./.6....zC..3._d.....r@...n.$...,.F.6X......SG....x...N.+..6.a%.].V}.u.(P..w.pK..%?.o......b.So1.....M.5.2........).`.N...D.fwTz..a.A. ...).=.\Y..Z.')+.../....0{..8..26u.;<a.......<...=.....eq;kD....Y..I^..`.R..n...T=.R..T.Jl.W..p..].....5.(y#....P.G.N........$Iv.....~....ns...J....TuY!o..jz...P5\|@..H.Tu.P.b!T..r7..,<.u.O....?......J.9...........r....~..f..U`...Y..\|....;..K>cl.....`_.+..l....f>.s.#w...36...[...9rI..t@.....b7.s..F....<..x.zT.t.5...8..?..j9k.'-.)u.[..w..>1I.....2.w.;..3.\?.,...b!.B$Qh.......A....?#...O.....5~W.h..HD.....V..d.O..\x1.rLV..U.4~...k.m.U...{6mg...q.ldfc...d..>[.i............<.".w^....4...XJ.n.xm..D.......M....XE.@.....GL...

Chrome Cache Entry: 212

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (23014)
Category:	downloaded
Size (bytes):	41018
Entropy (8bit):	5.288611763514835
Encrypted:	false
SSDEEP:	768:AwNvVNMV9ptcE+wCFgFLWcE+wCFgFLjONOT/cEA6KAOD54Dow93Tz:bAVeE++E+GONOzcEsYnjz
MD5:	FBEC530F567CB32C81348642102C8348
SHA1:	8D1BD68302D72651A78FD252EE52552D4B7E3364
SHA-256:	24055C6A77C3CDB43FCBB15A9F48F622042F3E8052F177916E3325BCDC85D1F3
SHA-512:	CEF10273CCDECDC4A389724FD4499371595F79601B51AD8CFE14D333E393E5E67373A97D3EDAE722868A7E68A70A6A22FF764AEE40D3CAC21F8CFFC1A231A11F
Malicious:	false
URL:	https://discord.com/assets/591980d24607547de30a.css
Preview:	.discordLogo_b83a05{height:36px;width:112px;background:url(/assets/23a7a3fd6624342117bf.svg)no-repeat;display:none;flex-shrink:0;margin-bottom:16px}.authBox_b83a05{width:480px;padding:var(--custom-auth-box-auth-box-padding);font-size:18px;box-shadow:var(--legacy-elevation-high);border-radius:5px;box-sizing:border-box;color:var(--text-muted)}.authBox_b83a05 a{color:var(--text-link)}.authBox_b83a05 a:hover{-webkit-text-decoration:underline;text-decoration:underline}.authBoxExpanded_b83a05{width:784px}.centeringWrapper_b83a05{width:100%;text-align:center}.avatar_b83a05{margin-bottom:24px}@media(max-width:485px){.authBox_b83a05{position:absolute;top:0;right:0;bottom:0;left:0;padding:20px 16px;width:100%;height:100%;display:flex;align-items:center;flex-direction:column;background:linear-gradient(to left bottom,#3d4046,#1e1e23);border-radius:0;overflow:scroll}.authBox_b83a05 .discordLogo_b83a05{display:block}@media(max-width:830px){.authBox_b83a05.authBoxExpanded_b83a05{max-width:none}}.auth

Chrome Cache Entry: 213

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	24
Entropy (8bit):	4.022055208874201
Encrypted:	false
SSDEEP:	3:PaniAKp18n:SnT
MD5:	5DFB17ADA137F27939246A24FD5F7CE1
SHA1:	6748CBADBAAA9216F6FC0C3C3B5F7CA786F3C8BA
SHA-256:	E7E1364442A162805292D9693D57C84E66D37E27849E1EDC4C31A3436DEDF238
SHA-512:	70A38493813CA097B394743E6ED33B2574079F500E5D9C911A8EC251E39C5BA47EC41214EE47B21BEF4D4392B2F3D507717282C2AE073A05FEC74542A2460F5D
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAnjkqJiyOoN-BIFDfwdehA=?alt=proto
Preview:	Cg4KDA38HXoQGgUIoAEYAg==

Chrome Cache Entry: 214

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	4246
Entropy (8bit):	4.103696787604314
Encrypted:	false
SSDEEP:	96:K9F4GfkbfNyN48/E8jfsrKk1Z/eO4oSgT3I/VcbQokvBD:KnqbfQ48/BfsrKYZ/eOBe9FJD
MD5:	DDA77F765068E4450D3545A40B777663
SHA1:	63AE45EF489734D09D3AEA98E016C0DD1BC733F9
SHA-256:	A644A9364BE96AD0A72F8E24397322B4D0646563A11E8FF76191A9239A561AC9
SHA-512:	D88521109D4AC8EA200F644973A7A554C1A6B8E0AE4658C7F0E3FAFBEE40A1CB8A6A75BECB2A49AE3B8D226BEE36CD8CA63B492FABC2BF034D6A295349567946
Malicious:	false
URL:	https://discord.com/assets/0e5029fd9cd4812b6712.svg
Preview:	<svg width="124" height="24" viewBox="0 0 124 24" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#a)"><g clip-path="url(#b)" fill="#fff"><path d="M26.242 2.01A25.218 25.218 0 0 0 19.851 0a18.718 18.718 0 0 0-.819 1.701 23.45 23.45 0 0 0-7.083 0A18.2 18.2 0 0 0 11.121 0a25.13 25.13 0 0 0-6.396 2.015C.68 8.132-.417 14.097.132 19.978c2.682 2.005 5.282 3.223 7.838 4.02A19.514 19.514 0 0 0 9.65 21.23a16.507 16.507 0 0 1-2.644-1.287c.222-.165.439-.337.648-.513 5.098 2.386 10.636 2.386 15.673 0 .211.177.428.348.648.513-.839.505-1.726.939-2.649 1.29A19.432 19.432 0 0 0 23.004 24c2.558-.797 5.16-2.015 7.843-4.022.643-6.817-1.099-12.728-4.605-17.968ZM10.343 16.361c-1.53 0-2.785-1.43-2.785-3.17 0-1.741 1.228-3.174 2.785-3.174 1.557 0 2.812 1.43 2.785 3.174.003 1.74-1.228 3.17-2.785 3.17Zm10.293 0c-1.53 0-2.786-1.43-2.786-3.17 0-1.741 1.228-3.174 2.785-3.174 1.557 0 2.812 1.43 2.785 3.174 0 1.74-1.228 3.17-2.785 3.17ZM41.629 6.122h6.652c1.603 0 2.958.257 4.069.767 1.109.51 1.94 1

Chrome Cache Entry: 215

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17745)
Category:	downloaded
Size (bytes):	17794
Entropy (8bit):	5.473881721264957
Encrypted:	false
SSDEEP:	384:ynp0/xKyAhCrap7NrDNZAQJhGzsqX1VXn0Fmc1YNsEPoVUA7:ynpGyfplzJisajM
MD5:	8F5BEB794777EAC4C63978CD0EF850F4
SHA1:	1E1FC58F2A253F63B96801836B6E626898319D4C
SHA-256:	81614ED290684BA635701BA13C3D61377AE1D96E0A8F32FD424879AF56010044
SHA-512:	318626E5ECD021D3B8CC096AE0EA866D62A1CCA883643BD7813490AE7C87CD7D55114CE2FFD6D46F7688DC467A4A4BDB389EE9AF6688EFE0FD1A5FC205613E14
Malicious:	false
URL:	https://discord.com/assets/ea8b2ed5e609f40e7f7b.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["11260"],{26230:function(e){e.exports="/assets/afd44ae05126b5fab40d.svg"},935227:function(e){e.exports="/assets/50b96601171fd361101c.svg"},479495:function(e,t,s){s(757143);var n,r=s(200651),i=s(192379),a=s(120356),o=s.n(a),l=s(593473),c=s(873546),u=s(442837),d=s(570140),h=s(893776),p=s(129293),m=s(388905),f=s(17894),C=s(124860),g=s(108427),x=s(314897),N=s(585483),v=s(981631),E=s(689938),S=s(113207);function A(e,t,s){return t in e?Object.defineProperty(e,t,{value:s,enumerable:!0,configurable:!0,writable:!0}):e[t]=s,e}u.ZP.initialize();class j extends(n=i.PureComponent){componentDidMount(){(0,g.e)("reset_password")}renderPasswordReset(){let{password:e,error:t,hasCancel:n}=this.state,i=this.isSubmitting(),a=null!=t?t:this.renderError("password");return(0,r.jsxs)(m.ZP,{onSubmit:this.handleSubmit,tag:"form",children:[(0,r.jsx)("img",{alt:"",src:null==a?s(26230):s(935227),className:S.marginBottom20}),(0,r.jsx

Chrome Cache Entry: 216

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.921485085907038
Encrypted:	false
SSDEEP:	3:t6WH7W+ZacvTnARcLnkDmJS4RKb5KVErcHYWNTWi7eLFOyTIXGUNfHFQJJqGrqL0:t6AbZ/Ikn4mc4slmYWBWzLRI2ylQJAe
MD5:	B1D4C5E276E3AAA8EC41E6014DD572B2
SHA1:	B5B63A8B35223277D75C79B2AABD8221FDA383EB
SHA-256:	7CF5996F7AB483BD985B3DE5BFBCF50A2B22A7B473E8011E5C993D9830AF9D12
SHA-512:	8E4C954D96FBDA407E87FA65859FE758FC83F2DA0C6D7C07824926BFB0BCDF4F40DE057C5DD1D7EE0890C5287D2ED2EC8FDEFBDF317B46FE222339894E0A559B
Malicious:	false
Preview:	<svg fill="none" height="9" viewBox="0 0 6 9" width="6" xmlns="http://www.w3.org/2000/svg"><path d="m0 2.83912v3.32176l3 2.83912 3-2.83912v-3.32176l-3-2.83912z" fill="#fff"/></svg>

Chrome Cache Entry: 217

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8090), with no line terminators
Category:	downloaded
Size (bytes):	8090
Entropy (8bit):	5.756447941556749
Encrypted:	false
SSDEEP:	96:hSvP/Siogm9fMJzt5l7gSyX9cK/T8JvcLOGBz/fPKypAYD4biID4Fzb/6:USzgWfMJztP7g9lQxKzPDphfL6
MD5:	B69D4EEB59E99D49A9A62E9F6300D5D1
SHA1:	DDC191FC8320AE66FCE2626B70C13497CD74AE0D
SHA-256:	2B465FF374615930ECAA5F2B7E8722B2172F3F5011449211D127FFEB5CBDC4CD
SHA-512:	7A5F8A6DB7E77DDEEF101594202304F0F86916178968786ED13992CEB95821A520F0F6E91A738547AC5BB3131F483FDCAFB1DE0A33238578A7D21225D1755DF3
Malicious:	false
URL:	https://discord.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js?
Preview:	window._cf_chl_opt={cFPWv:'g'};~function(V,h,i,j,k,o,s,B){V=b,function(d,e,U,f,g){for(U=b,f=d();!![];)try{if(g=parseInt(U(514))/1(-parseInt(U(464))/2)+parseInt(U(506))/3+parseInt(U(519))/4(parseInt(U(512))/5)+parseInt(U(537))/6+parseInt(U(541))/7+-parseInt(U(444))/8*(parseInt(U(463))/9)+parseInt(U(548))/10,e===g)break;else f.push(f.shift())}catch(D){f.push(f.shift())}}(a,187333),h=this\|\|self,i=h[V(470)],j={},j[V(531)]='o',j[V(503)]='s',j[V(515)]='u',j[V(442)]='z',j[V(517)]='n',j[V(445)]='I',j[V(529)]='b',k=j,h[V(481)]=function(g,D,E,F,a0,H,I,J,K,L,M){if(a0=V,D===null\|\|void 0===D)return F;for(H=n(D),g[a0(466)][a0(528)]&&(H=H[a0(530)](g[a0(466)][a0(528)](D))),H=g[a0(450)][a0(502)]&&g[a0(492)]?g[a0(450)][a0(502)](new g[(a0(492))](H)):function(N,a1,O){for(a1=a0,N[a1(494)](),O=0;O<N[a1(474)];N[O+1]===N[O]?N[a1(521)](O+1,1):O+=1);return N}(H),I='nAsAaAb'.split('A'),I=I[a0(500)][a0(544)](I),J=0;J<H[a0(474)];K=H[J],L=m(g,D,K),I(L)?(M=L==='s'&&!g[a0(518)](D[K]),a0(499)===E+K?G(E+K,L):M\|\|G(E+K

Chrome Cache Entry: 218

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 960x540, components 3
Category:	dropped
Size (bytes):	33094
Entropy (8bit):	7.662961138741444
Encrypted:	false
SSDEEP:	384:lgO9OMfES6EqMU9mmYJIbvXWQGA7DC5QC1QP9HfPt6r5esdEiExCbli1zqlYlBaJ:lJU5zGQswlE1TEx8kzqloBYA8R
MD5:	7E3C950F6514CEAEC263944BB6149A6B
SHA1:	D60A06B2724156F2C808648E8B5D8D543D93B084
SHA-256:	2CFA6F333D5A195FDFC244B2F3FBEDBAC858071EEC196BCA300808BAC20BF273
SHA-512:	AF8A05BDB2900D7D06D782309340941C4A0C6623F60F672AD4342A474F17CC76A987584D7EEB8D64D8960D6126A7A9FDB3E847D70DE8BD06C6BBAC24F6851D77
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..Z(...(...E...ZE....Z(...(...O.?AKI.G.(.h...(...).U..........(...(..o.~....O...(...(...(..^....^......(...(...#.....~....(...(...._.-!.ZZ.(...(...F...KH.t.)h...(...(..^....^......(...(...#.....~....(...(...._.-!.Z.Z(...(...F...KH.t.(.h...(...(...E...ZE...Z.(...(...O.?AKI.G.)h...(...(..U..........(...(..o.~....O...(...(...E...ZE....Z(...(...O.?AKI.G.(.h...(...).U.........

Chrome Cache Entry: 219

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.710597482771287
Encrypted:	false
SSDEEP:	3:t6WH7W+lFAATcvdnmFFSDDmJS4RKb5KGMXf/FGc8qQAGrqLW:t6Abli/m03mc4sldMX9QAw
MD5:	72A8B168AD2C7EEA7B2559B5690C7695
SHA1:	85E4F43154EA713C832BA27128A33EB7B2A7CF7A
SHA-256:	1F988D1AD4AB163D61A584254C07D75F3241EB6380BF48BF7D8F981E13C092CD
SHA-512:	11BCB1A3623B97C9DD2F22D0389B3CA05AB4F99596DE5D07C50C1FC83F7532D8C20B58379C54C38F503D86D8C2CAF52AF3B35FFCCDC4750089ABAF86C1C5294E
Malicious:	false
Preview:	<svg fill="none" height="8" viewBox="0 0 8 8" width="8" xmlns="http://www.w3.org/2000/svg"><circle cx="4" cy="4" r="4" fill="#fff"/></svg>.

Chrome Cache Entry: 220

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4804
Entropy (8bit):	3.9838661314243433
Encrypted:	false
SSDEEP:	96:Ez1Y5tmUKv0bhb9lsqYnlV4XdUo4e7JR0Tn515GGNj1j:eWtRK8Z4qYnlV4Xdt6RGaj1j
MD5:	22FD790491653D837422D80E3500CF92
SHA1:	E0618307DDC1E06D85729819B115D0652ABB148C
SHA-256:	641B1091276BA75578C3D93F367F0D70BCBBA7C62A7F159C4307ACF0ED6C5CBE
SHA-512:	AD2100B9391969B160D3DE80C7310CF5706B89CD097D8B48D6DF0D96E9CFB73C15DDD487DF7773C28094A152EC9D4F8F6E6B718C96FAF734708018C65511266E
Malicious:	false
Preview:	<svg fill="none" height="36" viewBox="0 0 130 36" width="130" xmlns="http://www.w3.org/2000/svg"><g fill="#fff"><path d="m27.5247 8.06243c-2.1034-.96349-4.3524-1.66374-6.7036-2.06243-.2888.51114-.6261 1.19861-.8587 1.74553-2.4995-.36802-4.9759-.36802-7.4293 0-.2326-.54692-.5777-1.23439-.869-1.74553-2.35376.39869-4.60533 1.1015-6.70864 2.06754-4.242451 6.27676-5.392506 12.39766-4.817478 18.43156 2.813808 2.0574 5.540698 3.3071 8.221628 4.1249.6619-.892 1.25228-1.8401 1.76089-2.8394-.96862-.3603-1.89634-.805-2.77294-1.3213.23259-.1686.46001-.345.67979-.5265 5.34655 2.4484 11.15555 2.4484 16.43815 0 .2224.1815.4498.3579.6798.5265-.8791.5188-1.8094.9635-2.778 1.3239.5086.9967 1.0964 1.9474 1.7609 2.8393 2.6834-.8178 5.4129-2.0675 8.2267-4.1274.6747-6.9949-1.1526-13.0595-4.8302-18.43667zm-16.6759 14.72587c-1.6049 0-2.92111-1.467-2.92111-3.2534s1.28807-3.2559 2.92111-3.2559c1.6331 0 2.9493 1.4669 2.9212 3.2559.0025 1.7864-1.2881 3.2534-2.9212 3.2534zm10.7952 0c-1.6049 0-2.9211-1.467-2.9211-3

Chrome Cache Entry: 221

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (970)
Category:	dropped
Size (bytes):	1019
Entropy (8bit):	5.481455450518707
Encrypted:	false
SSDEEP:	24:wkU14HIuIuISm+mm7VOhR1RYIbTOZF7B7v/SlCxKqWeeUu5m:wkTH/bIm7VObfqZFN7vqYxKfv5m
MD5:	5489024A0568CEB2CCC181B8BA420A0F
SHA1:	121F6E3A6DE26A8DCF7A967C442A8509BC196CDC
SHA-256:	34048A4F2D6B0861798B4D37954DAC09E8071EBB63C8E9B6D8ADF20BE95BFF82
SHA-512:	1C9B0EEF72C329B62D8DBAD87C9BCD78E65C11EFC5075C8EE8120A62F803E0F97B78E9E481373DC88908B00B8D9A9675CA81038EFE05E65BF9E9F3247A8F8D15
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["89273"],{361207:function(n,t,i){i.d(t,{DW:function(){return d},t3:function(){return f},w4:function(){return r}});var u=i(525654),e=i.n(u);i(271579),i(314897);var o=i(981631);let c="linux";function r(n){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1],i=arguments.length>2?arguments[2]:void 0;return"".concat(o.fzT.DESKTOP).concat(t?"/ptb":"","?platform=").concat(n).concat(null!=i?"&format=".concat(i):"")}function a(){var n;let t=arguments.length>0&&void 0!==arguments[0]?arguments[0]:null===(n=e().os)\|\|void 0===n?void 0:n.family;return null==t?"win":-1!==t.indexOf("Ubuntu")\|\|-1!==t.indexOf("Debian")\|\|-1!==t.indexOf("Fedora")\|\|-1!==t.indexOf("Red Hat")\|\|-1!==t.indexOf("SuSE")\|\|-1!==t.indexOf("Linux")?c:-1!==t.indexOf("OS X")?"osx":"win"}function d(n){return({win:"Windows",osx:"Mac",[c]:"Linux"})[a(n)]}function f(){let n=a();return r(n,!1,n===c?"tar.gz":null)}}}]);.//# sourceMappingURL=b8160243

Chrome Cache Entry: 222

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8712)
Category:	dropped
Size (bytes):	8761
Entropy (8bit):	5.595354119822134
Encrypted:	false
SSDEEP:	96:7YoXmoXiURhBU9QCy4WqAVMF+FW91nuFua4MDeTVPpz6jid6ftysD9g9u6EPaLil:7YoXmoXE9xUFEuTKt2lyLkTp/os
MD5:	102FE4FDEC4447C9891C9F3FAEAE0474
SHA1:	3FA3BAF1DCED3A39DF8599BEEFA5180B436A782C
SHA-256:	E45508538EE1AB34F520303F7D1A9A7F5CB5D99FF34CE7E5EB64EB32EF6F19F9
SHA-512:	97942EEC44A5F613A45A514E355F26EC3B2458BA497009D4D70D88FF3562C94212DFB424AF0CE37BE880F3528446B28BBAB6F77C2717F0C16BF1317AFBC030D4
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["18543"],{725436:function(e,t,n){n.d(t,{m:function(){return u}});var s=n(454585),a=n(551452),l=n(532901);let r={...s.Z.guildEventRules.link,react:(0,l.Z)({enableBuildOverrides:!1,mustConfirmExternalLink:!0}).react},i={...s.Z.guildEventRules.channelMention,react:(0,a.Z)({enableBuildOverrides:!1,shouldCloseDefaultModals:!0,shouldStopPropagation:!0}).react},u=s.Z.reactParserFor({...s.Z.guildEventRules,link:r,channelMention:i})},315416:function(e,t,n){n.d(t,{Z:function(){return i}});var s=n(192379),a=n(442837),l=n(897285),r=n(924301);function i(e,t,n){let i=(0,a.e7)([r.ZP],()=>r.ZP.getUserCount(t,n));return(0,s.useEffect)(()=>{null!=e&&null!=t&&l.Z.getGuildEventUserCounts(e,t,null!=n?[n]:[])},[t,e,n]),i}},405613:function(e,t,n){n.d(t,{Z:function(){return l}});var s=n(134432),a=n(981631);function l(e,t){let n;if(null==e.image)return null;null==t&&(t=window.screen.width*(0,s.x_)()),t=(0,s.oO)(t);let l=window.

Chrome Cache Entry: 223

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17745)
Category:	dropped
Size (bytes):	17794
Entropy (8bit):	5.473881721264957
Encrypted:	false
SSDEEP:	384:ynp0/xKyAhCrap7NrDNZAQJhGzsqX1VXn0Fmc1YNsEPoVUA7:ynpGyfplzJisajM
MD5:	8F5BEB794777EAC4C63978CD0EF850F4
SHA1:	1E1FC58F2A253F63B96801836B6E626898319D4C
SHA-256:	81614ED290684BA635701BA13C3D61377AE1D96E0A8F32FD424879AF56010044
SHA-512:	318626E5ECD021D3B8CC096AE0EA866D62A1CCA883643BD7813490AE7C87CD7D55114CE2FFD6D46F7688DC467A4A4BDB389EE9AF6688EFE0FD1A5FC205613E14
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["11260"],{26230:function(e){e.exports="/assets/afd44ae05126b5fab40d.svg"},935227:function(e){e.exports="/assets/50b96601171fd361101c.svg"},479495:function(e,t,s){s(757143);var n,r=s(200651),i=s(192379),a=s(120356),o=s.n(a),l=s(593473),c=s(873546),u=s(442837),d=s(570140),h=s(893776),p=s(129293),m=s(388905),f=s(17894),C=s(124860),g=s(108427),x=s(314897),N=s(585483),v=s(981631),E=s(689938),S=s(113207);function A(e,t,s){return t in e?Object.defineProperty(e,t,{value:s,enumerable:!0,configurable:!0,writable:!0}):e[t]=s,e}u.ZP.initialize();class j extends(n=i.PureComponent){componentDidMount(){(0,g.e)("reset_password")}renderPasswordReset(){let{password:e,error:t,hasCancel:n}=this.state,i=this.isSubmitting(),a=null!=t?t:this.renderError("password");return(0,r.jsxs)(m.ZP,{onSubmit:this.handleSubmit,tag:"form",children:[(0,r.jsx)("img",{alt:"",src:null==a?s(26230):s(935227),className:S.marginBottom20}),(0,r.jsx

Chrome Cache Entry: 224

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 39764, version 2.66
Category:	downloaded
Size (bytes):	39764
Entropy (8bit):	7.993646621116526
Encrypted:	true
SSDEEP:	768:90TMDBOLlFMKbQDweRs+mkq4oY+VT6p+0t5LMXTkfm7s/U2Uq:6TppGKMDwtN4orTAHjMDja
MD5:	71D3E9DC2BCB8E91225BA9FAB588C8F2
SHA1:	D7E38EE4C245F64B78EB18E6ECD7B9F53B3254A8
SHA-256:	AE99AAEDE2F373187A4FE442A2CB0AB9C2945EFBAB01CF33E01BE517C0C4F813
SHA-512:	DEDA05EBD575D413AA2277876991ECC2EA238907390753485BA1B487EDE2F432363C46DAAD5F3F240EAAF8D3258150829A3AE3D2D9C420EA59567CFD440361A6
Malicious:	false
URL:	https://discord.com/assets/1222195a37d6dd10994e.woff2
Preview:	wOF2.......T......}........B..........................z.. .`..P..D..W........S.6.$..`..r.. .....F..=[.W..ir.h......,......j..In.X....Uj..3...`K\t........".%.]..p..E........G..9&r...S.+.r.5....~`.....S'..1~.a..H...S.........N.tX2G7.u..m.z.!.......).w....V....:.6..W.\.+..j.K...[\|.n..dg.....Kx:;....7?2.j..\...0..=zd.(...{.c.....}._..Q.....dUx....b.\Y,.........W.b.zkAX.,..X..jO..w..% .[..DD.X..G\..?.9..\.G...#...T ..".$.Z.P...W..5.b.._......}at.....@2.A.....m...5Oy....e.a...D...'.s.$...Q.......[.....A.....r..&....8.Q.KZ.#G...#_.~...yh1$.b~.0S[..6..+...../...jdlcC_0S..J.J!e.'...)3.O..}.C.)...v.qn.......5}.7{.m.b.&:.S..h>.hz..."N.G8..A..&.....s...3<...C... _.F$.`.J.....UuKv.ik.H.'....e..b-k..kt..!....Q.l.R)ai&....Dp..\T).O...'6.<....u..WiM.s....I@.....+.....=...&.6.N..n.....\..k...8.....P6.f..k{...3....5....C..T.iG.5....s...$W..=^...3..V.._\..J..2`.........z........1....l.F... .zVb...0.Z..=........[2?.V.....J.....!4B.U..*.....>.Ta`0...

Chrome Cache Entry: 225

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5552)
Category:	downloaded
Size (bytes):	5601
Entropy (8bit):	5.7655360019382895
Encrypted:	false
SSDEEP:	96:2XobeWK+r3kiJfaaLUmbybQSfuaVRbm0HMgFfgWuAyEdVAmefr4/8VZPUGky:qobvfaa9DSfXDbXMaYPAyEdLefr4/YMe
MD5:	13FF42A071C43FA5521C11EB2F2EA914
SHA1:	B97D6318B384D57DEFD41EC4DEBF9D7DE198537C
SHA-256:	6B8776086567649C2432023184979BB8244A268C081FC1D478D834BF50A169F9
SHA-512:	F38C1D3760B23A65EACDB8214424227BDFE638C4A86E6DB89D8D86E29A820060165583FB7794E77935E52B62A6FE09567FC71FB44986D0FBD473F54DEBC56202
Malicious:	false
URL:	https://discord.com/assets/05bd1eb5dea5ee3387f4.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["46369"],{438820:function(e,t,n){var i,a=n(442837),c=n(570140);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}let s={canPlayWowMoment:!1,isFetchingWowMomentMedia:!1,wowMomentWumpusMediaUrl:null};class d extends(i=a.ZP.PersistedStore){initialize(e){null!=e&&(s=e),s.canPlayWowMoment=!1,s.isFetchingWowMomentMedia=!1,s.wowMomentWumpusMediaUrl=null}getState(){return s}get canPlayWowMoment(){return s.canPlayWowMoment}get isFetchingWowMomentMedia(){return s.isFetchingWowMomentMedia}get wowMomentWumpusMedia(){return s.wowMomentWumpusMediaUrl}}o(d,"displayName","PurchasedItemsFestivityStore"),o(d,"persistKey","PurchasedItemsFestivityStore"),o(d,"migrations",[e=>({...e})]),t.Z=new d(c.Z,{LOGOUT:function(){s={canPlayWowMoment:!1,isFetchingWowMomentMedia:!1,wowMomentWumpusMediaUrl:null}},PURCHASED_ITEMS_FESTIVITY_SET_CAN_PLAY_WOW_MOMENT:functi

Chrome Cache Entry: 226

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (970)
Category:	downloaded
Size (bytes):	1019
Entropy (8bit):	5.481455450518707
Encrypted:	false
SSDEEP:	24:wkU14HIuIuISm+mm7VOhR1RYIbTOZF7B7v/SlCxKqWeeUu5m:wkTH/bIm7VObfqZFN7vqYxKfv5m
MD5:	5489024A0568CEB2CCC181B8BA420A0F
SHA1:	121F6E3A6DE26A8DCF7A967C442A8509BC196CDC
SHA-256:	34048A4F2D6B0861798B4D37954DAC09E8071EBB63C8E9B6D8ADF20BE95BFF82
SHA-512:	1C9B0EEF72C329B62D8DBAD87C9BCD78E65C11EFC5075C8EE8120A62F803E0F97B78E9E481373DC88908B00B8D9A9675CA81038EFE05E65BF9E9F3247A8F8D15
Malicious:	false
URL:	https://discord.com/assets/b8160243347055e1f278.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["89273"],{361207:function(n,t,i){i.d(t,{DW:function(){return d},t3:function(){return f},w4:function(){return r}});var u=i(525654),e=i.n(u);i(271579),i(314897);var o=i(981631);let c="linux";function r(n){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1],i=arguments.length>2?arguments[2]:void 0;return"".concat(o.fzT.DESKTOP).concat(t?"/ptb":"","?platform=").concat(n).concat(null!=i?"&format=".concat(i):"")}function a(){var n;let t=arguments.length>0&&void 0!==arguments[0]?arguments[0]:null===(n=e().os)\|\|void 0===n?void 0:n.family;return null==t?"win":-1!==t.indexOf("Ubuntu")\|\|-1!==t.indexOf("Debian")\|\|-1!==t.indexOf("Fedora")\|\|-1!==t.indexOf("Red Hat")\|\|-1!==t.indexOf("SuSE")\|\|-1!==t.indexOf("Linux")?c:-1!==t.indexOf("OS X")?"osx":"win"}function d(n){return({win:"Windows",osx:"Mac",[c]:"Linux"})[a(n)]}function f(){let n=a();return r(n,!1,n===c?"tar.gz":null)}}}]);.//# sourceMappingURL=b8160243

Chrome Cache Entry: 227

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	4804
Entropy (8bit):	3.9838661314243433
Encrypted:	false
SSDEEP:	96:Ez1Y5tmUKv0bhb9lsqYnlV4XdUo4e7JR0Tn515GGNj1j:eWtRK8Z4qYnlV4Xdt6RGaj1j
MD5:	22FD790491653D837422D80E3500CF92
SHA1:	E0618307DDC1E06D85729819B115D0652ABB148C
SHA-256:	641B1091276BA75578C3D93F367F0D70BCBBA7C62A7F159C4307ACF0ED6C5CBE
SHA-512:	AD2100B9391969B160D3DE80C7310CF5706B89CD097D8B48D6DF0D96E9CFB73C15DDD487DF7773C28094A152EC9D4F8F6E6B718C96FAF734708018C65511266E
Malicious:	false
URL:	https://discord.com/assets/23a7a3fd6624342117bf.svg
Preview:	<svg fill="none" height="36" viewBox="0 0 130 36" width="130" xmlns="http://www.w3.org/2000/svg"><g fill="#fff"><path d="m27.5247 8.06243c-2.1034-.96349-4.3524-1.66374-6.7036-2.06243-.2888.51114-.6261 1.19861-.8587 1.74553-2.4995-.36802-4.9759-.36802-7.4293 0-.2326-.54692-.5777-1.23439-.869-1.74553-2.35376.39869-4.60533 1.1015-6.70864 2.06754-4.242451 6.27676-5.392506 12.39766-4.817478 18.43156 2.813808 2.0574 5.540698 3.3071 8.221628 4.1249.6619-.892 1.25228-1.8401 1.76089-2.8394-.96862-.3603-1.89634-.805-2.77294-1.3213.23259-.1686.46001-.345.67979-.5265 5.34655 2.4484 11.15555 2.4484 16.43815 0 .2224.1815.4498.3579.6798.5265-.8791.5188-1.8094.9635-2.778 1.3239.5086.9967 1.0964 1.9474 1.7609 2.8393 2.6834-.8178 5.4129-2.0675 8.2267-4.1274.6747-6.9949-1.1526-13.0595-4.8302-18.43667zm-16.6759 14.72587c-1.6049 0-2.92111-1.467-2.92111-3.2534s1.28807-3.2559 2.92111-3.2559c1.6331 0 2.9493 1.4669 2.9212 3.2559.0025 1.7864-1.2881 3.2534-2.9212 3.2534zm10.7952 0c-1.6049 0-2.9211-1.467-2.9211-3

Chrome Cache Entry: 228

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	137
Entropy (8bit):	4.832107377824175
Encrypted:	false
SSDEEP:	3:t6WH7W+lFAATcvcmJDmJS4RKb5KVErcHrFvR8hiJqGrqL0:t6Abli/c8mc4slmrFv2hiAe
MD5:	70275FE3104CF1D3388586AD8FFD478E
SHA1:	473EA46F5B22B5C7D14C39EE9C0C82811593883B
SHA-256:	3269CF3FDA7681388472225BAD39B6BB3B26088A0A03B6CD5796195F0114CE13
SHA-512:	044C0F8F1583FAEBA3A23FF2DF821A5A0E79C548DB3A6474614894DA2CB125476227407F865CF20D32DC7E4D9ADE09EBA6317EFB787EEED2570C0EBDFC401D2A
Malicious:	false
Preview:	<svg fill="none" height="8" viewBox="0 0 9 8" width="9" xmlns="http://www.w3.org/2000/svg"><path d="m4.5 0 4.5 8h-9z" fill="#fff"/></svg>

Chrome Cache Entry: 229

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11118)
Category:	dropped
Size (bytes):	11167
Entropy (8bit):	5.535074023387345
Encrypted:	false
SSDEEP:	192:YVQA29dyFDfqMgeYTllT06FJLviKriLZErOWD8yLg6T06oGL3rOhzus:QazsqP116In4zn
MD5:	8AAA605C48DC545F185CA77C921139D3
SHA1:	D2481F19DC4D8F4B161D3DD0B35B446FDC505446
SHA-256:	9ADEBA0225F0D293B735E83C05D1BB063F750C439CE8BCD7ED362D795CFD39B1
SHA-512:	469573F4D8F912DC151474F9ACA815F2A686C590408B20733E58C1C21F8DC71A26B2569B8052A8B67331D2DD2FA4E54AD7B4D953FEBC2DCA0676827AC0EFD377
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["52030"],{48550:function(e,t,s){s.d(t,{P:function(){return l}});var n=s(689938);let l={get webauthn(){return n.Z.Messages.MFA_V2_WEBAUTHN_NAME},get totp(){return n.Z.Messages.MFA_V2_TOTP_NAME},get sms(){return n.Z.Messages.MFA_V2_SMS_NAME},get password(){return n.Z.Messages.MFA_V2_PASSWORD_NAME},get backup(){return n.Z.Messages.MFA_V2_BACKUP_NAME}}},124860:function(e,t,s){s.d(t,{Cd:function(){return f},YR:function(){return S}}),s(47120),s(411104);var n=s(200651),l=s(192379),i=s(481060),r=s(447097),o=s(873124),a=s(248902),d=s(160511),u=s(51693),c=s(973810),h=s(689938);function f(e){var t,s;let{mfaChallenge:h,mfaFinish:f,onEarlyClose:m,onClose:S,width:_=440}=e,[g,x]=l.useState(null!==(s=null===(t=h.methods[0])\|\|void 0===t?void 0:t.type)&&void 0!==s?s:"select"),[E,C]=l.useState(g),p=async e=>{let{mfaType:t,data:s}=e;await f({mfaType:t,data:s,ticket:h.ticket}),null!=S&&S()},v={mfaChallenge:h,finish:p,setSli

\Device\Null

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.003997527334849
Encrypted:	false
SSDEEP:	3:HnRthLK5a6eCMABe:HRoJPO
MD5:	DF5DC1ABC0D52F3C9E931E26A7C0065C
SHA1:	EE84123D3B3BC440C63DFE65FF5616BE2B0904D5
SHA-256:	F7167A2FACDE50428D8D2697A1CDFF075DE809323DD16D62B65CDD103B2A9A6D
SHA-512:	9B2253CE41880D22A2DDF4F886BB6CB22FF0C981400CD9D03A1FCA81DE5FAEB86C26B85B66ECEC960816D7BBE9740843890F2FCCD334B6D274295A32A8E6A4E9
Malicious:	false
Preview:	The system cannot find the file specified...

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.422819819076701
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Fa1QSXjTZD.exe
File size:	506'368 bytes
MD5:	43a2789db11a7a83ca1250ffbc135210
SHA1:	564b660762081a9c6ef729c0fe388d8465ea05e1
SHA256:	04e4e646de39b18d7a9b4fe567dfdc986e21e469813f0069220649d26aed862d
SHA512:	99322803668abb4872f772c8a6de65941ee7800f5dc5b640199431fbb6e1d1c536ea5692b512399e3694fce1634d464f67ef6f27388bdeaaaa388b4c95f04cb3
SSDEEP:	6144:Z9+RLZJfdbnHCBD53HuOWejxjYhxmvC2BdVnDTtUvTWxerIGNRJmB5QsWwuwVk:Z96LZ14tXuOWGJYhH2bBDRGWg9FvsWb
TLSH:	56B46C57A7A807E9D1A7D03CC547C603E7B6B49913109BDB43A0CA791F63BE16E3A720
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........V...V...V..._.+.B...PHE.^...PH..v...PH..\...PH..R...PH..P.......A...V...s.......?...9H..T...9H..W...9HG.W...9H..W...RichV..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14005f9e8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6716AC54 [Mon Oct 21 19:32:36 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3dd1b7e6418973ac2798d88d33677d96

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F11ACF36F38h
dec eax
add esp, 28h
jmp 00007F11ACF36827h
int3
int3
jmp 00007F11ACF371E8h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0000177Bh]
dec eax
mov ecx, ebx
call dword ptr [000016E2h]
call dword ptr [00001764h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00001760h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [00001754h]
test eax, eax
je 00007F11ACF369B9h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [00018E02h]
call 00007F11ACF36B7Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00018EE9h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [00018E79h], eax
dec eax
mov eax, dword ptr [00018ED2h]
dec eax
mov dword ptr [00018D43h], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [00018E47h], eax
mov dword ptr [00018D1Dh], C0000409h
mov dword ptr [00018D17h], 00000001h
mov dword ptr [00000021h], 00000000h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x760f0	0x1cc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7d000	0x1e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x79000	0x3f84	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7e000	0x4e4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x6ffc0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x70080	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x6fe80	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x61000	0x818	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5fdb8	0x5fe00	4c119431b1c4f1a4b978717b363fe625	False	0.5327855076597132	data	6.336342868180684	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x61000	0x16b92	0x16c00	5f240a889c54932065c9a97254c2be1f	False	0.3797111092032967	data	5.583183874219138	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x78000	0xdf8	0x400	8b38ae6f06355583ba0f3c56432282da	False	0.2138671875	data	2.4344166528039173	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x79000	0x3f84	0x4000	ab64069b65bd47caec1442569966712c	False	0.48236083984375	data	5.778262616931933	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x7d000	0x1e8	0x200	7d03a0f9d3c3a10dec18b513161e66d8	False	0.54296875	data	4.772037401703051	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7e000	0x4e4	0x600	39326fb49822ad82593e9e49b5e608b8	False	0.5123697916666666	data	4.849267575521713	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x7d060	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
KERNEL32.dll	WideCharToMultiByte, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, GetTickCount, QueryPerformanceCounter, VerifyVersionInfoA, LoadLibraryA, GetProcAddress, GetModuleHandleA, FreeLibrary, GetSystemDirectoryA, CreateFileA, VerSetConditionMask, SleepEx, LeaveCriticalSection, EnterCriticalSection, FormatMessageA, SetLastError, CloseHandle, GetCurrentProcess, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetModuleHandleW, GetCurrentProcessId, GetCurrentThreadId, GetFileSizeEx, WaitForMultipleObjects, PeekNamedPipe, ReadFile, GetFileType, GetEnvironmentVariableA, MultiByteToWideChar, WaitForSingleObjectEx, QueryPerformanceFrequency, GetSystemTimeAsFileTime, MoveFileExA, DeleteCriticalSection, GetLastError, InitializeCriticalSectionEx, OutputDebugStringW, InitializeSListHead, GetConsoleWindow, SetConsoleTitleA, SetConsoleTextAttribute, Sleep, GetStdHandle
USER32.dll	GetWindowLongPtrA, SetWindowLongPtrA, MessageBoxA, SetLayeredWindowAttributes
ADVAPI32.dll	CryptAcquireContextA, CryptReleaseContext, CryptGetHashParam, CryptGenRandom, CryptCreateHash, CryptHashData, CryptDestroyHash, CryptDestroyKey, CryptImportKey, CryptEncrypt
SHELL32.dll	ShellExecuteA
MSVCP140.dll	?_Xlength_error@std@@YAXPEBD@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z, ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?uncaught_exception@std@@YA_NXZ, ?_Xbad_function_call@std@@YAXXZ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
urlmon.dll	URLDownloadToFileA
Normaliz.dll	IdnToAscii
WLDAP32.dll
CRYPT32.dll	CertGetCertificateChain, CertFreeCertificateChainEngine, CertCreateCertificateChainEngine, CryptQueryObject, CertGetNameStringA, CertFindExtension, CertAddCertificateContextToStore, CertFreeCertificateChain, PFXImportCertStore, CryptStringToBinaryA, CertFreeCertificateContext, CertFindCertificateInStore, CertEnumCertificatesInStore, CertCloseStore, CertOpenStore, CryptDecodeObjectEx
WS2_32.dll	gethostname, sendto, recvfrom, freeaddrinfo, getaddrinfo, select, ioctlsocket, listen, htonl, accept, WSACleanup, WSAStartup, WSAIoctl, WSASetLastError, socket, setsockopt, ntohs, htons, getsockopt, getsockname, getpeername, connect, bind, WSAGetLastError, send, recv, closesocket, ntohl, __WSAFDIsSet
VCRUNTIME140.dll	__std_exception_copy, __std_exception_destroy, _CxxThrowException, memcpy, memset, __std_terminate, __C_specific_handler, __current_exception_context, __current_exception, memchr, memcmp, strchr, strstr, memmove, strrchr
VCRUNTIME140_1.dll	__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0.dll	_invalid_parameter_noinfo_noreturn, _beginthreadex, _errno, __sys_nerr, _getpid, exit, system, terminate, _register_thread_local_exe_atexit_callback, _configure_narrow_argv, _initialize_narrow_environment, _initialize_onexit_table, _register_onexit_function, _crt_atexit, _cexit, _seh_filter_exe, _set_app_type, strerror, _c_exit, _initterm, _initterm_e, _exit, __p___argv, __p___argc, _get_initial_narrow_environment
api-ms-win-crt-heap-l1-1-0.dll	realloc, _callnewh, free, calloc, _set_new_mode, malloc
api-ms-win-crt-utility-l1-1-0.dll	rand, qsort
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vfprintf, fseek, feof, __p__commode, __acrt_iob_func, ftell, fputc, _lseeki64, _read, _write, _close, _open, fflush, __stdio_common_vsscanf, __stdio_common_vsprintf, fread, fputs, fopen, fwrite, fgets, fclose, _set_fmode
api-ms-win-crt-convert-l1-1-0.dll	strtod, atoi, strtoul, strtoull, strtol, strtoll
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale, localeconv
api-ms-win-crt-time-l1-1-0.dll	_time64, _gmtime64
api-ms-win-crt-string-l1-1-0.dll	strcmp, strncmp, isupper, strcspn, strspn, _strdup, strncpy, tolower, strpbrk
api-ms-win-crt-filesystem-l1-1-0.dll	_stat64, _unlink, _access, _fstat64
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr, _dclass

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 09:16:01.695301056 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:01.695467949 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:01.701175928 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:01.701193094 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:01.701483965 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:01.713900089 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:01.755332947 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:01.937462091 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:01.937494993 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:01.937511921 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:01.937614918 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:01.937652111 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:01.937706947 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:01.968624115 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:01.968655109 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:01.968764067 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:01.968787909 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:01.968837976 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.054548025 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.054578066 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.054744005 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.054776907 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.054841995 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.084939957 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.084959030 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.085084915 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.085119009 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.085244894 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.086874008 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.086893082 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.086942911 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.086954117 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.086977959 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.087001085 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.171125889 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.171158075 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.171248913 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.171286106 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.171303988 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.171355009 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.172054052 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.172075987 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.172136068 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.172144890 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.172228098 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.201898098 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.201950073 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.202034950 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.202050924 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.202064991 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.202094078 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.203440905 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.203489065 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.203527927 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.203536987 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.203584909 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.203608990 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.204436064 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.204488993 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.204520941 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.204528093 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.204556942 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.204574108 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.206233025 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.206285954 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.206332922 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.206341028 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.206371069 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.206388950 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.257858992 CEST	49676	443	192.168.2.9	23.206.229.209
Oct 24, 2024 09:16:02.257946968 CEST	49675	443	192.168.2.9	23.206.229.209
Oct 24, 2024 09:16:02.288357019 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.288388968 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.288470984 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.288486004 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.288535118 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.289752960 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.289772987 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.289839983 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.289849997 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.289895058 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.290035963 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.290097952 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.290102959 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.290116072 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.290150881 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.290673971 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.290695906 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.290705919 CEST	49706	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.290713072 CEST	443	49706	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.333268881 CEST	49708	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.333314896 CEST	49707	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.333324909 CEST	443	49708	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.333347082 CEST	443	49707	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.333456993 CEST	49708	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.334502935 CEST	49707	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.334911108 CEST	49708	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.334920883 CEST	49709	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.334928036 CEST	443	49708	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.334975004 CEST	443	49709	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.335006952 CEST	49707	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.335021973 CEST	443	49707	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.335038900 CEST	49709	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.335144997 CEST	49709	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.335153103 CEST	443	49709	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.336193085 CEST	49710	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.336205959 CEST	443	49710	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.336256981 CEST	49710	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.336848021 CEST	49711	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.336855888 CEST	443	49711	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.336937904 CEST	49710	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.336952925 CEST	443	49710	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.336958885 CEST	49711	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.337023973 CEST	49711	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:02.337032080 CEST	443	49711	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:02.523467064 CEST	49674	443	192.168.2.9	23.206.229.209
Oct 24, 2024 09:16:03.093902111 CEST	443	49707	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.098571062 CEST	443	49709	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.104599953 CEST	443	49711	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.104964972 CEST	443	49710	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.105403900 CEST	49707	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.105422974 CEST	443	49707	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.105988979 CEST	49707	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.105993986 CEST	443	49707	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.107305050 CEST	443	49708	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.107745886 CEST	49708	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.107759953 CEST	443	49708	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.108253002 CEST	49708	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.108258963 CEST	443	49708	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.108462095 CEST	49709	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.108479977 CEST	443	49709	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.108897924 CEST	49709	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.108906984 CEST	443	49709	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.112406015 CEST	49711	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.112417936 CEST	443	49711	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.112905979 CEST	49711	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.112911940 CEST	443	49711	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.113372087 CEST	49710	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.113388062 CEST	443	49710	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.116801977 CEST	49710	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.116806984 CEST	443	49710	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.241595030 CEST	443	49707	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.241621971 CEST	443	49707	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.241691113 CEST	49707	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.241705894 CEST	443	49707	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.241745949 CEST	49707	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.241753101 CEST	443	49707	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.241791010 CEST	443	49707	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.241833925 CEST	49707	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.243812084 CEST	443	49709	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.243875027 CEST	443	49709	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.243961096 CEST	49709	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.243994951 CEST	443	49709	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.244020939 CEST	443	49709	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.244045973 CEST	49709	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.244086027 CEST	49709	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.248538971 CEST	443	49711	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.248586893 CEST	443	49711	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.248642921 CEST	49711	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.248655081 CEST	443	49711	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.248723030 CEST	443	49711	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.248775005 CEST	49711	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.249347925 CEST	443	49708	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.249401093 CEST	443	49708	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.249449968 CEST	49708	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.252831936 CEST	443	49710	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.252926111 CEST	443	49710	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.252990007 CEST	49707	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.252990007 CEST	49710	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.252999067 CEST	443	49707	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.253045082 CEST	49707	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.253050089 CEST	443	49707	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.255563974 CEST	49710	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.255578041 CEST	443	49710	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.255589008 CEST	49710	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.255594015 CEST	443	49710	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.271182060 CEST	49709	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.271203995 CEST	443	49709	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.271228075 CEST	49709	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.271238089 CEST	443	49709	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.279814959 CEST	49711	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.279823065 CEST	443	49711	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.279848099 CEST	49711	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.279853106 CEST	443	49711	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.280846119 CEST	49708	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.280877113 CEST	443	49708	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.280893087 CEST	49708	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.280900002 CEST	443	49708	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.285248041 CEST	49712	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.285269976 CEST	443	49712	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.285330057 CEST	49712	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.285387039 CEST	49713	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.285423994 CEST	443	49713	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.285471916 CEST	49713	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.298563957 CEST	49712	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.298582077 CEST	443	49712	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.299009085 CEST	49713	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.299029112 CEST	443	49713	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.312300920 CEST	49714	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.312321901 CEST	443	49714	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.312382936 CEST	49714	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.312601089 CEST	49714	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.312616110 CEST	443	49714	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.313292027 CEST	49715	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.313314915 CEST	443	49715	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.313404083 CEST	49715	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.323803902 CEST	49716	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.323848963 CEST	443	49716	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.323911905 CEST	49716	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.324450016 CEST	49715	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.324464083 CEST	443	49715	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:03.332385063 CEST	49716	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:03.332406998 CEST	443	49716	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.086338997 CEST	443	49712	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.087136030 CEST	49712	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.087171078 CEST	443	49712	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.087212086 CEST	443	49715	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.087466955 CEST	49715	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.087495089 CEST	443	49715	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.087521076 CEST	49712	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.087527037 CEST	443	49712	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.087918997 CEST	49715	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.087925911 CEST	443	49715	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.088470936 CEST	443	49713	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.088972092 CEST	49713	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.088988066 CEST	443	49713	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.089404106 CEST	49713	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.089409113 CEST	443	49713	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.094124079 CEST	443	49716	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.094471931 CEST	49716	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.094496965 CEST	443	49716	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.094841003 CEST	49716	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.094849110 CEST	443	49716	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.228408098 CEST	443	49712	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.228646040 CEST	443	49712	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.228713036 CEST	49712	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.228753090 CEST	49712	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.228769064 CEST	443	49712	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.228777885 CEST	49712	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.228782892 CEST	443	49712	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.232726097 CEST	49717	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.232762098 CEST	443	49717	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.232830048 CEST	49717	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.232964039 CEST	49717	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.232980013 CEST	443	49717	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.233275890 CEST	443	49715	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.233349085 CEST	443	49715	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.233397007 CEST	49715	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.233505011 CEST	49715	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.233520985 CEST	443	49715	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.233534098 CEST	49715	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.233539104 CEST	443	49715	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.234925032 CEST	443	49713	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.235124111 CEST	443	49713	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.235204935 CEST	49713	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.235248089 CEST	49713	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.235251904 CEST	443	49713	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.235263109 CEST	49713	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.235266924 CEST	443	49713	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.235678911 CEST	49718	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.235690117 CEST	443	49718	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.235769033 CEST	49718	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.235887051 CEST	49718	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.235898972 CEST	443	49718	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.237291098 CEST	49719	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.237298965 CEST	443	49719	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.237365961 CEST	49719	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.237489939 CEST	49719	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.237502098 CEST	443	49719	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.240911007 CEST	443	49716	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.240964890 CEST	443	49716	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.241014004 CEST	49716	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.241123915 CEST	49716	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.241123915 CEST	49716	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.241134882 CEST	443	49716	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.241146088 CEST	443	49716	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.243139982 CEST	49720	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.243168116 CEST	443	49720	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.243242979 CEST	49720	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.243354082 CEST	49720	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.243366957 CEST	443	49720	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.286906004 CEST	443	49714	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.287508965 CEST	49714	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.287523985 CEST	443	49714	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.287844896 CEST	49714	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.287849903 CEST	443	49714	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.436110973 CEST	443	49714	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.436255932 CEST	443	49714	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.436436892 CEST	49714	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.436489105 CEST	49714	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.436494112 CEST	443	49714	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.436506033 CEST	49714	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.436510086 CEST	443	49714	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.439095020 CEST	49721	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.439119101 CEST	443	49721	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.439197063 CEST	49721	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.439333916 CEST	49721	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:04.439343929 CEST	443	49721	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:04.601521015 CEST	49677	443	192.168.2.9	20.189.173.11
Oct 24, 2024 09:16:05.001195908 CEST	443	49720	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.002022982 CEST	49720	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.002042055 CEST	443	49720	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.002517939 CEST	49720	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.002523899 CEST	443	49720	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.005182981 CEST	443	49718	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.005470991 CEST	49718	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.005487919 CEST	443	49718	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.005811930 CEST	49718	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.005816936 CEST	443	49718	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.014486074 CEST	443	49719	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.014791965 CEST	49719	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.014806986 CEST	443	49719	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.015120029 CEST	49719	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.015125990 CEST	443	49719	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.015207052 CEST	443	49717	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.015427113 CEST	49717	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.015434027 CEST	443	49717	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.015750885 CEST	49717	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.015754938 CEST	443	49717	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.140100956 CEST	443	49720	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.140152931 CEST	443	49720	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.140331984 CEST	49720	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.140578032 CEST	49720	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.140595913 CEST	443	49720	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.140619040 CEST	49720	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.140625000 CEST	443	49720	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.143572092 CEST	49722	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.143606901 CEST	443	49722	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.143707991 CEST	49722	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.143867970 CEST	49722	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.143873930 CEST	443	49722	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.145623922 CEST	443	49718	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.145742893 CEST	443	49718	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.145811081 CEST	49718	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.145868063 CEST	49718	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.145874023 CEST	443	49718	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.145884037 CEST	49718	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.145886898 CEST	443	49718	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.148008108 CEST	49723	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.148020983 CEST	443	49723	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.148101091 CEST	49723	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.148231030 CEST	49723	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.148237944 CEST	443	49723	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.152009964 CEST	443	49717	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.152204990 CEST	443	49717	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.152261019 CEST	49717	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.152287960 CEST	49717	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.152295113 CEST	443	49717	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.152307034 CEST	49717	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.152311087 CEST	443	49717	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.154113054 CEST	49724	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.154159069 CEST	443	49724	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.154237032 CEST	49724	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.154356003 CEST	49724	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.154370070 CEST	443	49724	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.155283928 CEST	443	49719	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.155368090 CEST	443	49719	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.155422926 CEST	49719	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.155510902 CEST	49719	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.155519009 CEST	443	49719	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.155531883 CEST	49719	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.155535936 CEST	443	49719	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.157412052 CEST	49725	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.157448053 CEST	443	49725	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.157527924 CEST	49725	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.157644033 CEST	49725	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.157658100 CEST	443	49725	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.200622082 CEST	443	49721	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.201114893 CEST	49721	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.201126099 CEST	443	49721	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.201605082 CEST	49721	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.201610088 CEST	443	49721	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.352272987 CEST	443	49721	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.352538109 CEST	443	49721	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.352608919 CEST	49721	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.353523970 CEST	49721	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.353533983 CEST	443	49721	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.353564024 CEST	49721	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.353569031 CEST	443	49721	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.357749939 CEST	49726	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.357775927 CEST	443	49726	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.357850075 CEST	49726	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.357983112 CEST	49726	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.357995987 CEST	443	49726	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.804707050 CEST	49673	443	192.168.2.9	204.79.197.203
Oct 24, 2024 09:16:05.927155018 CEST	443	49723	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.927715063 CEST	49723	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.927731037 CEST	443	49723	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.928193092 CEST	49723	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.928200006 CEST	443	49723	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.932796955 CEST	443	49722	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.933428049 CEST	49722	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.933446884 CEST	443	49722	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.933583021 CEST	49722	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.933588982 CEST	443	49722	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.938766003 CEST	443	49724	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.939177036 CEST	49724	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.939189911 CEST	443	49724	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.939519882 CEST	49724	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.939524889 CEST	443	49724	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.943722010 CEST	443	49725	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.944010019 CEST	49725	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.944024086 CEST	443	49725	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:05.944346905 CEST	49725	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:05.944353104 CEST	443	49725	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.066843987 CEST	443	49723	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.066956997 CEST	443	49723	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.067024946 CEST	49723	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.067217112 CEST	49723	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.067233086 CEST	443	49723	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.067243099 CEST	49723	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.067249060 CEST	443	49723	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.070269108 CEST	49727	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.070308924 CEST	443	49727	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.070426941 CEST	49727	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.070594072 CEST	49727	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.070602894 CEST	443	49727	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.073889971 CEST	443	49722	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.074064016 CEST	443	49722	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.074120998 CEST	49722	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.074147940 CEST	49722	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.074161053 CEST	443	49722	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.074181080 CEST	49722	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.074187040 CEST	443	49722	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.076246023 CEST	49728	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.076256990 CEST	443	49728	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.076355934 CEST	49728	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.076473951 CEST	49728	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.076487064 CEST	443	49728	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.079299927 CEST	443	49724	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.079895973 CEST	443	49724	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.079965115 CEST	49724	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.079992056 CEST	49724	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.080008030 CEST	443	49724	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.080018044 CEST	49724	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.080023050 CEST	443	49724	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.082139969 CEST	49729	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.082160950 CEST	443	49729	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.082228899 CEST	49729	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.082340002 CEST	49729	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.082351923 CEST	443	49729	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.085642099 CEST	443	49725	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.085983038 CEST	443	49725	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.086044073 CEST	49725	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.086076021 CEST	49725	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.086076021 CEST	49725	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.086086988 CEST	443	49725	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.086095095 CEST	443	49725	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.087846994 CEST	49730	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.087858915 CEST	443	49730	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.087991953 CEST	49730	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.088136911 CEST	49730	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.088150978 CEST	443	49730	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.139470100 CEST	443	49726	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.142298937 CEST	49726	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.142328024 CEST	443	49726	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.143024921 CEST	49726	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.143033028 CEST	443	49726	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.282099962 CEST	443	49726	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.282197952 CEST	443	49726	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.282280922 CEST	49726	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.282677889 CEST	49726	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.282696009 CEST	443	49726	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.282706976 CEST	49726	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.282711983 CEST	443	49726	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.285701990 CEST	49731	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.285722017 CEST	443	49731	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.285775900 CEST	49731	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.286206007 CEST	49731	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.286216021 CEST	443	49731	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.831331015 CEST	443	49728	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.834224939 CEST	443	49727	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.834875107 CEST	49728	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.834886074 CEST	443	49728	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.835021019 CEST	49727	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.835035086 CEST	443	49727	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.835377932 CEST	49728	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.835381985 CEST	443	49728	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.835500956 CEST	49727	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.835505962 CEST	443	49727	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.838525057 CEST	443	49729	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.842742920 CEST	49729	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.842755079 CEST	443	49729	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.843147993 CEST	49729	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.843153000 CEST	443	49729	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.845592022 CEST	443	49730	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.846837997 CEST	49730	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.846849918 CEST	443	49730	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.847191095 CEST	49730	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.847196102 CEST	443	49730	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.969575882 CEST	443	49728	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.970308065 CEST	443	49728	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.970443964 CEST	49728	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.970648050 CEST	49728	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.970648050 CEST	49728	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.970669031 CEST	443	49728	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.970679998 CEST	443	49728	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.971064091 CEST	443	49727	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.971425056 CEST	443	49727	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.974698067 CEST	49727	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.974698067 CEST	49727	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.974725962 CEST	49727	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.974730015 CEST	443	49727	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.976497889 CEST	443	49729	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.976564884 CEST	443	49729	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.976632118 CEST	49729	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.976799965 CEST	49729	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.976809025 CEST	443	49729	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.976819038 CEST	49729	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.976828098 CEST	443	49729	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.983688116 CEST	443	49730	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.984512091 CEST	443	49730	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.984581947 CEST	49730	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.984613895 CEST	49730	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.984613895 CEST	49730	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:06.984620094 CEST	443	49730	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:06.984628916 CEST	443	49730	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.049590111 CEST	49732	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.049608946 CEST	443	49732	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.049819946 CEST	49732	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.049895048 CEST	49733	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.049943924 CEST	443	49733	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.049998999 CEST	49733	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.050195932 CEST	49732	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.050208092 CEST	443	49732	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.050452948 CEST	49733	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.050468922 CEST	443	49733	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.050570011 CEST	49734	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.050578117 CEST	443	49734	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.050628901 CEST	49734	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.050705910 CEST	49734	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.050719023 CEST	443	49734	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.051425934 CEST	49735	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.051438093 CEST	443	49735	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.051508904 CEST	49735	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.051697969 CEST	49735	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.051717043 CEST	443	49735	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.055497885 CEST	443	49731	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.056070089 CEST	49731	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.056087017 CEST	443	49731	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.056555033 CEST	49731	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.056560040 CEST	443	49731	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.199928045 CEST	443	49731	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.200246096 CEST	443	49731	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.200300932 CEST	49731	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.201967955 CEST	49731	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.201980114 CEST	443	49731	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.201992035 CEST	49731	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.201996088 CEST	443	49731	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.204885960 CEST	49736	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.204922915 CEST	443	49736	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.204993010 CEST	49736	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.205151081 CEST	49736	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.205166101 CEST	443	49736	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.807351112 CEST	443	49732	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.808239937 CEST	49732	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.808249950 CEST	443	49732	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.808444977 CEST	443	49733	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.808733940 CEST	49732	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.808737040 CEST	443	49732	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.809990883 CEST	49733	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.810005903 CEST	443	49733	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.810564041 CEST	49733	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.810569048 CEST	443	49733	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.812195063 CEST	443	49735	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.812597036 CEST	49735	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.812604904 CEST	443	49735	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.812911034 CEST	49735	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.812915087 CEST	443	49735	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.817969084 CEST	443	49734	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.818262100 CEST	49734	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.818281889 CEST	443	49734	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.818808079 CEST	49734	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.818814039 CEST	443	49734	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.944396019 CEST	443	49733	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.944559097 CEST	443	49733	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.944632053 CEST	49733	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.944909096 CEST	49733	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.944909096 CEST	49733	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.944932938 CEST	443	49733	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.944941998 CEST	443	49733	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.945519924 CEST	443	49732	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.945651054 CEST	443	49732	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.945703983 CEST	49732	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.948756933 CEST	49732	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.948770046 CEST	443	49732	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.948781967 CEST	49732	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.948786974 CEST	443	49732	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.950598955 CEST	443	49735	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.950897932 CEST	443	49735	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.950962067 CEST	49735	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.954150915 CEST	443	49736	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.955789089 CEST	443	49734	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.955811024 CEST	49735	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.955811024 CEST	49735	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.955818892 CEST	443	49735	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.955827951 CEST	443	49735	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.956417084 CEST	443	49734	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.956475019 CEST	49734	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.957715988 CEST	49734	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.957722902 CEST	443	49734	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.957746029 CEST	49734	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.957750082 CEST	443	49734	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.957813025 CEST	49736	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.957834959 CEST	443	49736	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.958266973 CEST	49736	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.958271980 CEST	443	49736	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.962558985 CEST	49737	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.962596893 CEST	443	49737	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.962650061 CEST	49737	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.965224981 CEST	49738	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.965259075 CEST	443	49738	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.965315104 CEST	49738	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.966623068 CEST	49739	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.966633081 CEST	443	49739	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.966691971 CEST	49739	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.966922998 CEST	49739	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.966934919 CEST	443	49739	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.974920988 CEST	49740	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.974961042 CEST	443	49740	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.975013018 CEST	49740	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.975687981 CEST	49737	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.975702047 CEST	443	49737	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.975791931 CEST	49738	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.975811958 CEST	443	49738	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:07.977639914 CEST	49740	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:07.977655888 CEST	443	49740	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.093117952 CEST	443	49736	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.093188047 CEST	443	49736	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.093238115 CEST	49736	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:08.100944042 CEST	49736	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:08.100963116 CEST	443	49736	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.100974083 CEST	49736	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:08.100980043 CEST	443	49736	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.110240936 CEST	49741	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:08.110285997 CEST	443	49741	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.110367060 CEST	49741	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:08.112507105 CEST	49741	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:08.112535954 CEST	443	49741	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.735414982 CEST	443	49740	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.738106966 CEST	443	49737	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.744374990 CEST	443	49739	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.750957012 CEST	443	49738	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.756357908 CEST	49740	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:08.756375074 CEST	443	49740	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.756809950 CEST	49740	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:08.756814003 CEST	443	49740	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.757103920 CEST	49737	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:08.757122040 CEST	443	49737	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.757841110 CEST	49737	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:08.757844925 CEST	443	49737	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.758171082 CEST	49739	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:08.758183002 CEST	443	49739	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.758724928 CEST	49739	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:08.758728981 CEST	443	49739	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.763583899 CEST	49738	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:08.763612032 CEST	443	49738	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.764173985 CEST	49738	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:08.764180899 CEST	443	49738	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.882852077 CEST	443	49741	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.889818907 CEST	443	49740	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.889952898 CEST	443	49740	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.890072107 CEST	49740	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:08.892929077 CEST	443	49737	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.893012047 CEST	443	49737	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.893095016 CEST	49737	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:08.894536018 CEST	443	49739	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.894591093 CEST	443	49739	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.894656897 CEST	49739	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:08.901305914 CEST	443	49738	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.901453972 CEST	443	49738	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:08.901542902 CEST	49738	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:08.929646015 CEST	49741	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.126633883 CEST	49741	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.126677990 CEST	443	49741	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:09.127264023 CEST	49741	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.127271891 CEST	443	49741	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:09.127664089 CEST	49738	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.127696037 CEST	443	49738	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:09.127707958 CEST	49738	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.127715111 CEST	443	49738	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:09.130021095 CEST	49740	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.130048037 CEST	443	49740	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:09.131506920 CEST	49737	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.131520987 CEST	443	49737	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:09.134577036 CEST	49739	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.134582996 CEST	443	49739	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:09.134593964 CEST	49739	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.134599924 CEST	443	49739	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:09.267040968 CEST	443	49741	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:09.267115116 CEST	443	49741	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:09.267194986 CEST	49741	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.420481920 CEST	49742	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.420517921 CEST	443	49742	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:09.420592070 CEST	49742	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.425272942 CEST	49741	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.425307989 CEST	443	49741	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:09.425321102 CEST	49741	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.425328016 CEST	443	49741	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:09.433759928 CEST	49742	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.433774948 CEST	443	49742	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:09.438194990 CEST	49743	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.438215017 CEST	443	49743	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:09.438281059 CEST	49743	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.438786030 CEST	49744	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.438826084 CEST	443	49744	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:09.438890934 CEST	49744	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.439109087 CEST	49744	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.439124107 CEST	443	49744	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:09.439498901 CEST	49745	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.439528942 CEST	443	49745	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:09.439591885 CEST	49745	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.439801931 CEST	49745	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.439816952 CEST	443	49745	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:09.439946890 CEST	49743	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.439960957 CEST	443	49743	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:09.440382957 CEST	49746	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.440395117 CEST	443	49746	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:09.440450907 CEST	49746	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.440601110 CEST	49746	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:09.440615892 CEST	443	49746	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:09.883833885 CEST	49751	443	192.168.2.9	104.26.1.5
Oct 24, 2024 09:16:09.883873940 CEST	443	49751	104.26.1.5	192.168.2.9
Oct 24, 2024 09:16:09.883939028 CEST	49751	443	192.168.2.9	104.26.1.5
Oct 24, 2024 09:16:09.893368959 CEST	49751	443	192.168.2.9	104.26.1.5
Oct 24, 2024 09:16:09.893388987 CEST	443	49751	104.26.1.5	192.168.2.9
Oct 24, 2024 09:16:10.194888115 CEST	443	49742	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.195740938 CEST	49742	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.195753098 CEST	443	49742	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.196305990 CEST	49742	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.196310997 CEST	443	49742	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.201035023 CEST	443	49746	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.201638937 CEST	49746	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.201672077 CEST	443	49746	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.202003002 CEST	49746	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.202009916 CEST	443	49746	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.208559036 CEST	443	49743	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.209026098 CEST	49743	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.209059000 CEST	443	49743	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.209470034 CEST	49743	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.209475994 CEST	443	49743	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.210602045 CEST	443	49745	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.211072922 CEST	443	49744	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.211085081 CEST	49745	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.211103916 CEST	443	49745	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.211764097 CEST	49745	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.211770058 CEST	443	49745	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.212603092 CEST	49744	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.212621927 CEST	443	49744	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.213016033 CEST	49744	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.213021994 CEST	443	49744	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.334923983 CEST	443	49742	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.334985971 CEST	443	49742	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.335243940 CEST	49742	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.335453987 CEST	49742	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.335467100 CEST	443	49742	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.335477114 CEST	49742	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.335481882 CEST	443	49742	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.339065075 CEST	443	49746	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.339085102 CEST	49752	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.339131117 CEST	443	49752	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.339138985 CEST	443	49746	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.339205027 CEST	49752	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.339267015 CEST	49746	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.339457989 CEST	49746	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.339457989 CEST	49746	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.339473009 CEST	443	49746	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.339482069 CEST	443	49746	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.339848995 CEST	49752	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.339871883 CEST	443	49752	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.342552900 CEST	49753	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.342587948 CEST	443	49753	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.342715979 CEST	49753	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.342858076 CEST	49753	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.342875004 CEST	443	49753	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.348711967 CEST	443	49743	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.348871946 CEST	443	49743	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.348931074 CEST	49743	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.349040031 CEST	49743	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.349056959 CEST	443	49743	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.349071026 CEST	49743	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.349076033 CEST	443	49743	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.351238012 CEST	443	49745	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.351448059 CEST	443	49745	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.351454020 CEST	443	49744	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.351530075 CEST	49745	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.351622105 CEST	443	49744	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.351696014 CEST	49744	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.357722998 CEST	49754	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.357767105 CEST	443	49754	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.357884884 CEST	49754	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.358980894 CEST	49754	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.359015942 CEST	443	49754	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.359318972 CEST	49745	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.359328032 CEST	443	49745	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.359343052 CEST	49745	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.359348059 CEST	443	49745	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.360371113 CEST	49744	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.360378027 CEST	443	49744	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.373177052 CEST	49755	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.373209000 CEST	443	49755	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.373390913 CEST	49755	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.374083996 CEST	49755	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.374099970 CEST	443	49755	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.374778986 CEST	49756	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.374800920 CEST	443	49756	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.374953032 CEST	49756	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.375034094 CEST	49756	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:10.375044107 CEST	443	49756	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:10.505412102 CEST	443	49751	104.26.1.5	192.168.2.9
Oct 24, 2024 09:16:10.505498886 CEST	49751	443	192.168.2.9	104.26.1.5
Oct 24, 2024 09:16:10.509989023 CEST	49751	443	192.168.2.9	104.26.1.5
Oct 24, 2024 09:16:10.509995937 CEST	443	49751	104.26.1.5	192.168.2.9
Oct 24, 2024 09:16:10.510293961 CEST	443	49751	104.26.1.5	192.168.2.9
Oct 24, 2024 09:16:10.513792992 CEST	49751	443	192.168.2.9	104.26.1.5
Oct 24, 2024 09:16:10.555342913 CEST	443	49751	104.26.1.5	192.168.2.9
Oct 24, 2024 09:16:10.663722038 CEST	443	49751	104.26.1.5	192.168.2.9
Oct 24, 2024 09:16:10.663784981 CEST	443	49751	104.26.1.5	192.168.2.9
Oct 24, 2024 09:16:10.663841963 CEST	49751	443	192.168.2.9	104.26.1.5
Oct 24, 2024 09:16:10.671685934 CEST	49751	443	192.168.2.9	104.26.1.5
Oct 24, 2024 09:16:10.671694994 CEST	443	49751	104.26.1.5	192.168.2.9
Oct 24, 2024 09:16:11.095000982 CEST	443	49753	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.095611095 CEST	49753	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.095623016 CEST	443	49753	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.096246958 CEST	49753	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.096251965 CEST	443	49753	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.131681919 CEST	443	49756	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.132245064 CEST	49756	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.132256985 CEST	443	49756	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.132975101 CEST	49756	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.132980108 CEST	443	49756	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.133622885 CEST	443	49755	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.134048939 CEST	49755	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.134063959 CEST	443	49755	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.134668112 CEST	49755	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.134674072 CEST	443	49755	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.135729074 CEST	443	49754	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.136287928 CEST	49754	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.136307955 CEST	443	49754	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.136820078 CEST	49754	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.136826038 CEST	443	49754	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.231550932 CEST	443	49753	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.231638908 CEST	443	49753	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.231722116 CEST	49753	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.232016087 CEST	49753	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.232017040 CEST	49753	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.232027054 CEST	443	49753	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.232068062 CEST	443	49753	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.234954119 CEST	49757	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.234977961 CEST	443	49757	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.235083103 CEST	49757	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.235372066 CEST	49757	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.235394001 CEST	443	49757	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.270363092 CEST	443	49756	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.270428896 CEST	443	49756	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.270533085 CEST	49756	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.270874977 CEST	49756	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.270891905 CEST	443	49756	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.270908117 CEST	49756	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.270915985 CEST	443	49756	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.271656990 CEST	443	49755	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.271827936 CEST	443	49755	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.272177935 CEST	49755	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.272248983 CEST	49755	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.272248983 CEST	49755	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.272260904 CEST	443	49755	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.272269011 CEST	443	49755	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.274656057 CEST	443	49754	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.274780989 CEST	443	49754	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.274919987 CEST	49754	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.277124882 CEST	49758	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.277160883 CEST	443	49758	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.277251959 CEST	49758	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.278162003 CEST	49754	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.278176069 CEST	443	49754	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.278186083 CEST	49754	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.278191090 CEST	443	49754	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.278434038 CEST	49759	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.278450966 CEST	443	49759	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.278517008 CEST	49759	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.279300928 CEST	49758	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.279304028 CEST	49759	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.279325008 CEST	443	49758	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.279333115 CEST	443	49759	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.281090021 CEST	49760	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.281126976 CEST	443	49760	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.281188011 CEST	49760	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.281356096 CEST	49760	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:11.281372070 CEST	443	49760	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:11.867147923 CEST	49676	443	192.168.2.9	23.206.229.209
Oct 24, 2024 09:16:11.867172003 CEST	49675	443	192.168.2.9	23.206.229.209
Oct 24, 2024 09:16:12.132762909 CEST	49674	443	192.168.2.9	23.206.229.209
Oct 24, 2024 09:16:12.165622950 CEST	443	49757	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.166562080 CEST	49757	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.166578054 CEST	443	49757	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.166826963 CEST	443	49759	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.167105913 CEST	443	49760	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.167310953 CEST	49757	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.167320967 CEST	443	49757	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.168303013 CEST	49759	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.168309927 CEST	443	49759	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.168885946 CEST	49759	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.168890953 CEST	443	49759	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.169404030 CEST	49760	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.169425011 CEST	443	49760	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.169519901 CEST	49760	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.169524908 CEST	443	49760	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.170511961 CEST	443	49758	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.170841932 CEST	49758	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.170850992 CEST	443	49758	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.171338081 CEST	49758	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.171354055 CEST	443	49758	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.300151110 CEST	443	49752	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.306818008 CEST	443	49759	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.307117939 CEST	443	49759	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.307172060 CEST	49759	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.307228088 CEST	443	49760	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.308096886 CEST	443	49760	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.308145046 CEST	49760	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.308171988 CEST	443	49757	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.308231115 CEST	443	49757	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.308276892 CEST	49757	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.311696053 CEST	443	49758	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.311891079 CEST	443	49758	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.311980009 CEST	49758	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.351521015 CEST	49752	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.372005939 CEST	49752	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.372014999 CEST	443	49752	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.372502089 CEST	49752	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.372508049 CEST	443	49752	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.372773886 CEST	49758	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.372773886 CEST	49758	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.372797012 CEST	443	49758	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.372807980 CEST	443	49758	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.376113892 CEST	49759	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.376137972 CEST	443	49759	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.376146078 CEST	49759	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.376151085 CEST	443	49759	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.377273083 CEST	49760	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.377294064 CEST	443	49760	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.377305031 CEST	49760	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.377311945 CEST	443	49760	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.378087044 CEST	49757	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.378093958 CEST	443	49757	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.378119946 CEST	49757	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.378123045 CEST	443	49757	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.390671015 CEST	49761	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.390710115 CEST	443	49761	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.390774965 CEST	49761	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.390980005 CEST	49762	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.391016006 CEST	443	49762	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.391073942 CEST	49762	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.391300917 CEST	49763	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.391309023 CEST	443	49763	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.391365051 CEST	49763	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.391498089 CEST	49763	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.391510010 CEST	443	49763	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.391525984 CEST	49762	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.391537905 CEST	443	49762	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.392174959 CEST	49764	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.392206907 CEST	443	49764	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.392265081 CEST	49764	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.393811941 CEST	49761	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.393824100 CEST	443	49761	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.394077063 CEST	49764	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.394093037 CEST	443	49764	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.509813070 CEST	443	49752	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.509881020 CEST	443	49752	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.509924889 CEST	49752	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.510164022 CEST	49752	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.510181904 CEST	443	49752	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.510195971 CEST	49752	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.510201931 CEST	443	49752	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.513160944 CEST	49765	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.513195038 CEST	443	49765	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:12.513258934 CEST	49765	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.513510942 CEST	49765	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:12.513525963 CEST	443	49765	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.144562006 CEST	443	49762	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.145139933 CEST	49762	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.145169973 CEST	443	49762	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.145694017 CEST	49762	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.145699024 CEST	443	49762	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.157706976 CEST	443	49764	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.158541918 CEST	49764	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.158571959 CEST	443	49764	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.159017086 CEST	49764	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.159025908 CEST	443	49764	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.164740086 CEST	443	49761	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.165250063 CEST	49761	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.165267944 CEST	443	49761	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.165693045 CEST	49761	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.165699005 CEST	443	49761	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.170764923 CEST	443	49763	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.171148062 CEST	49763	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.171155930 CEST	443	49763	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.171588898 CEST	49763	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.171595097 CEST	443	49763	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.268573046 CEST	443	49765	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.269172907 CEST	49765	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.269188881 CEST	443	49765	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.269716978 CEST	49765	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.269721985 CEST	443	49765	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.281933069 CEST	443	49762	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.282114029 CEST	443	49762	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.282169104 CEST	49762	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.282264948 CEST	49762	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.282277107 CEST	443	49762	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.282288074 CEST	49762	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.282293081 CEST	443	49762	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.285403967 CEST	49766	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.285443068 CEST	443	49766	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.285511017 CEST	49766	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.285767078 CEST	49766	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.285782099 CEST	443	49766	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.298019886 CEST	443	49764	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.298079014 CEST	443	49764	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.298307896 CEST	49764	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.298340082 CEST	49764	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.298351049 CEST	443	49764	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.298361063 CEST	49764	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.298365116 CEST	443	49764	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.301572084 CEST	49767	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.301600933 CEST	443	49767	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.301814079 CEST	49767	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.301986933 CEST	49767	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.301999092 CEST	443	49767	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.302103996 CEST	443	49761	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.302273035 CEST	443	49761	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.302346945 CEST	49761	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.302390099 CEST	49761	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.302402973 CEST	443	49761	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.302431107 CEST	49761	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.302437067 CEST	443	49761	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.307822943 CEST	49768	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.307871103 CEST	443	49768	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.307933092 CEST	49768	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.308180094 CEST	49768	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.308192015 CEST	443	49768	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.311780930 CEST	443	49763	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.311866999 CEST	443	49763	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.311925888 CEST	49763	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.312052965 CEST	49763	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.312061071 CEST	443	49763	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.312069893 CEST	49763	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.312072992 CEST	443	49763	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.314960957 CEST	49769	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.314985037 CEST	443	49769	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.315157890 CEST	49769	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.315157890 CEST	49769	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.315182924 CEST	443	49769	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.414840937 CEST	443	49765	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.414918900 CEST	443	49765	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.414995909 CEST	49765	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.438287973 CEST	49765	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.438301086 CEST	443	49765	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.438311100 CEST	49765	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.438317060 CEST	443	49765	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.442431927 CEST	49770	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.442471027 CEST	443	49770	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.442575932 CEST	49770	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.460262060 CEST	49770	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:13.460279942 CEST	443	49770	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:13.944255114 CEST	443	49704	23.206.229.209	192.168.2.9
Oct 24, 2024 09:16:13.944422960 CEST	49704	443	192.168.2.9	23.206.229.209
Oct 24, 2024 09:16:14.041346073 CEST	49773	443	192.168.2.9	162.159.130.234
Oct 24, 2024 09:16:14.041353941 CEST	443	49773	162.159.130.234	192.168.2.9
Oct 24, 2024 09:16:14.041614056 CEST	49773	443	192.168.2.9	162.159.130.234
Oct 24, 2024 09:16:14.043478966 CEST	49773	443	192.168.2.9	162.159.130.234
Oct 24, 2024 09:16:14.043488979 CEST	443	49773	162.159.130.234	192.168.2.9
Oct 24, 2024 09:16:14.049209118 CEST	443	49766	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.070888042 CEST	443	49767	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.072432041 CEST	443	49769	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.077322960 CEST	443	49768	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.102703094 CEST	49766	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.122425079 CEST	49767	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.122472048 CEST	49769	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.122478008 CEST	49768	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.126441956 CEST	49766	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.126455069 CEST	443	49766	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.127011061 CEST	49766	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.127017021 CEST	443	49766	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.129446030 CEST	49767	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.129451036 CEST	443	49767	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.129849911 CEST	49767	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.129854918 CEST	443	49767	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.130319118 CEST	49769	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.130326033 CEST	443	49769	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.130991936 CEST	49769	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.130997896 CEST	443	49769	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.131266117 CEST	49768	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.131273031 CEST	443	49768	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.131998062 CEST	49768	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.132003069 CEST	443	49768	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.212369919 CEST	49677	443	192.168.2.9	20.189.173.11
Oct 24, 2024 09:16:14.227035999 CEST	443	49770	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.262741089 CEST	443	49766	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.262829065 CEST	443	49766	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.262931108 CEST	49766	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.265894890 CEST	443	49767	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.266130924 CEST	443	49767	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.266189098 CEST	49767	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.267441034 CEST	443	49769	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.267606020 CEST	443	49769	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.267818928 CEST	49769	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.270869017 CEST	443	49768	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.271220922 CEST	443	49768	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.271286011 CEST	49768	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.276159048 CEST	49770	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.300770998 CEST	49770	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.300780058 CEST	443	49770	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.301311970 CEST	49770	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.301318884 CEST	443	49770	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.301525116 CEST	49768	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.301532984 CEST	443	49768	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.301556110 CEST	49768	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.301561117 CEST	443	49768	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.302891016 CEST	49766	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.302921057 CEST	443	49766	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.302949905 CEST	49766	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.302963972 CEST	443	49766	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.303118944 CEST	49767	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.303129911 CEST	443	49767	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.303143024 CEST	49767	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.303148031 CEST	443	49767	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.304543018 CEST	49769	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.304543018 CEST	49769	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.304559946 CEST	443	49769	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.304569006 CEST	443	49769	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.366267920 CEST	49775	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.366329908 CEST	443	49775	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.366631031 CEST	49775	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.366939068 CEST	49776	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.366971970 CEST	443	49776	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.367058992 CEST	49776	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.368124962 CEST	49777	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.368163109 CEST	443	49777	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.368226051 CEST	49777	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.368597984 CEST	49775	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.368639946 CEST	443	49775	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.368788958 CEST	49776	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.368805885 CEST	443	49776	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.368872881 CEST	49777	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.368884087 CEST	443	49777	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.369457960 CEST	49778	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.369476080 CEST	443	49778	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.369585991 CEST	49778	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.369879961 CEST	49778	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.369891882 CEST	443	49778	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.439971924 CEST	443	49770	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.440035105 CEST	443	49770	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.440107107 CEST	49770	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.442226887 CEST	49770	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.442245960 CEST	443	49770	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.484061003 CEST	49779	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.484092951 CEST	443	49779	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.484363079 CEST	49779	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.484842062 CEST	49779	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:14.484853983 CEST	443	49779	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:14.653106928 CEST	443	49773	162.159.130.234	192.168.2.9
Oct 24, 2024 09:16:14.698447943 CEST	49773	443	192.168.2.9	162.159.130.234
Oct 24, 2024 09:16:14.743680954 CEST	49773	443	192.168.2.9	162.159.130.234
Oct 24, 2024 09:16:14.743721962 CEST	443	49773	162.159.130.234	192.168.2.9
Oct 24, 2024 09:16:14.744985104 CEST	443	49773	162.159.130.234	192.168.2.9
Oct 24, 2024 09:16:14.745090961 CEST	49773	443	192.168.2.9	162.159.130.234
Oct 24, 2024 09:16:14.891671896 CEST	49773	443	192.168.2.9	162.159.130.234
Oct 24, 2024 09:16:14.891803026 CEST	443	49773	162.159.130.234	192.168.2.9
Oct 24, 2024 09:16:14.893309116 CEST	49773	443	192.168.2.9	162.159.130.234
Oct 24, 2024 09:16:14.893356085 CEST	443	49773	162.159.130.234	192.168.2.9
Oct 24, 2024 09:16:14.934540033 CEST	49773	443	192.168.2.9	162.159.130.234
Oct 24, 2024 09:16:15.028537035 CEST	443	49773	162.159.130.234	192.168.2.9
Oct 24, 2024 09:16:15.028594971 CEST	443	49773	162.159.130.234	192.168.2.9
Oct 24, 2024 09:16:15.028687954 CEST	49773	443	192.168.2.9	162.159.130.234
Oct 24, 2024 09:16:15.030010939 CEST	49773	443	192.168.2.9	162.159.130.234
Oct 24, 2024 09:16:15.030044079 CEST	443	49773	162.159.130.234	192.168.2.9
Oct 24, 2024 09:16:15.042751074 CEST	49782	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.042783976 CEST	443	49782	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.043051958 CEST	49782	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.043226004 CEST	49782	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.043239117 CEST	443	49782	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.129311085 CEST	443	49778	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.130003929 CEST	49778	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.130019903 CEST	443	49778	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.130409956 CEST	49778	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.130414009 CEST	443	49778	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.132937908 CEST	443	49775	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.133261919 CEST	49775	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.133280039 CEST	443	49775	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.133644104 CEST	49775	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.133649111 CEST	443	49775	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.138977051 CEST	443	49776	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.139686108 CEST	49776	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.139703989 CEST	443	49776	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.139914036 CEST	49776	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.139919043 CEST	443	49776	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.142863035 CEST	443	49777	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.143322945 CEST	49777	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.143333912 CEST	443	49777	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.143867970 CEST	49777	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.143872023 CEST	443	49777	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.251827955 CEST	443	49779	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.252302885 CEST	49779	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.252334118 CEST	443	49779	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.252762079 CEST	49779	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.252768993 CEST	443	49779	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.279798985 CEST	443	49775	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.279973984 CEST	443	49775	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.280035019 CEST	49775	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.281481028 CEST	443	49776	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.281563044 CEST	443	49776	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.281755924 CEST	49776	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.285227060 CEST	443	49777	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.285290003 CEST	443	49777	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.285554886 CEST	49777	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.290353060 CEST	49775	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.290380955 CEST	443	49775	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.301749945 CEST	49776	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.301749945 CEST	49776	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.301764965 CEST	443	49776	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.301774979 CEST	443	49776	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.304725885 CEST	49777	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.304747105 CEST	443	49777	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.304759979 CEST	49777	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.304766893 CEST	443	49777	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.318881035 CEST	49783	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.318917036 CEST	443	49783	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.319161892 CEST	49783	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.327011108 CEST	49784	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.327064991 CEST	443	49784	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.327172995 CEST	49783	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.327177048 CEST	49785	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.327193975 CEST	443	49783	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.327203989 CEST	443	49785	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.327218056 CEST	49784	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.327259064 CEST	49785	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.327334881 CEST	49784	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.327353954 CEST	443	49784	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.328150034 CEST	49785	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.328166008 CEST	443	49785	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.395977974 CEST	443	49779	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.396075964 CEST	443	49779	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.396224022 CEST	49779	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.396370888 CEST	49779	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.396384001 CEST	443	49779	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.396414042 CEST	49779	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.396420002 CEST	443	49779	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.399888992 CEST	49786	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.399924994 CEST	443	49786	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.400000095 CEST	49786	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.400213003 CEST	49786	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.400228024 CEST	443	49786	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.510178089 CEST	443	49778	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.510461092 CEST	443	49778	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.510557890 CEST	49778	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.510818005 CEST	49778	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.510838032 CEST	443	49778	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.519529104 CEST	49787	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.519570112 CEST	443	49787	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.519642115 CEST	49787	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.519823074 CEST	49787	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:15.519833088 CEST	443	49787	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:15.656821012 CEST	443	49782	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.657104969 CEST	49782	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.657120943 CEST	443	49782	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.658157110 CEST	443	49782	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.658227921 CEST	49782	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.659462929 CEST	49782	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.659528017 CEST	443	49782	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.659634113 CEST	49782	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.700495005 CEST	49782	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.700505972 CEST	443	49782	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.747594118 CEST	49782	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.844940901 CEST	443	49782	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.845046043 CEST	443	49782	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.845058918 CEST	443	49782	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.845115900 CEST	49782	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.845136881 CEST	443	49782	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.845164061 CEST	443	49782	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.845226049 CEST	49782	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.845232964 CEST	443	49782	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.845392942 CEST	443	49782	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.845537901 CEST	49782	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.845545053 CEST	443	49782	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.892160892 CEST	49782	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.962476015 CEST	443	49782	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.962588072 CEST	443	49782	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.962624073 CEST	443	49782	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.962641001 CEST	49782	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.962651014 CEST	443	49782	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.962697983 CEST	49782	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.962703943 CEST	443	49782	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.962945938 CEST	443	49782	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.963032961 CEST	49782	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.963120937 CEST	49782	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.963134050 CEST	443	49782	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.975436926 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.975482941 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.975719929 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.975838900 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.975868940 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.976129055 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.976253033 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.976262093 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.976309061 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.976736069 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.976751089 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.977077961 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.977093935 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:15.977264881 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:15.977276087 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.088238955 CEST	443	49785	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.088267088 CEST	443	49784	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.089900970 CEST	443	49783	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.137543917 CEST	49783	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.143718004 CEST	49785	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.143879890 CEST	49784	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.165469885 CEST	443	49786	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.172439098 CEST	49785	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.172454119 CEST	443	49785	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.173310041 CEST	49784	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.173320055 CEST	443	49784	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.173623085 CEST	49785	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.173629045 CEST	443	49785	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.173779011 CEST	49784	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.173784971 CEST	443	49784	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.174474955 CEST	49783	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.174496889 CEST	443	49783	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.174818993 CEST	49786	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.174833059 CEST	443	49786	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.175376892 CEST	49786	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.175381899 CEST	443	49786	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.175539017 CEST	49783	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.175553083 CEST	443	49783	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.277451038 CEST	443	49787	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.308444023 CEST	443	49785	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.308528900 CEST	443	49785	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.308603048 CEST	49785	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.308986902 CEST	443	49784	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.309139967 CEST	443	49784	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.309209108 CEST	49784	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.309446096 CEST	443	49783	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.309741974 CEST	443	49783	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.309870958 CEST	49783	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.310457945 CEST	443	49786	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.310522079 CEST	443	49786	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.310640097 CEST	49786	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.319329023 CEST	49787	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.319350958 CEST	443	49787	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.320200920 CEST	49787	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.320207119 CEST	443	49787	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.328588963 CEST	49786	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.328622103 CEST	49786	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.328623056 CEST	443	49786	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.328629017 CEST	443	49786	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.333599091 CEST	49785	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.333621025 CEST	443	49785	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.333635092 CEST	49785	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.333642960 CEST	443	49785	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.337404013 CEST	49784	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.337404013 CEST	49784	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.337416887 CEST	443	49784	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.337425947 CEST	443	49784	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.424515009 CEST	49783	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.424515009 CEST	49783	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.424539089 CEST	443	49783	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.424552917 CEST	443	49783	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.435203075 CEST	49792	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.435237885 CEST	443	49792	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.435323000 CEST	49792	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.436712027 CEST	49792	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.436727047 CEST	443	49792	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.437439919 CEST	49793	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.437468052 CEST	443	49793	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.437573910 CEST	49793	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.437774897 CEST	49794	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.437787056 CEST	443	49794	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.437856913 CEST	49794	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.437865019 CEST	49793	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.437881947 CEST	443	49793	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.438215971 CEST	49795	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.438226938 CEST	443	49795	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.438481092 CEST	49795	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.438595057 CEST	49795	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.438606977 CEST	443	49795	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.438678980 CEST	49794	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.438693047 CEST	443	49794	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.453965902 CEST	443	49787	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.454035044 CEST	443	49787	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.454123020 CEST	49787	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.454534054 CEST	49787	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.454545021 CEST	443	49787	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.454559088 CEST	49787	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.454565048 CEST	443	49787	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.461662054 CEST	49796	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.461707115 CEST	443	49796	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.462038040 CEST	49796	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.462219954 CEST	49796	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:16.462234974 CEST	443	49796	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:16.575218916 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.581701040 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.589780092 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.599905014 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.599920034 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.601021051 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.601028919 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.601391077 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.601427078 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.601551056 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.601866961 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.601999998 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.602066040 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.614850998 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.615017891 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.615454912 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.615621090 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.617002010 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.617103100 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.617211103 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.617283106 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.617578030 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.617594957 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.659327984 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.659333944 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.666812897 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.763525963 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.763581038 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.763613939 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.763638973 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.763653040 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.763695002 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.763700962 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.763746023 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.763771057 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.763812065 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.763823032 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.763868093 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.764398098 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.766210079 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.766259909 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.766294956 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.766314983 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.766324043 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.766336918 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.766370058 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.766382933 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.766412020 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.766434908 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.766443014 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.766452074 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.766509056 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.766967058 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.767028093 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.767038107 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.769826889 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.769864082 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.769900084 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.769918919 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.769926071 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.769967079 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.769972086 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.770044088 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.770072937 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.770104885 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.770109892 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.770173073 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.770633936 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.770683050 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.770725965 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.770731926 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.807768106 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.808062077 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.823030949 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.881917953 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.881963968 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.882011890 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.882038116 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.882061005 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.882081985 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.882092953 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.882134914 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.882143021 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.882157087 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.882160902 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.882178068 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.882198095 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.882204056 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.882283926 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.882405043 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.882484913 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.882528067 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.882535934 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.882870913 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.883055925 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.883079052 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.883147001 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.883156061 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.883200884 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.883277893 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.883308887 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.883352995 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.883356094 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.883368015 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.883402109 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.883407116 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.883450985 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.883644104 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.883709908 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.883738041 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.883758068 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.883764982 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.883821964 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.884211063 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.884277105 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.884320021 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.884347916 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.884368896 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.884377003 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.884411097 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.884608984 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.884659052 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.884687901 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.884705067 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.884716034 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.884824038 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.884829044 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.885015965 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.885080099 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.885086060 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.885586023 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.885762930 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.885777950 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.887229919 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.887378931 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.887406111 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.887448072 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.887454987 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.887501955 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.887521982 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.887579918 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.887613058 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.887650013 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.887655020 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.887700081 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.888519049 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.888591051 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.888628006 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.888683081 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.888689995 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.888731956 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.889234066 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.889314890 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.889358997 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.889420033 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.889441013 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.889446974 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.889461994 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.890285969 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.890324116 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.890377998 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.890383959 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.890428066 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.922472000 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.922538996 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.922547102 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.927951097 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.963921070 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.998244047 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.998332024 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.998363018 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.998406887 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.998409986 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.998435020 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.998451948 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.998472929 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.998502016 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.998536110 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.998549938 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.998562098 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.998581886 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.998981953 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.999047995 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.999056101 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.999699116 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.999732018 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.999766111 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.999769926 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.999778986 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:16.999814987 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:16.999838114 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.000503063 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.000597954 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.000626087 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.000655890 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.000669003 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.000688076 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.000720024 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.000783920 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.000824928 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.000830889 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.000839949 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.000848055 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.000849009 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.000874996 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.000881910 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.000912905 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.001241922 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.001247883 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.001271009 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.001322985 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.001327991 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.001487970 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.001519918 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.001543045 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.001549959 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.001585007 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.001605034 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.001817942 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.001857996 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.001866102 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.001872063 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.001935959 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.002525091 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.002563953 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.002588987 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.002597094 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.002629042 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.002651930 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.003595114 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.003662109 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.003669024 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.003726959 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.003803968 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.003842115 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.003858089 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.003880024 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.003901958 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.003906965 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.003916025 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.003935099 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.003964901 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.003998995 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.004076958 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.004116058 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.004149914 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.004160881 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.004170895 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.004200935 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.004705906 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.004755974 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.004760981 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.004769087 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.004791975 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.004806042 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.004812002 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.004826069 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.004848003 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.004867077 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.004870892 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.004935026 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.005481958 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.005538940 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.005593061 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.005595922 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.005609035 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.005659103 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.006227970 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.006283998 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.006433010 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.006477118 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.006494999 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.006500006 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.006534100 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.006556034 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.007226944 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.007292986 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.007345915 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.007395983 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.008356094 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.008425951 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.008450031 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.008505106 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.010405064 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.010468006 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.010483980 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.010549068 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.040986061 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.041064024 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.041188002 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.041246891 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.113776922 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.113831997 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.113854885 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.113864899 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.113878012 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.113926888 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.114481926 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.114532948 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.114653111 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.114703894 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.115139008 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.115195990 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.115294933 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.115339041 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.115345955 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.115359068 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.115385056 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.115392923 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.115407944 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.115411997 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.115451097 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.116127014 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.116182089 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.116193056 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.116194963 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.116229057 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.116252899 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.116281986 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.116286039 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.116641045 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.117124081 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.117162943 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.117187023 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.117197990 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.117209911 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.117211103 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.117238045 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.117244005 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.117285013 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.118205070 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.118249893 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.118283033 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.118284941 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.118293047 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.118307114 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.118341923 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.119050980 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.119121075 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.119170904 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.119179010 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.119221926 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.119231939 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.119247913 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.119254112 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.119292974 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.119294882 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.119334936 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.119338989 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.119343996 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.119350910 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.119369030 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.119419098 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.119618893 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.119659901 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.119714975 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.119818926 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.119858027 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.119870901 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.119878054 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.119905949 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.119930029 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.120085955 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.120137930 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.120198011 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.120234966 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.120253086 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.120263100 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.120289087 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.120547056 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.120604992 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.120605946 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.120618105 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.120650053 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.120670080 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.120675087 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.120719910 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.121061087 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.121125937 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.121133089 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.121144056 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.121180058 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.121192932 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.121212006 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.121227980 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.121248960 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.121285915 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.121370077 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.121375084 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.121390104 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.121414900 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.121428013 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.121438026 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.121445894 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.121450901 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.121454000 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.121512890 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.121522903 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.121558905 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.121568918 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.121582031 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.121632099 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.121665001 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.121665001 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.121718884 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.121735096 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.121789932 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.121865988 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.121936083 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.122035027 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.122088909 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.122329950 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.122390032 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.122488022 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.122538090 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.122749090 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.122819901 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.122884989 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.122925043 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.122936964 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.122941017 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.122960091 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.122978926 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.123008966 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.123020887 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.123079062 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.123205900 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.123255014 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.123259068 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.123269081 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.123317003 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.123418093 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.123466015 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.123476982 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.123482943 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.123519897 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.123522997 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.123529911 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.123588085 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.124298096 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.124346972 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.124363899 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.124368906 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.124382973 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.124397039 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.124428988 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.124433994 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.124444962 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.125273943 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.125318050 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.125324965 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.125330925 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.125389099 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.126667023 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.126739025 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.128957033 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.129026890 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.129041910 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.129049063 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.129070997 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.129091978 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.129106998 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.129112005 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.129127026 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.129164934 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.129479885 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.129539013 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.129800081 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.129853010 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.129857063 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.129872084 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.129905939 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.129918098 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.129962921 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.129976988 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.129981995 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.130009890 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.130016088 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.130053043 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.130065918 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.130069971 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.130131960 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.130709887 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.130765915 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.130790949 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.130798101 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.130824089 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.149735928 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.150232077 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.150415897 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.159697056 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.159745932 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.159794092 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.159842014 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.160072088 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.160082102 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.160136938 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.169194937 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.169260025 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.191272020 CEST	443	49793	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:17.193749905 CEST	443	49792	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:17.197633028 CEST	443	49795	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:17.207284927 CEST	443	49794	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:17.229490995 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.229619026 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.229640961 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.229680061 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.229742050 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.229751110 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.229819059 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.229958057 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.229978085 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.230062962 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.230072021 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.230142117 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.230576038 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.230592966 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.230690002 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.230698109 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.230765104 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.234365940 CEST	443	49796	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:17.234978914 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.234993935 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.235101938 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.235111952 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.235155106 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.235460043 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.235481977 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.235527992 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.235536098 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.235570908 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.235589981 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.235825062 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.235841036 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.235882998 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.235891104 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.235920906 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.235939980 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.236334085 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.236350060 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.236390114 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.236398935 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.236434937 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.236465931 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.236577988 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.236594915 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.236654043 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.236665010 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.236706972 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.236944914 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.236960888 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.237020016 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.237029076 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.237070084 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.237281084 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.237299919 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.237343073 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.237349987 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.237381935 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.237399101 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.237406969 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.237421989 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.237477064 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.237483978 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.237514973 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.237538099 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.238161087 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.238200903 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.238224030 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.238229036 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.238266945 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.238375902 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.238392115 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.238457918 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.238466024 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.238498926 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.238938093 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.238960981 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.238995075 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.239002943 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.239043951 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.239619017 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.239700079 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.239753008 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.239819050 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.240556002 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.240636110 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.240644932 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.240665913 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.240683079 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.240690947 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.240720034 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.240735054 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.240778923 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.240784883 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.240825891 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.241276026 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.241301060 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.241319895 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.241343975 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.241353035 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.241358042 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.241430044 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.241842031 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.241887093 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.241920948 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.241928101 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.241961956 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.241970062 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.242010117 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.242046118 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.242050886 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.242095947 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.242120028 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.242382050 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.242420912 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.242456913 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.242461920 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.242502928 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.242526054 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.243011951 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.243052959 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.243088007 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.243093014 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.243129969 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.243149996 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.243535995 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.243577957 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.243638992 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.243643999 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.243669987 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.243691921 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.244123936 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.244165897 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.244195938 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.244200945 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.244236946 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.244259119 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.244678974 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.244721889 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.244755030 CEST	49793	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:17.244765043 CEST	49792	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:17.244765043 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.244767904 CEST	49795	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:17.244775057 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.244822025 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.245279074 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.245332003 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.245354891 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.245362043 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.245409012 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.245552063 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.245594025 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.245624065 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.245628119 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.245656967 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.245680094 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.246017933 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.246032000 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.246067047 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.246085882 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.246113062 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.246118069 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.246130943 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.246134996 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.246176958 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.246176958 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.246212959 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.246264935 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.246274948 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.246300936 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.246331930 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.246578932 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.246619940 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.246643066 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.246649027 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.246701956 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.246706009 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.246742964 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.246769905 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.246774912 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.246803045 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.246824980 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.247148037 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.247180939 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.247227907 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.247232914 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.247268915 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.247551918 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.247574091 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.247612000 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.247617960 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.247661114 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.247778893 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.247818947 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.247839928 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.247844934 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.247885942 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.247936010 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.247975111 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.248003006 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.248008013 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.248035908 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.248061895 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.248073101 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.248090029 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.248155117 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.248161077 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.248290062 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.248320103 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.248356104 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.248363018 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.248399973 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.248599052 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.248665094 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.248671055 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.248727083 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.248763084 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.248778105 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.248817921 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.248825073 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.248852015 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.260384083 CEST	49794	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:17.276098967 CEST	49796	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:17.278773069 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.278850079 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.278896093 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.278911114 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.278943062 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.279220104 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.279259920 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.279294968 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.279301882 CEST	443	49791	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.279345036 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.283569098 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.296519041 CEST	49796	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:17.296530008 CEST	443	49796	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:17.297226906 CEST	49796	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:17.297230959 CEST	443	49796	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:17.297491074 CEST	49793	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:17.297499895 CEST	443	49793	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:17.298093081 CEST	49793	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:17.298099041 CEST	443	49793	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:17.298429966 CEST	49792	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:17.298439980 CEST	443	49792	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:17.299460888 CEST	49792	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:17.299465895 CEST	443	49792	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:17.299846888 CEST	49795	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:17.299853086 CEST	443	49795	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:17.300649881 CEST	49795	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:17.300656080 CEST	443	49795	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:17.301346064 CEST	49794	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:17.301352978 CEST	443	49794	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:17.302171946 CEST	49794	443	192.168.2.9	13.107.253.45
Oct 24, 2024 09:16:17.302177906 CEST	443	49794	13.107.253.45	192.168.2.9
Oct 24, 2024 09:16:17.303210974 CEST	49789	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.303455114 CEST	49791	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.304053068 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.345645905 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.345666885 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.345738888 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.345751047 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.345772028 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.345844984 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.346151114 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.346167088 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.346221924 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.346229076 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.346427917 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.346447945 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.346484900 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.346493959 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.346558094 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.350433111 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.350447893 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.350496054 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.350645065 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.350653887 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.350665092 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.350682020 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.350814104 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.350814104 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.350826025 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.350958109 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.350982904 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.351088047 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.351097107 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.351140022 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.351192951 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.351207018 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.351264954 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.351270914 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.351320982 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.351387024 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.351406097 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.351484060 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.351490021 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.351532936 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.351593971 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.351615906 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.351671934 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.351679087 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.351718903 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.351738930 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.351753950 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.351814985 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.351825953 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.351867914 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.351970911 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.351986885 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.352041960 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.352047920 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.352096081 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.352577925 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.352593899 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.352648020 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.352653980 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.352696896 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.353110075 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.353126049 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.353179932 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.353188038 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.353231907 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.353909969 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.353925943 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.353970051 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.353979111 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.354012966 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.354036093 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.354582071 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.354597092 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.354645967 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.354652882 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.354688883 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.354711056 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.355071068 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.355088949 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.355142117 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.355148077 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.355190039 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.355405092 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.355420113 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.355472088 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.355478048 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.355513096 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.355531931 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.356183052 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.356199026 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.356247902 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.356257915 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.356287956 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.356308937 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.356360912 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.356374979 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.356430054 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.356436014 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.356472969 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.356496096 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.356792927 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.356808901 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.356878042 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.356884956 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.356918097 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.356928110 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.356939077 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.356954098 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.356975079 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.357022047 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.357060909 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.357074976 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.357125044 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.357134104 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.357148886 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.357199907 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.357217073 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.357247114 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.357254028 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.357279062 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.357316971 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.357743025 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.357764006 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.357810974 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.357820034 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.357857943 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.357880116 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.358200073 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.358217955 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.358274937 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.358288050 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.358330011 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.359019041 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.359036922 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.359105110 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.359112024 CEST	443	49790	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.359158039 CEST	49790	443	192.168.2.9	162.159.128.233
Oct 24, 2024 09:16:17.360704899 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.360771894 CEST	443	49789	162.159.128.233	192.168.2.9
Oct 24, 2024 09:16:17.360805988 CEST	49789	443	192.168.2.9	162.159.128.233

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 09:16:09.867892027 CEST	192.168.2.9	1.1.1.1	0xc37a	Standard query (0)	keyauth.win	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:13.964468956 CEST	192.168.2.9	1.1.1.1	0xce9e	Standard query (0)	discord.gg	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:13.964646101 CEST	192.168.2.9	1.1.1.1	0x727	Standard query (0)	discord.gg	65	IN (0x0001)	false
Oct 24, 2024 09:16:15.032577991 CEST	192.168.2.9	1.1.1.1	0xe809	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:15.032721996 CEST	192.168.2.9	1.1.1.1	0x35ff	Standard query (0)	discord.com	65	IN (0x0001)	false
Oct 24, 2024 09:16:18.012022972 CEST	192.168.2.9	1.1.1.1	0xda85	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:18.012366056 CEST	192.168.2.9	1.1.1.1	0x6dd	Standard query (0)	discord.com	65	IN (0x0001)	false
Oct 24, 2024 09:16:18.606550932 CEST	192.168.2.9	1.1.1.1	0xc2e8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:18.606826067 CEST	192.168.2.9	1.1.1.1	0x30f6	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 24, 2024 09:16:26.325839996 CEST	192.168.2.9	1.1.1.1	0x1ec3	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:26.326586008 CEST	192.168.2.9	1.1.1.1	0x6ddb	Standard query (0)	cdn.discordapp.com	65	IN (0x0001)	false
Oct 24, 2024 09:16:29.375386000 CEST	192.168.2.9	1.1.1.1	0x2de0	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:29.375634909 CEST	192.168.2.9	1.1.1.1	0xa3e	Standard query (0)	cdn.discordapp.com	65	IN (0x0001)	false
Oct 24, 2024 09:16:32.906580925 CEST	192.168.2.9	1.1.1.1	0x60b7	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:32.906879902 CEST	192.168.2.9	1.1.1.1	0x9e35	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 24, 2024 09:16:09.878021002 CEST	1.1.1.1	192.168.2.9	0xc37a	No error (0)	keyauth.win	104.26.1.5	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:09.878021002 CEST	1.1.1.1	192.168.2.9	0xc37a	No error (0)	keyauth.win	172.67.72.57	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:09.878021002 CEST	1.1.1.1	192.168.2.9	0xc37a	No error (0)	keyauth.win	104.26.0.5	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:13.971600056 CEST	1.1.1.1	192.168.2.9	0xce9e	No error (0)	discord.gg	162.159.130.234	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:13.971600056 CEST	1.1.1.1	192.168.2.9	0xce9e	No error (0)	discord.gg	162.159.136.234	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:13.971600056 CEST	1.1.1.1	192.168.2.9	0xce9e	No error (0)	discord.gg	162.159.134.234	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:13.971600056 CEST	1.1.1.1	192.168.2.9	0xce9e	No error (0)	discord.gg	162.159.135.234	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:13.971600056 CEST	1.1.1.1	192.168.2.9	0xce9e	No error (0)	discord.gg	162.159.133.234	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:13.972744942 CEST	1.1.1.1	192.168.2.9	0x727	No error (0)	discord.gg		65	IN (0x0001)	false
Oct 24, 2024 09:16:15.042078972 CEST	1.1.1.1	192.168.2.9	0xe809	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:15.042078972 CEST	1.1.1.1	192.168.2.9	0xe809	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:15.042078972 CEST	1.1.1.1	192.168.2.9	0xe809	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:15.042078972 CEST	1.1.1.1	192.168.2.9	0xe809	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:15.042078972 CEST	1.1.1.1	192.168.2.9	0xe809	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:15.042094946 CEST	1.1.1.1	192.168.2.9	0x35ff	No error (0)	discord.com		65	IN (0x0001)	false
Oct 24, 2024 09:16:18.019290924 CEST	1.1.1.1	192.168.2.9	0xda85	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:18.019290924 CEST	1.1.1.1	192.168.2.9	0xda85	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:18.019290924 CEST	1.1.1.1	192.168.2.9	0xda85	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:18.019290924 CEST	1.1.1.1	192.168.2.9	0xda85	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:18.019290924 CEST	1.1.1.1	192.168.2.9	0xda85	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:18.020224094 CEST	1.1.1.1	192.168.2.9	0x6dd	No error (0)	discord.com		65	IN (0x0001)	false
Oct 24, 2024 09:16:18.614038944 CEST	1.1.1.1	192.168.2.9	0xc2e8	No error (0)	www.google.com	142.250.185.228	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:18.614249945 CEST	1.1.1.1	192.168.2.9	0x30f6	No error (0)	www.google.com		65	IN (0x0001)	false
Oct 24, 2024 09:16:26.336659908 CEST	1.1.1.1	192.168.2.9	0x1ec3	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:26.336659908 CEST	1.1.1.1	192.168.2.9	0x1ec3	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:26.336659908 CEST	1.1.1.1	192.168.2.9	0x1ec3	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:26.336659908 CEST	1.1.1.1	192.168.2.9	0x1ec3	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:26.336659908 CEST	1.1.1.1	192.168.2.9	0x1ec3	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:26.336698055 CEST	1.1.1.1	192.168.2.9	0x6ddb	No error (0)	cdn.discordapp.com		65	IN (0x0001)	false
Oct 24, 2024 09:16:29.386918068 CEST	1.1.1.1	192.168.2.9	0x2de0	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:29.386918068 CEST	1.1.1.1	192.168.2.9	0x2de0	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:29.386918068 CEST	1.1.1.1	192.168.2.9	0x2de0	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:29.386918068 CEST	1.1.1.1	192.168.2.9	0x2de0	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:29.386918068 CEST	1.1.1.1	192.168.2.9	0x2de0	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:29.387866020 CEST	1.1.1.1	192.168.2.9	0xa3e	No error (0)	cdn.discordapp.com		65	IN (0x0001)	false
Oct 24, 2024 09:16:32.913976908 CEST	1.1.1.1	192.168.2.9	0x60b7	No error (0)	a.nel.cloudflare.com	35.190.80.1	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.9	49706	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:01 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:01 UTC	561	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:01 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 23 Oct 2024 06:30:03 GMT ETag: "0x8DCF32C20D7262E" x-ms-request-id: 39f98116-901e-0015-0fb5-25b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071601Z-17fbfdc98bb6q7cv86r4xdspkg00000006z0000000003xv9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:01 UTC	15823	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-24 07:16:01 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <S T="1" F="0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L>
2024-10-24 07:16:02 UTC	16384	IN	Data Raw: 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d Data Ascii: <S T="3" /> </T> <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-
2024-10-24 07:16:02 UTC	16384	IN	Data Raw: 6e 74 73 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a Data Ascii: nts" /> </C> <C T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" />
2024-10-24 07:16:02 UTC	16384	IN	Data Raw: 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: </S> <C T="U32" I="0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32"
2024-10-24 07:16:02 UTC	16384	IN	Data Raw: 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 Data Ascii: _Count"> <C> <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S
2024-10-24 07:16:02 UTC	16384	IN	Data Raw: 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 Data Ascii: <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3"
2024-10-24 07:16:02 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 Data Ascii: </L> <R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false
2024-10-24 07:16:02 UTC	16384	IN	Data Raw: 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: T="B" /> </R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" />
2024-10-24 07:16:02 UTC	16384	IN	Data Raw: 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: O> </F> <F T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.9	49707	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:03 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:03 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:03 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 014e5f85-701e-006f-2b35-21afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071603Z-r1755647c66xkk8sn093pbsnz800000000mg000000000m7t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:16:03 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.9	49708	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:03 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:03 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 77f74883-b01e-0001-1a50-2346e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071603Z-17fbfdc98bbx4f4q0941cebmvs00000006tg000000005cws x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:03 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.9	49709	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:03 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:03 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:03 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 509f9858-c01e-00a2-4459-232327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071603Z-17fbfdc98bb4k5z6ayu7yh2rsn0000000740000000000982 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:03 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.9	49711	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:03 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:03 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:03 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 3b262095-501e-0035-475d-23c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071603Z-r1755647c66sn7s9kfw6gzvyp000000009h0000000000pbn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:03 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.9	49710	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:03 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:03 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 31a53d7e-801e-00a3-74f7-217cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071603Z-17fbfdc98bb4k5z6ayu7yh2rsn00000006wg000000006wub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:03 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.9	49712	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:04 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:04 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: e1deb6d3-201e-006e-700b-22bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071604Z-r1755647c66d87vp2n0g7qt8bn00000008q0000000002qy2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:04 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.9	49715	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:04 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:04 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: fbb8ce34-501e-0064-0cbd-201f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071604Z-r1755647c66z4pt7cv1pnqayy400000009c00000000051wz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:04 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.9	49713	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:04 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:04 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 734838af-101e-0065-4be5-214088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071604Z-r1755647c66c9glmgg3prd89mn00000009f00000000026y6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:04 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.9	49716	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:04 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:04 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: ad393351-301e-0099-6d59-236683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071604Z-17fbfdc98bbpc9nz0r22pywp08000000075g000000000n8m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:04 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.9	49714	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:04 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:04 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: a0191c6f-501e-0047-3c5d-23ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071604Z-17fbfdc98bbvcvlzx1n0fduhm000000006z0000000005a3r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:04 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.9	49720	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:04 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:05 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a95f3241-e01e-0020-1c5d-23de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071605Z-17fbfdc98bbl89flqtm21qm6rn0000000750000000000r0n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:05 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.9	49718	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:04 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:05 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 8659e35a-201e-005d-7d92-1fafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071605Z-r1755647c66z4pt7cv1pnqayy400000009d00000000047fh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:05 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.9	49719	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:05 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:05 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: a48fb397-901e-008f-6356-2367a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071605Z-17fbfdc98bbkw9phumvsc7yy8w00000006v00000000063fu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:05 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.9	49717	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:05 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:05 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 20eafa8b-401e-0067-4901-2009c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071605Z-r1755647c66j878m0wkraqty3800000007vg000000005dxd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:05 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.9	49721	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:05 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:05 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 48cb304a-401e-0064-7764-2354af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071605Z-17fbfdc98bb9tt772yde9rhbm80000000700000000001tub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:05 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.9	49723	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:05 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:05 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 3edebaab-e01e-0033-21c8-214695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071605Z-r1755647c669hnl7dkxy835cqc0000000740000000005mk8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:06 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.9	49722	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:05 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:05 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: fe83e199-601e-00ab-415a-2366f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071605Z-17fbfdc98bbx648l6xmxqcmf20000000070g0000000018ds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:06 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.9	49724	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:05 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:05 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: c39ac956-e01e-001f-465d-231633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071605Z-17fbfdc98bbqc8zsbguzmabx6800000006s0000000005w3p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:06 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.9	49725	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:05 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:05 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: b1dca041-701e-0001-1ae2-20b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071605Z-r1755647c66c9glmgg3prd89mn00000009a00000000063yt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:06 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.9	49726	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:06 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:06 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: b4b04932-601e-0050-10e3-202c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071606Z-r1755647c66cdf7jx43n17haqc0000000a20000000006nps x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:06 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.9	49728	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:06 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:06 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: e2670bef-801e-008f-375d-232c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071606Z-17fbfdc98bbrx2rj4asdpg8sbs00000002yg000000001qzb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:06 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.9	49727	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:06 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: a019224c-501e-0047-645d-23ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071606Z-17fbfdc98bbx4f4q0941cebmvs00000006ug0000000041gg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.9	49729	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:06 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:06 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: b93710ac-501e-007b-525a-235ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071606Z-17fbfdc98bbczcjda6v8hpct4c00000000p0000000002hr0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:06 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.9	49730	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:06 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:06 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 8ee7b399-e01e-0033-0c50-234695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071606Z-17fbfdc98bb6q7cv86r4xdspkg000000070g00000000387e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:06 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.9	49731	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:07 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:07 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 8a7344d1-601e-0084-805a-236b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071607Z-r1755647c66l72xfkr6ug378ks00000008700000000068y1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:07 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.9	49732	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:07 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:07 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 6ff76e76-001e-002b-21c5-2099f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071607Z-r1755647c66xkk8sn093pbsnz800000000c0000000000ux3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:07 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.9	49733	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:07 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:07 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: ba25aa5e-401e-0015-7950-230e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071607Z-17fbfdc98bbnhb2b0umpa641c800000006vg0000000044qa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:07 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.9	49735	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:07 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:07 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 55f0b2c4-501e-008f-5c50-239054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071607Z-17fbfdc98bblvnlh5w88rcarag00000006zg0000000055r8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:07 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.9	49734	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:07 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:07 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 1290ce53-d01e-002b-7905-2225fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071607Z-r1755647c66n5bjpba5s4mu9d000000009c0000000004vf0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:07 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.9	49736	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:07 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:07 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 265f42d2-801e-0047-38c8-207265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071607Z-r1755647c66nxct5p0gnwngmx000000008t00000000004w8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:08 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.9	49740	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:08 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:08 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 9e0e1983-701e-003e-2856-2379b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071608Z-r1755647c66sn7s9kfw6gzvyp000000009gg0000000014vh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:08 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.9	49737	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:08 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:08 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 1f9c3bb8-d01e-0014-220b-22ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071608Z-r1755647c66cdf7jx43n17haqc0000000a7g0000000020rc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:08 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.9	49739	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:08 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:08 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 5cd52618-301e-0033-5865-23fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071608Z-17fbfdc98bbrx2rj4asdpg8sbs00000002xg0000000034xn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:08 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.9	49738	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:08 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:08 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 46af3d48-701e-0032-6627-21a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071608Z-r1755647c66m4jttnz6nb8kzng00000007xg00000000386u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:08 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.9	49741	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:09 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:09 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:09 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: ee1aea59-301e-0052-0750-2365d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071609Z-17fbfdc98bb6q7cv86r4xdspkg00000006x0000000005rrt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:09 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.9	49742	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:10 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:10 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: ad3e5457-301e-0099-155a-236683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071610Z-17fbfdc98bbx648l6xmxqcmf2000000006w0000000004hf0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:10 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.9	49746	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:10 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:10 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: f5c3fbe0-b01e-0002-646f-231b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071610Z-17fbfdc98bb7qlzm4x52d2225c00000006z00000000029kq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:10 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.9	49743	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:10 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:10 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 95a4abee-901e-0016-6e50-23efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071610Z-17fbfdc98bbnhb2b0umpa641c800000006xg0000000029wv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:10 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.9	49745	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:10 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:10 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 0c1e413e-701e-0021-5e50-233d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071610Z-17fbfdc98bbpc9nz0r22pywp0800000006zg0000000065fw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:10 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.9	49744	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:10 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:10 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: d9d4df84-d01e-00ad-0964-23e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071610Z-17fbfdc98bbqc8zsbguzmabx6800000006vg0000000032pq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:10 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.9	49751	104.26.1.5	443	7472	C:\Users\user\Desktop\Fa1QSXjTZD.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:10 UTC	128	OUT	POST /api/1.1/ HTTP/1.1 Host: keyauth.win Accept: / Content-Length: 58 Content-Type: application/x-www-form-urlencoded
2024-10-24 07:16:10 UTC	58	OUT	Data Raw: 74 79 70 65 3d 69 6e 69 74 26 76 65 72 3d 38 2e 33 26 6e 61 6d 65 3d 6c 6f 61 64 65 72 20 70 72 69 6e 63 69 70 61 6c 26 6f 77 6e 65 72 69 64 3d 39 57 49 76 54 56 4a 61 39 6d Data Ascii: type=init&ver=8.3&name=loader principal&ownerid=9WIvTVJa9m
2024-10-24 07:16:10 UTC	1107	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:10 GMT Content-Type: application/json; charset=UTF-8 Content-Length: 121 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k8NehXWirF7ol4OVQ3QDyPVPlj948HWFP6ievdLzXzQov8Y8DK0aNBIQlEYPtrDWgcctGW0Swhyu7d78sn8d7a8bNWFZtxNLYheCZqWCfey%2FR0AaKetk603fNK%2Fi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Acknowledge: Credit to VaultCord.com X-Powered-By: VaultCord.com content-security-policy: upgrade-insecure-requests permissions-policy: accelerometer=(), camera=(), fullscreen=, geolocation=(self), gyroscope=(), microphone=(), payment= referrer-policy: strict-origin-when-cross-origin strict-transport-security: max-age=31536000; includeSubDomains x-content-security-policy: img-src ; media-src data:; x-content-type-options: nosniff x-frame-options: DENY x-xss-protection: 1; mode=block Access-Control-Allow-Headers: * Access-Control-Allow-Methods: * Access-Control-Allow-Origin: * Server: cloudflare CF-RAY: 8d782e0e1fee6bae-DFW
2024-10-24 07:16:10 UTC	121	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 22 3a 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 69 6e 76 61 6c 69 64 76 65 72 22 2c 22 64 6f 77 6e 6c 6f 61 64 22 3a 22 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 2e 67 67 2f 70 72 69 76 61 74 65 63 6f 6d 6d 75 6e 69 74 79 22 2c 22 6f 77 6e 65 72 69 64 22 3a 22 39 57 49 76 54 56 4a 61 39 6d 22 7d Data Ascii: {"success":false,"code":0,"message":"invalidver","download":"https://discord.gg/privatecommunity","ownerid":"9WIvTVJa9m"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.9	49753	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:11 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:11 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 1bb7fc0c-c01e-0046-7759-232db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071611Z-17fbfdc98bbgpkh7048gc3vfcc000000072g000000002mr9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:11 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.9	49756	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:11 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:11 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: b92258e0-a01e-00ab-2aab-219106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071611Z-r1755647c66fnxpdavnqahfp1w00000007n00000000039rn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:11 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.9	49755	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:11 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:11 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 68ab0001-401e-0064-04b8-2054af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071611Z-r1755647c66l72xfkr6ug378ks00000008d00000000003ex x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:11 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.9	49754	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:11 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:11 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 7a637aca-b01e-0002-3c05-221b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071611Z-r1755647c66sn7s9kfw6gzvyp000000009g00000000015pv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:11 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.9	49757	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:12 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:12 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: f651688a-e01e-0071-5b56-2308e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071612Z-17fbfdc98bbvcvlzx1n0fduhm00000000740000000002gfq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:12 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.9	49759	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:12 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:12 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 629c9caa-001e-0079-2150-2312e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071612Z-17fbfdc98bb7qlzm4x52d2225c0000000710000000000zt8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:12 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.9	49760	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:12 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:12 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 2653a72e-001e-005a-26e6-21c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071612Z-r1755647c66nfj7t97c2qyh6zg0000000650000000006v1t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:12 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.9	49758	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:12 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:12 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0688ef78-901e-0029-5550-23274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071612Z-17fbfdc98bbkw9phumvsc7yy8w00000006z0000000002p0k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:12 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.9	49752	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:12 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:12 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 3589f4cc-c01e-0079-731b-24e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071612Z-r1755647c66cdf7jx43n17haqc0000000a700000000029gd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:12 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.9	49762	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:13 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:13 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 95048cb8-e01e-0051-2a5a-2384b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071613Z-17fbfdc98bbg2mc9qrpn009kgs0000000700000000004dfh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:13 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.9	49764	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:13 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:13 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 8ae0ddcf-601e-0002-0c50-23a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071613Z-17fbfdc98bblptj7fr9s141cpc00000006ug000000007641 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:13 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.9	49761	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:13 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:13 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: b6a35dc4-401e-008c-3156-2386c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071613Z-17fbfdc98bblptj7fr9s141cpc000000071g000000000w26 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:13 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.9	49763	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:13 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:13 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 14f65908-801e-008f-32d6-202c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071613Z-r1755647c66dj7986akr8tvaw400000008mg000000004wfp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:13 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.9	49765	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:13 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:13 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: d4a2e493-801e-0048-07d3-20f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071613Z-r1755647c66dj7986akr8tvaw400000008ng000000004cpd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:13 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.9	49766	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:14 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:14 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: f94d3c24-301e-001f-4850-23aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071614Z-r1755647c66h2wzt2z0cr0zc7400000003p00000000008u8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:14 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.9	49767	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:14 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:14 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 8832b605-d01e-0014-3350-23ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071614Z-17fbfdc98bbx4f4q0941cebmvs00000006v0000000004e5s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:14 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.9	49769	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:14 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:14 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: f58edff3-b01e-0002-5659-231b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071614Z-17fbfdc98bbvcvlzx1n0fduhm00000000730000000002sd5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:14 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.9	49768	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:14 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:14 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: ab84cae0-f01e-005d-23d7-2513ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071614Z-r1755647c66ldfgxa3qp9d53us00000009e0000000002tkw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:14 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.9	49770	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:14 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:14 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:14 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 55f0c68d-501e-008f-5d50-239054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071614Z-r1755647c66s2pfjx11r8ys39000000000pg0000000046c1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:14 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.9	49773	162.159.130.234	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:14 UTC	669	OUT	GET /privatecommunity HTTP/1.1 Host: discord.gg Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 07:16:15 UTC	849	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 24 Oct 2024 07:16:14 GMT Content-Type: text/plain;charset=UTF-8 Content-Length: 0 Connection: close Location: https://discord.com/invite/privatecommunity Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fwWzJiF%2FmNywHnTyLLq1fJv%2F6p8HwYU54bSeKUS8uYLCDw7Lyo2HJmaR%2F%2Bs1oZNQw2mk3pnijxvnFIVnzmFG8coBunrvTqgiyyj2QjlU3aSadFKYJKTYfBCBZjA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d782e297ed6464d-DFW

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.9	49778	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:15 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:15 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:15 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: dd00ddb0-a01e-003d-64e4-2598d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071615Z-r1755647c66xkk8sn093pbsnz800000000gg000000000nzg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-24 07:16:15 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.9	49775	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:15 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:15 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: e131a16a-201e-005d-6a5d-23afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071615Z-17fbfdc98bbpc9nz0r22pywp0800000006yg0000000064zb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:15 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.9	49776	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:15 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:15 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 1c36e671-f01e-0096-085a-2310ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071615Z-17fbfdc98bbq2x5bzrteug30v80000000720000000000923 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:15 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.9	49777	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:15 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:15 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: fc76d5e5-a01e-003d-2e6c-2398d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071615Z-17fbfdc98bbgqz661ufkm7k13c00000006tg000000005d47 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:15 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.9	49779	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:15 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:15 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: df53dfe1-801e-0067-2856-23fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071615Z-17fbfdc98bbvwcxrk0yzwg4d5800000006zg000000003yas x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:15 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.9	49782	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:15 UTC	677	OUT	GET /invite/privatecommunity HTTP/1.1 Host: discord.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 07:16:15 UTC	497	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Ray: 8d782e2e4d124647-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Cache-Control: private Last-Modified: Thu, 24 Oct 2024 03:15:21 GMT Set-Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; Expires=Tue, 23 Oct 2029 07:16:15 GMT; Max-Age=157680000; Path=/; Secure; HttpOnly; SameSite=Lax Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2024-10-24 07:16:15 UTC	5204	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 73 65 6c 66 27 3b 20 73 63 72 69 70 74 2d 73 72 63 20 27 73 65 6c 66 27 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 6e 6f 6e 63 65 2d 4d 54 59 7a 4c 44 45 31 4d 69 77 79 4d 6a 55 73 4d 54 59 7a 4c 44 45 79 4c 44 49 79 4e 69 77 79 4d 6a 51 73 4d 54 6b 78 27 20 62 6c 6f 62 3a 20 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 61 6e 69 6d 61 74 69 6f 6e 73 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f Data Ascii: Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline' 'nonce-MTYzLDE1MiwyMjUsMTYzLDEyLDIyNiwyMjQsMTkx' blob: https://cdn.discordapp.com/animations/ https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/
2024-10-24 07:16:15 UTC	1369	IN	Data Raw: 32 64 39 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 33 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 43 68 65 63 6b 20 6f 75 74 20 74 68 65 20 f0 9d 90 8f f0 9d 90 91 f0 9d 90 88 f0 9d 90 95 f0 9d 90 80 f0 9d 90 93 f0 9d 90 84 20 f0 9d 90 92 f0 9d 90 93 f0 9d 90 8e f0 9d 90 91 f0 9d 90 84 20 f0 9f 94 90 20 63 6f Data Ascii: 2d93<!DOCTYPE html><html><head> <meta charset="utf-8"> <meta content="width=device-width,initial-scale=1,maximum-scale=3" name="viewport"><meta name="description" content="Check out the co
2024-10-24 07:16:15 UTC	1369	IN	Data Raw: 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 3a 61 6c 74 65 72 6e 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6c 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 3a 61 6c 74 65 72 6e 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 70 74 2d 42 52 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 3a 61 6c 74 65 72 6e 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 72 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 2d 55 53 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 3a 61 6c 74 65 72 6e 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 6c Data Ascii: <meta property="og:locale:alternate" content="el" /><meta property="og:locale:alternate" content="pt-BR" /><meta property="og:locale:alternate" content="tr" /><meta property="og:locale" content="en-US" /><meta property="og:locale:alternate" content="l
2024-10-24 07:16:15 UTC	1369	IN	Data Raw: 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 75 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 3a 61 6c 74 65 72 6e 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 63 73 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 3a 61 6c 74 65 72 6e 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 73 76 2d 53 45 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 3a 61 6c 74 65 72 6e 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6c 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 3a 61 6c 74 65 72 6e 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 66 72 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a Data Ascii: ate" content="hu" /><meta property="og:locale:alternate" content="cs" /><meta property="og:locale:alternate" content="sv-SE" /><meta property="og:locale:alternate" content="nl" /><meta property="og:locale:alternate" content="fr" /><meta property="og:
2024-10-24 07:16:15 UTC	1369	IN	Data Raw: 64 2e 63 6f 6d 2f 69 6e 76 69 74 65 2f 70 72 69 76 61 74 65 63 6f 6d 6d 75 6e 69 74 79 3f 6c 6f 63 61 6c 65 3d 6a 61 22 20 2f 3e 0a 3c 6d 65 74 61 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 6c 61 6e 67 3d 22 65 73 2d 45 53 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 69 6e 76 69 74 65 2f 70 72 69 76 61 74 65 63 6f 6d 6d 75 6e 69 74 79 3f 6c 6f 63 61 6c 65 3d 65 73 2d 45 53 22 20 2f 3e 0a 3c 6d 65 74 61 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 6c 61 6e 67 3d 22 69 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 69 6e 76 69 74 65 2f 70 72 69 76 61 74 65 63 6f 6d 6d 75 6e 69 74 79 3f 6c 6f 63 61 6c 65 3d 69 74 22 20 2f 3e 0a 3c 6d 65 74 61 Data Ascii: d.com/invite/privatecommunity?locale=ja" /><meta rel="alternate" hreflang="es-ES" href="https://discord.com/invite/privatecommunity?locale=es-ES" /><meta rel="alternate" hreflang="it" href="https://discord.com/invite/privatecommunity?locale=it" /><meta
2024-10-24 07:16:15 UTC	1369	IN	Data Raw: 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 6c 61 6e 67 3d 22 74 68 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 69 6e 76 69 74 65 2f 70 72 69 76 61 74 65 63 6f 6d 6d 75 6e 69 74 79 3f 6c 6f 63 61 6c 65 3d 74 68 22 20 2f 3e 0a 3c 6d 65 74 61 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 69 6e 76 69 74 65 2f 70 72 69 76 61 74 65 63 6f 6d 6d 75 6e 69 74 79 3f 6c 6f 63 61 6c 65 3d 65 6e 2d 47 42 22 20 2f 3e 0a 3c 6d 65 74 61 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 6c 61 6e 67 3d 22 6b 6f 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 69 73 63 Data Ascii: rel="alternate" hreflang="th" href="https://discord.com/invite/privatecommunity?locale=th" /><meta rel="alternate" hreflang="en-GB" href="https://discord.com/invite/privatecommunity?locale=en-GB" /><meta rel="alternate" hreflang="ko" href="https://disc
2024-10-24 07:16:15 UTC	1369	IN	Data Raw: 67 3a 69 6d 61 67 65 3a 68 65 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 35 31 32 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 73 70 6c 61 73 68 65 73 2f 31 32 33 30 32 32 37 38 34 32 38 37 37 36 32 30 33 35 39 2f 30 34 62 35 38 62 35 64 38 63 38 36 33 39 36 32 63 63 64 61 63 33 30 35 65 35 65 65 31 32 36 39 2e 6a 70 67 3f 73 69 7a 65 3d 35 31 32 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 6f 6f 67 6c 65 62 6f 74 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 62 69 6e 67 62 6f 74 22 20 63 Data Ascii: g:image:height" content="512" /><meta property="twitter:image" content="https://cdn.discordapp.com/splashes/1230227842877620359/04b58b5d8c863962ccdac305e5ee1269.jpg?size=512" /><meta name="googlebot" content="noindex, nofollow" /><meta name="bingbot" c
2024-10-24 07:16:15 UTC	1369	IN	Data Raw: 69 73 63 6f 72 64 2e 63 6f 6d 27 2c 0a 20 20 20 20 20 20 43 44 4e 5f 48 4f 53 54 3a 20 27 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 27 2c 0a 20 20 20 20 20 20 41 53 53 45 54 5f 45 4e 44 50 4f 49 4e 54 3a 20 27 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 27 2c 0a 20 20 20 20 20 20 4d 45 44 49 41 5f 50 52 4f 58 59 5f 45 4e 44 50 4f 49 4e 54 3a 20 27 2f 2f 6d 65 64 69 61 2e 64 69 73 63 6f 72 64 61 70 70 2e 6e 65 74 27 2c 0a 20 20 20 20 20 20 57 49 44 47 45 54 5f 45 4e 44 50 4f 49 4e 54 3a 20 27 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 77 69 64 67 65 74 27 2c 0a 20 20 20 20 20 20 49 4e 56 49 54 45 5f 48 4f 53 54 3a 20 27 64 69 73 63 6f 72 64 2e 67 67 27 2c 0a 20 20 20 20 20 20 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 5f 48 4f 53 54 3a 20 27 64 69 73 Data Ascii: iscord.com', CDN_HOST: 'cdn.discordapp.com', ASSET_ENDPOINT: '//discord.com', MEDIA_PROXY_ENDPOINT: '//media.discordapp.net', WIDGET_ENDPOINT: '//discord.com/widget', INVITE_HOST: 'discord.gg', GUILD_TEMPLATE_HOST: 'dis
2024-10-24 07:16:15 UTC	1369	IN	Data Raw: 49 74 65 6d 28 6e 29 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 6f 3f 6e 75 6c 6c 3a 4a 53 4f 4e 2e 70 61 72 73 65 28 6f 29 7d 63 61 74 63 68 28 6e 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 7d 28 22 74 6f 6b 65 6e 22 29 26 26 21 77 69 6e 64 6f 77 2e 5f 5f 4f 56 45 52 4c 41 59 5f 5f 29 7b 76 61 72 20 6e 3d 6e 75 6c 6c 21 3d 77 69 6e 64 6f 77 2e 44 69 73 63 6f 72 64 4e 61 74 69 76 65 7c 7c 6e 75 6c 6c 21 3d 77 69 6e 64 6f 77 2e 72 65 71 75 69 72 65 3f 22 65 74 66 22 3a 22 6a 73 6f 6e 22 2c 6f 3d 77 69 6e 64 6f 77 2e 47 4c 4f 42 41 4c 5f 45 4e 56 2e 47 41 54 45 57 41 59 5f 45 4e 44 50 4f 49 4e 54 2b 22 2f 3f 65 6e 63 6f 64 69 6e 67 3d 22 2b 6e 2b 22 26 76 3d 22 2b 77 69 6e 64 6f 77 2e 47 4c 4f 42 41 4c 5f 45 4e 56 2e 41 50 49 5f 56 45 52 53 49 4f 4e 3b 6e 75 Data Ascii: Item(n);return null==o?null:JSON.parse(o)}catch(n){return null}}("token")&&!window.__OVERLAY__){var n=null!=window.DiscordNative\|\|null!=window.require?"etf":"json",o=window.GLOBAL_ENV.GATEWAY_ENDPOINT+"/?encoding="+n+"&v="+window.GLOBAL_ENV.API_VERSION;nu
2024-10-24 07:16:15 UTC	723	IN	Data Raw: 73 4d 54 59 7a 4c 44 45 79 4c 44 49 79 4e 69 77 79 4d 6a 51 73 4d 54 6b 78 27 3b 61 2e 73 72 63 3d 27 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 73 63 72 69 70 74 73 2f 6a 73 64 2f 6d 61 69 6e 2e 6a 73 27 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 3b 22 3b 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 64 29 7d 7d 69 66 28 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 29 7b 76 61 72 20 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 69 66 72 61 6d 65 27 29 3b 61 2e 68 65 69 67 68 Data Ascii: sMTYzLDEyLDIyNiwyMjQsMTkx';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.heigh

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.9	49785	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:16 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:16 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 2067cf5d-601e-0001-3659-23faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071616Z-17fbfdc98bb6j78ntkx6e2fx4c00000006tg0000000057bn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:16 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.9	49784	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:16 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:16 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 310b9d61-301e-0051-4f21-2138bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071616Z-r1755647c66prnf6k99z0m3kzc00000009b0000000005pmx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:16 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.9	49786	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:16 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:16 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 931f542e-301e-000c-75f2-21323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071616Z-r1755647c66kmfl29f2su56tc40000000a4g0000000050qf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:16 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.9	49783	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:16 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:16 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: e131a4b8-201e-005d-245d-23afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071616Z-17fbfdc98bb4k5z6ayu7yh2rsn0000000710000000002ccx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:16 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.9	49787	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:16 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:16 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: ea95fade-601e-003e-6b5d-233248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071616Z-17fbfdc98bbrx2rj4asdpg8sbs00000002xg00000000354h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:16 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.9	49789	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:16 UTC	889	OUT	GET /assets/69646.2af8e3f2e60b2cca1cbf.css HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:16 UTC	959	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:16 GMT Content-Type: text/css Content-Length: 1189139 Connection: close CF-Ray: 8d782e344de63ac1-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "7b173af12aa2176b69d5656709649ab1" Last-Modified: Wed, 23 Oct 2024 17:23:22 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=25b0IVGq8Pk6ZTBc8qK31XeOKfudWeOOTffTWcDydINVKIx5F9p%2F2ohXV%2BI9WkmVDWZKWxezK4rp8F1XVxK8RpPiAyA%2FqVijLqZYOTqnRMwfP922F7dbyDX%2FvKTh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:16 UTC	410	IN	Data Raw: 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 6e 65 72 2d 77 61 6e 64 65 72 69 6e 67 2d 63 75 62 65 73 5f 62 36 64 62 32 30 7b 32 35 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 78 28 32 32 70 78 29 72 6f 74 61 74 65 28 2d 39 30 64 65 67 29 73 63 61 6c 65 28 2e 35 29 7d 35 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 78 28 32 32 70 78 29 74 72 61 6e 73 6c 61 74 65 79 28 32 32 70 78 29 72 6f 74 61 74 65 28 2d 31 38 30 64 65 67 29 7d 37 35 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 78 28 30 29 74 72 61 6e 73 6c 61 74 65 79 28 32 32 70 78 29 72 6f 74 61 74 65 28 2d 32 37 30 64 65 67 29 73 63 61 6c 65 28 2e 35 29 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 2d 33 36 30 64 65 67 29 7d Data Ascii: @keyframes spinner-wandering-cubes_b6db20{25%{transform:translatex(22px)rotate(-90deg)scale(.5)}50%{transform:translatex(22px)translatey(22px)rotate(-180deg)}75%{transform:translatex(0)translatey(22px)rotate(-270deg)scale(.5)}to{transform:rotate(-360deg)}
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 6e 65 72 2d 70 75 6c 73 69 6e 67 2d 65 6c 6c 69 70 73 69 73 5f 62 36 64 62 32 30 7b 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 3b 6f 70 61 63 69 74 79 3a 31 7d 35 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 2e 38 29 3b 6f 70 61 63 69 74 79 3a 2e 33 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 3b 6f 70 61 63 69 74 79 3a 31 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 6e 65 72 2d 6c 6f 77 2d 6d 6f 74 69 6f 6e 5f 62 36 64 62 32 30 7b 30 25 7b 6f 70 61 63 69 74 79 3a 31 7d 35 30 25 7b 6f 70 61 63 69 74 79 3a 2e 36 7d 74 6f 7b 6f 70 61 63 69 74 79 3a 31 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 6e 65 Data Ascii: sform:scale(1)}}@keyframes spinner-pulsing-ellipsis_b6db20{0%{transform:scale(1);opacity:1}50%{transform:scale(.8);opacity:.3}to{transform:scale(1);opacity:1}}@keyframes spinner-low-motion_b6db20{0%{opacity:1}50%{opacity:.6}to{opacity:1}}@keyframes spinne
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 61 75 74 6f 3b 77 69 64 74 68 3a 32 38 70 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 70 75 6c 73 69 6e 67 45 6c 6c 69 70 73 69 73 5f 62 36 64 62 32 30 20 2e 69 74 65 6d 5f 62 36 64 62 32 30 7b 61 6e 69 6d 61 74 69 6f 6e 3a 73 70 69 6e 6e 65 72 2d 70 75 6c 73 69 6e 67 2d 65 6c 6c 69 70 73 69 73 5f 62 36 64 62 32 30 20 31 2e 34 73 20 69 6e 66 69 6e 69 74 65 20 65 61 73 65 2d 69 6e 2d 6f 75 74 3b 77 69 64 74 68 3a 36 70 78 3b 68 65 69 67 68 74 3a 36 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 32 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 70 72 69 6d 61 72 79 2d 31 30 30 29 3b 62 6f 72 64 65 72 Data Ascii: auto;width:28px;display:flex;justify-content:center;position:relative}.pulsingEllipsis_b6db20 .item_b6db20{animation:spinner-pulsing-ellipsis_b6db20 1.4s infinite ease-in-out;width:6px;height:6px;margin-right:2px;background-color:var(--primary-100);border
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3a 72 6f 75 6e 64 3b 73 74 72 6f 6b 65 3a 76 61 72 28 2d 2d 62 72 61 6e 64 2d 35 30 30 29 7d 2e 70 61 74 68 32 5f 62 36 64 62 32 30 7b 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 2e 31 35 73 3b 73 74 72 6f 6b 65 3a 76 61 72 28 2d 2d 74 65 78 74 2d 62 72 61 6e 64 29 3b 6f 70 61 63 69 74 79 3a 2e 36 7d 2e 70 61 74 68 33 5f 62 36 64 62 32 30 7b 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 2e 32 33 73 3b 73 74 72 6f 6b 65 3a 76 61 72 28 2d 2d 74 65 78 74 2d 62 72 61 6e 64 29 7d 2e 74 68 65 6d 65 2d 6c 69 67 68 74 20 2e 70 61 74 68 33 5f 62 36 64 62 32 30 7b 6f 70 61 63 69 74 79 3a 2e 33 7d 68 74 6d 6c 2e 64 65 63 6f 72 61 74 65 2d 6c 69 6e 6b 73 20 2e 6c 6f 77 53 61 Data Ascii: -miterlimit:10;stroke-linecap:round;stroke:var(--brand-500)}.path2_b6db20{animation-delay:.15s;stroke:var(--text-brand);opacity:.6}.path3_b6db20{animation-delay:.23s;stroke:var(--text-brand)}.theme-light .path3_b6db20{opacity:.3}html.decorate-links .lowSa
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 74 28 74 6f 20 74 6f 70 2c 74 72 61 6e 73 70 61 72 65 6e 74 2c 74 72 61 6e 73 70 61 72 65 6e 74 20 76 61 72 28 2d 2d 63 75 73 74 6f 6d 2d 62 75 74 74 6f 6e 2d 6c 69 6e 6b 2d 75 6e 64 65 72 6c 69 6e 65 2d 6f 66 66 73 65 74 29 2c 74 72 61 6e 73 70 61 72 65 6e 74 20 76 61 72 28 2d 2d 63 75 73 74 6f 6d 2d 62 75 74 74 6f 6e 2d 6c 69 6e 6b 2d 75 6e 64 65 72 6c 69 6e 65 2d 6f 66 66 73 65 74 29 2c 74 72 61 6e 73 70 61 72 65 6e 74 20 76 61 72 28 2d 2d 63 75 73 74 6f 6d 2d 62 75 74 74 6f 6e 2d 6c 69 6e 6b 2d 75 6e 64 65 72 6c 69 6e 65 2d 73 74 6f 70 29 2c 74 72 61 6e 73 70 61 72 65 6e 74 20 76 61 72 28 2d 2d 63 75 73 74 6f 6d 2d 62 75 74 74 6f 6e 2d 6c 69 6e 6b 2d 75 6e 64 65 72 6c 69 6e 65 2d 73 74 6f 70 29 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a Data Ascii: t(to top,transparent,transparent var(--custom-button-link-underline-offset),transparent var(--custom-button-link-underline-offset),transparent var(--custom-button-link-underline-stop),transparent var(--custom-button-link-underline-stop));background-image:
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 6f 72 42 72 61 6e 64 49 6e 76 65 72 74 65 64 5f 64 64 34 66 38 35 5b 61 72 69 61 2d 64 69 73 61 62 6c 65 64 3d 74 72 75 65 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 77 68 69 74 65 2d 35 30 30 29 7d 2e 6c 6f 6f 6b 46 69 6c 6c 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 42 72 61 6e 64 49 6e 76 65 72 74 65 64 5f 64 64 34 66 38 35 20 2e 73 70 69 6e 6e 65 72 49 74 65 6d 5f 64 64 34 66 38 35 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 72 61 6e 64 2d 35 30 30 29 7d 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 42 72 61 6e 64 5f 64 64 34 66 38 35 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 74 74 6f 6e 2d 6f 75 74 6c 69 6e 65 2d 62 72 61 6e 64 2d 74 65 78 74 29 3b 62 Data Ascii: orBrandInverted_dd4f85[aria-disabled=true]{background-color:var(--white-500)}.lookFilled_dd4f85.colorBrandInverted_dd4f85 .spinnerItem_dd4f85{background-color:var(--brand-500)}.lookOutlined_dd4f85.colorBrand_dd4f85{color:var(--button-outline-brand-text);b
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 35 2e 63 6f 6c 6f 72 50 72 69 6d 61 72 79 5f 64 64 34 66 38 35 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 74 74 6f 6e 2d 6f 75 74 6c 69 6e 65 2d 70 72 69 6d 61 72 79 2d 74 65 78 74 29 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 74 74 6f 6e 2d 6f 75 74 6c 69 6e 65 2d 70 72 69 6d 61 72 79 2d 62 6f 72 64 65 72 29 7d 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 50 72 69 6d 61 72 79 5f 64 64 34 66 38 35 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 74 74 6f 6e 2d 6f 75 74 6c 69 6e 65 2d 70 72 69 6d 61 72 79 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 68 6f 76 65 72 29 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 74 74 6f 6e 2d 6f 75 74 6c 69 Data Ascii: 5.colorPrimary_dd4f85{color:var(--button-outline-primary-text);border-color:var(--button-outline-primary-border)}.lookOutlined_dd4f85.colorPrimary_dd4f85:hover{background-color:var(--button-outline-primary-background-hover);border-color:var(--button-outli
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 4c 69 6e 6b 5f 64 64 34 66 38 35 3a 61 63 74 69 76 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 28 76 61 72 28 2d 2d 74 65 78 74 2d 6c 69 6e 6b 2d 68 73 6c 29 2f 2e 31 29 7d 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 4c 69 6e 6b 5f 64 64 34 66 38 35 3a 64 69 73 61 62 6c 65 64 2c 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 4c 69 6e 6b 5f 64 64 34 66 38 35 5b 61 72 69 61 2d 64 69 73 61 62 6c 65 64 3d 74 72 75 65 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 4c 69 6e 6b 5f 64 64 34 66 38 35 20 2e 73 Data Ascii: ned_dd4f85.colorLink_dd4f85:active{background-color:hsl(var(--text-link-hsl)/.1)}.lookOutlined_dd4f85.colorLink_dd4f85:disabled,.lookOutlined_dd4f85.colorLink_dd4f85[aria-disabled=true]{background-color:transparent}.lookOutlined_dd4f85.colorLink_dd4f85 .s
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 6c 6f 72 57 68 69 74 65 5f 64 64 34 66 38 35 3a 64 69 73 61 62 6c 65 64 2c 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 57 68 69 74 65 5f 64 64 34 66 38 35 5b 61 72 69 61 2d 64 69 73 61 62 6c 65 64 3d 74 72 75 65 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 57 68 69 74 65 5f 64 64 34 66 38 35 20 2e 73 70 69 6e 6e 65 72 49 74 65 6d 5f 64 64 34 66 38 35 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 77 68 69 74 65 2d 35 30 30 29 7d 2e 6c 6f 6f 6b 4c 69 6e 6b 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 57 68 69 74 65 5f 64 64 34 66 38 35 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 77 68 Data Ascii: lorWhite_dd4f85:disabled,.lookOutlined_dd4f85.colorWhite_dd4f85[aria-disabled=true]{background-color:transparent}.lookOutlined_dd4f85.colorWhite_dd4f85 .spinnerItem_dd4f85{background-color:var(--white-500)}.lookLink_dd4f85.colorWhite_dd4f85{color:var(--wh
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 68 6f 76 65 72 29 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 74 74 6f 6e 2d 6f 75 74 6c 69 6e 65 2d 64 61 6e 67 65 72 2d 62 6f 72 64 65 72 2d 68 6f 76 65 72 29 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 74 74 6f 6e 2d 6f 75 74 6c 69 6e 65 2d 64 61 6e 67 65 72 2d 74 65 78 74 2d 68 6f 76 65 72 29 7d 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 52 65 64 5f 64 64 34 66 38 35 3a 61 63 74 69 76 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 74 74 6f 6e 2d 6f 75 74 6c 69 6e 65 2d 64 61 6e 67 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 61 63 74 69 76 65 29 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 74 74 6f 6e 2d 6f Data Ascii: -background-hover);border-color:var(--button-outline-danger-border-hover);color:var(--button-outline-danger-text-hover)}.lookOutlined_dd4f85.colorRed_dd4f85:active{background-color:var(--button-outline-danger-background-active);border-color:var(--button-o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.9	49790	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:16 UTC	879	OUT	GET /assets/webMinimal.183cbc8427e6b143ce21.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:16 UTC	963	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:16 GMT Content-Type: text/javascript Content-Length: 14624305 Connection: close CF-Ray: 8d782e344c482e7b-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "216cb783d60a3e7c57c9d9ffea99dc3f" Last-Modified: Thu, 24 Oct 2024 03:15:20 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S9Tzm2qU8y6NQIdNwX3941ANEP5jNjE5CWMe8aWDJJxXljE3fi6IfyKey33%2FEVO87qtz3JhQfRUSVIUYvNL7WFa1S5NMSy3XyacR3p6RU5uROOnL%2FsPfN4U1afgG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:16 UTC	406	IN	Data Raw: 28 28 29 3d 3e 7b 76 61 72 20 65 3d 7b 33 38 35 30 30 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 7b 22 2e 2f 64 65 2e 6a 73 6f 6e 61 22 3a 5b 22 36 34 34 37 35 33 22 2c 22 33 30 32 34 34 22 5d 2c 22 2e 2f 7a 68 2d 43 4e 2e 6a 73 6f 6e 61 22 3a 5b 22 34 39 34 30 36 32 22 2c 22 35 36 34 34 36 22 5d 2c 22 2e 2f 64 61 2e 6a 73 6f 6e 61 22 3a 5b 22 34 34 38 36 37 22 2c 22 35 37 33 38 37 22 5d 2c 22 2e 2f 65 6c 2e 6a 73 6f 6e 61 22 3a 5b 22 35 38 31 31 34 34 22 2c 22 35 35 36 30 31 22 5d 2c 22 2e 2f 74 72 2e 6a 73 6f 6e 61 22 3a 5b 22 31 34 36 38 37 38 22 2c 22 38 34 33 38 35 22 5d 2c 22 2e 2f 65 73 2d 45 53 2e 6a 73 6f 6e 61 22 3a 5b 22 38 37 32 35 35 30 22 2c 22 34 35 37 34 37 22 5d 2c 22 2e 2f 68 72 2e 6a 73 6f 6e 61 22 3a 5b 22 Data Ascii: (()=>{var e={385007:function(e,t,n){var r={"./de.jsona":["644753","30244"],"./zh-CN.jsona":["494062","56446"],"./da.jsona":["44867","57387"],"./el.jsona":["581144","55601"],"./tr.jsona":["146878","84385"],"./es-ES.jsona":["872550","45747"],"./hr.jsona":["
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 2d 42 52 2e 6a 73 6f 6e 61 22 3a 5b 22 32 34 36 32 39 37 22 2c 22 33 39 34 22 5d 2c 22 2e 2f 72 6f 2e 6a 73 6f 6e 61 22 3a 5b 22 33 37 31 39 30 22 2c 22 35 33 32 36 39 22 5d 2c 22 2e 2f 73 76 2d 53 45 2e 6a 73 6f 6e 61 22 3a 5b 22 33 33 35 34 31 37 22 2c 22 31 31 31 39 33 22 5d 2c 22 2e 2f 72 75 2e 6a 73 6f 6e 61 22 3a 5b 22 38 30 39 34 36 34 22 2c 22 31 32 36 31 31 22 5d 2c 22 2e 2f 76 69 2e 6a 73 6f 6e 61 22 3a 5b 22 31 33 39 31 30 37 22 2c 22 34 35 35 37 36 22 5d 2c 22 2e 2f 69 64 2e 6a 73 6f 6e 61 22 3a 5b 22 34 39 32 32 34 38 22 2c 22 37 37 38 30 30 22 5d 2c 22 2e 2f 69 74 2e 6a 73 6f 6e 61 22 3a 5b 22 35 31 35 36 33 30 22 2c 22 37 38 36 37 30 22 5d 2c 22 2e 2f 75 6b 2e 6a 73 6f 6e 61 22 3a 5b 22 31 36 37 31 31 31 22 2c 22 35 38 35 34 38 22 5d 2c 22 Data Ascii: -BR.jsona":["246297","394"],"./ro.jsona":["37190","53269"],"./sv-SE.jsona":["335417","11193"],"./ru.jsona":["809464","12611"],"./vi.jsona":["139107","45576"],"./id.jsona":["492248","77800"],"./it.jsona":["515630","78670"],"./uk.jsona":["167111","58548"],"
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 72 5f 32 35 30 30 78 31 30 30 30 2e 70 6e 67 22 3a 22 39 32 38 34 30 30 22 2c 22 2e 2f 73 74 69 63 6b 65 72 73 2d 6c 61 75 6e 63 68 2f 32 30 32 30 5f 50 4d 4d 5f 53 54 49 43 4b 45 52 53 5f 4d 72 6b 74 5f 44 65 73 6b 74 6f 70 48 65 72 6f 5f 4c 65 66 74 5f 31 38 30 78 32 32 30 2e 70 6e 67 22 3a 22 31 34 38 38 32 31 22 2c 22 2e 2f 73 74 69 63 6b 65 72 73 2d 6c 61 75 6e 63 68 2f 32 30 32 30 5f 50 4d 4d 5f 53 54 49 43 4b 45 52 53 5f 4d 72 6b 74 5f 44 65 73 6b 74 6f 70 48 65 72 6f 5f 52 69 67 68 74 5f 31 38 30 78 32 32 30 2e 70 6e 67 22 3a 22 39 38 32 35 36 33 22 2c 22 2e 2f 73 74 69 63 6b 65 72 73 2d 6c 61 75 6e 63 68 2f 32 30 32 30 5f 50 4d 4d 5f 53 54 49 43 4b 45 52 53 5f 4d 72 6b 74 5f 44 65 73 6b 74 6f 70 5f 43 68 61 6e 67 65 6c 6f 67 5f 36 35 38 58 32 32 Data Ascii: r_2500x1000.png":"928400","./stickers-launch/2020_PMM_STICKERS_Mrkt_DesktopHero_Left_180x220.png":"148821","./stickers-launch/2020_PMM_STICKERS_Mrkt_DesktopHero_Right_180x220.png":"982563","./stickers-launch/2020_PMM_STICKERS_Mrkt_Desktop_Changelog_658X22
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 3d 22 4d 4f 44 55 4c 45 5f 4e 4f 54 5f 46 4f 55 4e 44 22 2c 74 7d 72 65 74 75 72 6e 20 72 5b 65 5d 7d 69 2e 6b 65 79 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 72 29 7d 2c 69 2e 72 65 73 6f 6c 76 65 3d 61 2c 65 2e 65 78 70 6f 72 74 73 3d 69 2c 69 2e 69 64 3d 22 31 34 38 36 36 30 22 7d 2c 35 37 37 33 39 31 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 7b 22 2e 2f 69 6d 67 5f 70 72 65 6d 69 75 6d 5f 65 6d 6f 6a 69 5f 64 61 72 6b 2e 73 76 67 22 3a 22 33 34 31 30 34 38 22 2c 22 2e 2f 69 6d 67 5f 70 72 65 6d 69 75 6d 5f 65 6d 6f 6a 69 5f 6c 69 67 68 74 2e 73 76 67 22 3a 22 35 33 37 33 38 31 22 2c 22 2e 2f 69 6d 67 5f 70 72 65 6d 69 75 6d 5f 65 6d 6f 6a 69 5f 74 75 74 6f 72 69 61 6c 2e Data Ascii: ="MODULE_NOT_FOUND",t}return r[e]}i.keys=function(){return Object.keys(r)},i.resolve=a,e.exports=i,i.id="148660"},577391:function(e,t,n){var r={"./img_premium_emoji_dark.svg":"341048","./img_premium_emoji_light.svg":"537381","./img_premium_emoji_tutorial.
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 29 7b 69 66 28 21 6e 2e 6f 28 72 2c 65 29 29 7b 76 61 72 20 74 3d 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 66 69 6e 64 20 6d 6f 64 75 6c 65 20 27 22 2b 65 2b 22 27 22 29 3b 74 68 72 6f 77 20 74 2e 63 6f 64 65 3d 22 4d 4f 44 55 4c 45 5f 4e 4f 54 5f 46 4f 55 4e 44 22 2c 74 7d 72 65 74 75 72 6e 20 72 5b 65 5d 7d 69 2e 6b 65 79 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 72 29 7d 2c 69 2e 72 65 73 6f 6c 76 65 3d 61 2c 65 2e 65 78 70 6f 72 74 73 3d 69 2c 69 2e 69 64 3d 22 37 33 35 38 30 30 22 7d 2c 36 30 34 39 30 31 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 7b 22 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 65 6d 6f 6a 69 2d 33 32 2e 70 6e Data Ascii: ))}function a(e){if(!n.o(r,e)){var t=Error("Cannot find module '"+e+"'");throw t.code="MODULE_NOT_FOUND",t}return r[e]}i.keys=function(){return Object.keys(r)},i.resolve=a,e.exports=i,i.id="735800"},604901:function(e,t,n){var r={"./spritesheet-emoji-32.pn
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 3a 22 35 37 38 31 34 22 2c 22 2e 2f 68 61 6c 6c 6f 77 65 65 6e 5f 64 65 66 65 61 6e 2e 6d 70 33 22 3a 22 38 31 39 30 39 38 22 2c 22 2e 2f 68 61 6c 6c 6f 77 65 65 6e 5f 64 69 73 63 6f 6e 6e 65 63 74 2e 6d 70 33 22 3a 22 33 38 32 34 37 32 22 2c 22 2e 2f 68 61 6c 6c 6f 77 65 65 6e 5f 6d 65 73 73 61 67 65 31 2e 6d 70 33 22 3a 22 37 37 32 36 33 37 22 2c 22 2e 2f 68 61 6c 6c 6f 77 65 65 6e 5f 6d 75 74 65 2e 6d 70 33 22 3a 22 35 33 39 37 31 36 22 2c 22 2e 2f 68 61 6c 6c 6f 77 65 65 6e 5f 75 6e 64 65 61 66 65 6e 2e 6d 70 33 22 3a 22 32 35 37 31 33 30 22 2c 22 2e 2f 68 61 6c 6c 6f 77 65 65 6e 5f 75 6e 64 65 66 65 61 6e 2e 6d 70 33 22 3a 22 31 30 37 38 34 38 22 2c 22 2e 2f 68 61 6c 6c 6f 77 65 65 6e 5f 75 6e 6d 75 74 65 2e 6d 70 33 22 3a 22 34 33 32 39 31 35 22 2c Data Ascii: :"57814","./halloween_defean.mp3":"819098","./halloween_disconnect.mp3":"382472","./halloween_message1.mp3":"772637","./halloween_mute.mp3":"539716","./halloween_undeafen.mp3":"257130","./halloween_undefean.mp3":"107848","./halloween_unmute.mp3":"432915",
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 29 29 7b 76 61 72 20 74 3d 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 66 69 6e 64 20 6d 6f 64 75 6c 65 20 27 22 2b 65 2b 22 27 22 29 3b 74 68 72 6f 77 20 74 2e 63 6f 64 65 3d 22 4d 4f 44 55 4c 45 5f 4e 4f 54 5f 46 4f 55 4e 44 22 2c 74 7d 72 65 74 75 72 6e 20 72 5b 65 5d 7d 69 2e 6b 65 79 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 72 29 7d 2c 69 2e 72 65 73 6f 6c 76 65 3d 61 2c 65 2e 65 78 70 6f 72 74 73 3d 69 2c 69 2e 69 64 3d 22 34 35 31 33 34 33 22 7d 2c 31 37 34 34 39 38 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6c 65 74 20 74 3d 7b 7d 3b 74 2e 69 73 53 61 66 61 72 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 61 76 69 67 61 74 6f 72 3f 2e 76 65 6e 64 6f 72 26 26 6e 61 76 69 67 61 74 6f Data Ascii: )){var t=Error("Cannot find module '"+e+"'");throw t.code="MODULE_NOT_FOUND",t}return r[e]}i.keys=function(){return Object.keys(r)},i.resolve=a,e.exports=i,i.id="451343"},174498:function(e){let t={};t.isSafari=function(){return navigator?.vendor&&navigato
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 7c 68 61 69 65 7c 68 63 69 74 7c 68 64 5c 2d 28 6d 7c 70 7c 74 29 7c 68 65 69 5c 2d 7c 68 69 28 70 74 7c 74 61 29 7c 68 70 28 20 69 7c 69 70 29 7c 68 73 5c 2d 63 7c 68 74 28 63 28 5c 2d 7c 20 7c 5f 7c 61 7c 67 7c 70 7c 73 7c 74 29 7c 74 70 29 7c 68 75 28 61 77 7c 74 63 29 7c 69 5c 2d 28 32 30 7c 67 6f 7c 6d 61 29 7c 69 32 33 30 7c 69 61 63 28 20 7c 5c 2d 7c 5c 2f 29 7c 69 62 72 6f 7c 69 64 65 61 7c 69 67 30 31 7c 69 6b 6f 6d 7c 69 6d 31 6b 7c 69 6e 6e 6f 7c 69 70 61 71 7c 69 72 69 73 7c 6a 61 28 74 7c 76 29 61 7c 6a 62 72 6f 7c 6a 65 6d 75 7c 6a 69 67 73 7c 6b 64 64 69 7c 6b 65 6a 69 7c 6b 67 74 28 20 7c 5c 2f 29 7c 6b 6c 6f 6e 7c 6b 70 74 20 7c 6b 77 63 5c 2d 7c 6b 79 6f 28 63 7c 6b 29 7c 6c 65 28 6e 6f 7c 78 69 29 7c 6c 67 28 20 67 7c 5c 2f 28 6b 7c 6c Data Ascii: \|haie\|hcit\|hd\-(m\|p\|t)\|hei\-\|hi(pt\|ta)\|hp( i\|ip)\|hs\-c\|ht(c(\-\| \|_\|a\|g\|p\|s\|t)\|tp)\|hu(aw\|tc)\|i\-(20\|go\|ma)\|i230\|iac( \|\-\|\/)\|ibro\|idea\|ig01\|ikom\|im1k\|inno\|ipaq\|iris\|ja(t\|v)a\|jbro\|jemu\|jigs\|kddi\|keji\|kgt( \|\/)\|klon\|kpt \|kwc\-\|kyo(c\|k)\|le(no\|xi)\|lg( g\|\/(k\|l
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 69 63 2e 77 6f 66 66 32 22 3a 5b 22 38 35 38 38 35 35 22 5d 2c 22 2e 2f 6e 6f 74 6f 2d 73 61 6e 73 2f 6e 6f 74 6f 73 61 6e 73 2d 36 30 30 2d 73 65 6d 69 62 6f 6c 64 2e 77 6f 66 66 32 22 3a 5b 22 33 38 31 31 37 36 22 5d 2c 22 2e 2f 67 67 2d 73 61 6e 73 2f 67 67 73 61 6e 73 2d 37 30 30 2d 62 6f 6c 64 2e 77 6f 66 66 32 22 3a 5b 22 39 30 39 36 37 31 22 5d 2c 22 2e 2f 67 67 2d 73 61 6e 73 2f 67 67 73 61 6e 73 2d 35 30 30 2d 6d 65 64 69 75 6d 2e 77 6f 66 66 32 22 3a 5b 22 35 39 38 33 22 5d 2c 22 2e 2f 6e 6f 74 6f 2d 73 61 6e 73 2f 6e 6f 74 6f 73 61 6e 73 2d 35 30 30 2d 6d 65 64 69 75 6d 69 74 61 6c 69 63 2e 77 6f 66 66 32 22 3a 5b 22 33 39 30 32 38 38 22 5d 2c 22 2e 2f 66 72 61 75 6e 63 65 73 2f 66 72 61 75 6e 63 65 73 2d 34 30 30 2d 6e 6f 72 6d 61 6c 2e 77 6f Data Ascii: ic.woff2":["858855"],"./noto-sans/notosans-600-semibold.woff2":["381176"],"./gg-sans/ggsans-700-bold.woff2":["909671"],"./gg-sans/ggsans-500-medium.woff2":["5983"],"./noto-sans/notosans-500-mediumitalic.woff2":["390288"],"./fraunces/fraunces-400-normal.wo
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 3a 5b 22 31 30 31 31 30 33 22 5d 2c 22 2e 2f 67 67 2d 6d 6f 6e 6f 2f 67 67 6d 6f 6e 6f 2d 37 30 30 2d 62 6f 6c 64 2e 77 6f 66 66 32 22 3a 5b 22 37 35 37 38 38 33 22 5d 2c 22 2e 2f 63 6f 72 69 6e 74 68 69 61 2f 63 6f 72 69 6e 74 68 69 61 2d 34 30 30 2d 6e 6f 72 6d 61 6c 2e 77 6f 66 66 32 22 3a 5b 22 36 32 32 38 31 34 22 5d 2c 22 2e 2f 67 67 2d 73 61 6e 73 2f 67 67 73 61 6e 73 2d 36 30 30 2d 73 65 6d 69 62 6f 6c 64 2e 77 6f 66 66 32 22 3a 5b 22 31 35 31 38 35 39 22 5d 2c 22 2e 2f 6e 6f 74 6f 2d 73 61 6e 73 2f 6e 6f 74 6f 73 61 6e 73 2d 35 30 30 2d 6d 65 64 69 75 6d 2e 77 6f 66 66 32 22 3a 5b 22 32 31 34 39 22 5d 7d 3b 66 75 6e 63 74 69 6f 6e 20 69 28 65 29 7b 69 66 28 21 6e 2e 6f 28 72 2c 65 29 29 72 65 74 75 72 6e 20 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c Data Ascii: :["101103"],"./gg-mono/ggmono-700-bold.woff2":["757883"],"./corinthia/corinthia-400-normal.woff2":["622814"],"./gg-sans/ggsans-600-semibold.woff2":["151859"],"./noto-sans/notosans-500-medium.woff2":["2149"]};function i(e){if(!n.o(r,e))return Promise.resol

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.9	49791	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:16 UTC	875	OUT	GET /assets/sentry.d30fc24f50e5e3e76b3e.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:16 UTC	962	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:16 GMT Content-Type: text/javascript Content-Length: 1131565 Connection: close CF-Ray: 8d782e344e623ab5-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "4f8f7ac8f509d88d00832626b0034b06" Last-Modified: Thu, 24 Oct 2024 03:15:20 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OiofmAMNxPcxDNXpDe%2FhZBjmNKBN4nxafC9FSnhVmQMFst8oMqZOc4TkSryPUKuzQR2NwUNazRSh1JaaVlpPalKrJmY2QDLwvnAtcczVQ6e3SpNJohLOXjDw7hO%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 28 28 29 3d 3e 7b 76 61 72 20 65 3d 7b 36 35 34 38 36 31 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 65 3d 72 2e 6e 6d 64 28 65 29 3b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 73 28 39 30 30 37 31 39 39 32 35 34 37 34 30 39 39 32 29 2c 72 3d 22 30 31 32 33 34 35 36 37 38 39 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 22 2c 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 42 69 67 49 6e 74 3b 66 75 6e 63 74 69 6f 6e 20 5f 28 65 2c 74 2c 72 2c 6e 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 65 3f 5f 5b 30 5d 3a 76 6f 69 64 20 30 21 3d 3d 74 3f 31 30 21 3d 2b 74 7c 7c 72 3f 59 28 65 2c 74 2c 72 2c 6e 29 3a 46 28 65 29 3a 46 28 Data Ascii: (()=>{var e={654861:function(e,t,r){e=r.nmd(e);var n=function(e){"use strict";var t=s(9007199254740992),r="0123456789abcdefghijklmnopqrstuvwxyz",a="function"==typeof BigInt;function _(e,t,r,n){return void 0===e?_[0]:void 0!==t?10!=+t\|\|r?Y(e,t,r,n):F(e):F(
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 6e 67 74 68 2c 6f 3d 41 72 72 61 79 28 61 29 2c 45 3d 30 3b 66 6f 72 28 72 3d 30 3b 72 3c 5f 3b 72 2b 2b 29 28 6e 3d 65 5b 72 5d 2d 45 2d 74 5b 72 5d 29 3c 30 3f 28 6e 2b 3d 31 65 37 2c 45 3d 31 29 3a 45 3d 30 2c 6f 5b 72 5d 3d 6e 3b 66 6f 72 28 72 3d 5f 3b 72 3c 61 3b 72 2b 2b 29 7b 69 66 28 28 6e 3d 65 5b 72 5d 2d 45 29 3c 30 29 6e 2b 3d 31 65 37 3b 65 6c 73 65 7b 6f 5b 72 2b 2b 5d 3d 6e 3b 62 72 65 61 6b 7d 6f 5b 72 5d 3d 6e 7d 66 6f 72 28 3b 72 3c 61 3b 72 2b 2b 29 6f 5b 72 5d 3d 65 5b 72 5d 3b 72 65 74 75 72 6e 20 75 28 6f 29 2c 6f 7d 6f 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 5f 2e 70 72 6f 74 6f 74 79 70 65 29 2c 45 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 5f 2e 70 72 6f 74 6f 74 Data Ascii: ngth,o=Array(a),E=0;for(r=0;r<_;r++)(n=e[r]-E-t[r])<0?(n+=1e7,E=1):E=0,o[r]=n;for(r=_;r<a;r++){if((n=e[r]-E)<0)n+=1e7;else{o[r++]=n;break}o[r]=n}for(;r<a;r++)o[r]=e[r];return u(o),o}o.prototype=Object.create(_.prototype),E.prototype=Object.create(_.protot
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 6f 2f 31 65 37 29 3b 72 65 74 75 72 6e 20 5f 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 72 3d 5b 5d 3b 74 2d 2d 20 3e 30 3b 29 72 2e 70 75 73 68 28 30 29 3b 72 65 74 75 72 6e 20 72 2e 63 6f 6e 63 61 74 28 65 29 7d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 73 75 62 74 72 61 63 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 72 2c 6e 2c 61 2c 5f 3d 46 28 65 29 3b 69 66 28 74 68 69 73 2e 73 69 67 6e 21 3d 3d 5f 2e 73 69 67 6e 29 72 65 74 75 72 6e 20 74 68 69 73 2e 61 64 64 28 5f 2e 6e 65 67 61 74 65 28 29 29 3b 76 61 72 20 69 3d 74 68 69 73 2e 76 61 6c 75 65 2c 63 3d 5f 2e 76 61 6c 75 65 3b 69 66 28 5f 2e 69 73 53 6d 61 6c 6c 29 72 65 74 75 72 6e 20 4c 28 69 2c 4d 61 74 68 2e 61 62 73 Data Ascii: =Math.floor(o/1e7);return _}function p(e,t){for(var r=[];t-- >0;)r.push(0);return r.concat(e)}o.prototype.subtract=function(e){var t,r,n,a,_=F(e);if(this.sign!==_.sign)return this.add(_.negate());var i=this.value,c=_.value;if(_.isSmall)return L(i,Math.abs
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 37 2a 72 3b 6f 5b 6e 2b 5f 5d 3d 72 7d 72 65 74 75 72 6e 20 75 28 6f 29 2c 6f 7d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 75 6c 74 69 70 6c 79 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 72 2c 6e 2c 61 3d 46 28 65 29 2c 45 3d 74 68 69 73 2e 76 61 6c 75 65 2c 69 3d 61 2e 76 61 6c 75 65 2c 63 3d 74 68 69 73 2e 73 69 67 6e 21 3d 3d 61 2e 73 69 67 6e 3b 69 66 28 61 2e 69 73 53 6d 61 6c 6c 29 7b 69 66 28 30 3d 3d 3d 69 29 72 65 74 75 72 6e 20 5f 5b 30 5d 3b 69 66 28 31 3d 3d 3d 69 29 72 65 74 75 72 6e 20 74 68 69 73 3b 69 66 28 2d 31 3d 3d 3d 69 29 72 65 74 75 72 6e 20 74 68 69 73 2e 6e 65 67 61 74 65 28 29 3b 69 66 28 28 6e 3d 4d 61 74 68 2e 61 62 73 28 69 29 29 3c 31 65 37 29 72 65 74 75 72 6e 20 6e 65 77 20 6f 28 4f 28 45 2c 6e 29 2c 63 29 3b 69 Data Ascii: 7*r;o[n+_]=r}return u(o),o}o.prototype.multiply=function(e){var t,r,n,a=F(e),E=this.value,i=a.value,c=this.sign!==a.sign;if(a.isSmall){if(0===i)return _[0];if(1===i)return this;if(-1===i)return this.negate();if((n=Math.abs(i))<1e7)return new o(O(E,n),c);i
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 69 28 74 68 69 73 2e 76 61 6c 75 65 2a 74 68 69 73 2e 76 61 6c 75 65 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 44 28 65 2c 74 29 7b 76 61 72 20 72 2c 6e 2c 61 2c 5f 2c 6f 3d 65 2e 6c 65 6e 67 74 68 2c 45 3d 49 28 6f 29 3b 66 6f 72 28 61 3d 30 2c 72 3d 6f 2d 31 3b 72 3e 3d 30 3b 2d 2d 72 29 6e 3d 52 28 28 5f 3d 31 65 37 2a 61 2b 65 5b 72 5d 29 2f 74 29 2c 61 3d 5f 2d 6e 2a 74 2c 45 5b 72 5d 3d 30 7c 6e 3b 72 65 74 75 72 6e 5b 45 2c 30 7c 61 5d 7d 66 75 6e 63 74 69 6f 6e 20 43 28 65 2c 74 29 7b 76 61 72 20 72 2c 6e 2c 63 3d 46 28 74 29 3b 69 66 28 61 29 72 65 74 75 72 6e 5b 6e 65 77 20 69 28 65 2e 76 61 6c 75 65 2f 63 2e 76 61 6c 75 65 29 2c 6e 65 77 20 69 28 65 2e 76 61 6c 75 65 25 63 2e 76 61 6c 75 65 29 5d 3b Data Ascii: on(e){return new i(this.valuethis.value)};function D(e,t){var r,n,a,_,o=e.length,E=I(o);for(a=0,r=o-1;r>=0;--r)n=R((_=1e7a+e[r])/t),a=_-n*t,E[r]=0\|n;return[E,0\|a]}function C(e,t){var r,n,c=F(t);if(a)return[new i(e.value/c.value),new i(e.value%c.value)];
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 30 3e 67 28 73 2c 74 29 29 7b 63 2e 70 75 73 68 28 30 29 3b 63 6f 6e 74 69 6e 75 65 7d 6e 3d 73 2e 6c 65 6e 67 74 68 2c 61 3d 31 65 37 2a 73 5b 6e 2d 31 5d 2b 73 5b 6e 2d 32 5d 2c 5f 3d 31 65 37 2a 74 5b 69 2d 31 5d 2b 74 5b 69 2d 32 5d 2c 6e 3e 69 26 26 28 61 3d 28 61 2b 31 29 2a 31 65 37 29 2c 72 3d 4d 61 74 68 2e 63 65 69 6c 28 61 2f 5f 29 3b 64 6f 7b 69 66 28 30 3e 3d 67 28 6f 3d 4f 28 74 2c 72 29 2c 73 29 29 62 72 65 61 6b 3b 72 2d 2d 7d 77 68 69 6c 65 28 72 29 3b 63 2e 70 75 73 68 28 72 29 2c 73 3d 64 28 73 2c 6f 29 7d 72 65 74 75 72 6e 20 63 2e 72 65 76 65 72 73 65 28 29 2c 5b 6c 28 63 29 2c 6c 28 73 29 5d 7d 28 4e 2c 41 29 29 5b 30 5d 3b 76 61 72 20 70 3d 65 2e 73 69 67 6e 21 3d 3d 63 2e 73 69 67 6e 2c 68 3d 6e 5b 31 5d 2c 53 3d 65 2e 73 69 67 6e Data Ascii: 0>g(s,t)){c.push(0);continue}n=s.length,a=1e7s[n-1]+s[n-2],_=1e7t[i-1]+t[i-2],n>i&&(a=(a+1)*1e7),r=Math.ceil(a/_);do{if(0>=g(o=O(t,r),s))break;r--}while(r);c.push(r),s=d(s,o)}return c.reverse(),[l(c),l(s)]}(N,A))[0];var p=e.sign!==c.sign,h=n[1],S=e.sign
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 31 5d 7d 2c 69 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 6f 64 3d 69 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 6d 61 69 6e 64 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 69 28 74 68 69 73 2e 76 61 6c 75 65 25 46 28 65 29 2e 76 61 6c 75 65 29 7d 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 6d 61 69 6e 64 65 72 3d 45 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 6f 64 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 6d 61 69 6e 64 65 72 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 6f 64 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 70 6f 77 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 72 2c 6e 2c 61 3d 46 28 65 29 2c 6f 3d 74 68 69 73 2e 76 61 6c 75 65 2c 69 3d 61 2e 76 61 6c 75 65 3b 69 66 28 30 3d 3d 3d 69 29 72 65 74 75 72 6e 20 5f 5b 31 5d Data Ascii: 1]},i.prototype.mod=i.prototype.remainder=function(e){return new i(this.value%F(e).value)},E.prototype.remainder=E.prototype.mod=o.prototype.remainder=o.prototype.mod,o.prototype.pow=function(e){var t,r,n,a=F(e),o=this.value,i=a.value;if(0===i)return _[1]
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 3b 72 65 74 75 72 6e 20 74 2e 69 73 53 6d 61 6c 6c 3f 31 3a 67 28 72 2c 6e 29 7d 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6d 70 61 72 65 41 62 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 46 28 65 29 2c 72 3d 4d 61 74 68 2e 61 62 73 28 74 68 69 73 2e 76 61 6c 75 65 29 2c 6e 3d 74 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 74 2e 69 73 53 6d 61 6c 6c 3f 72 3d 3d 3d 28 6e 3d 4d 61 74 68 2e 61 62 73 28 6e 29 29 3f 30 3a 72 3e 6e 3f 31 3a 2d 31 3a 2d 31 7d 2c 69 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6d 70 61 72 65 41 62 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 76 61 6c 75 65 2c 72 3d 46 28 65 29 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 28 74 3d 74 3e 3d 30 3f 74 3a 2d 74 29 3d 3d 3d 28 72 3d 72 3e 3d 30 3f 72 Data Ascii: ;return t.isSmall?1:g(r,n)},E.prototype.compareAbs=function(e){var t=F(e),r=Math.abs(this.value),n=t.value;return t.isSmall?r===(n=Math.abs(n))?0:r>n?1:-1:-1},i.prototype.compareAbs=function(e){var t=this.value,r=F(e).value;return(t=t>=0?t:-t)===(r=r>=0?r
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 79 70 65 2e 67 74 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 67 72 65 61 74 65 72 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 73 73 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 30 3e 74 68 69 73 2e 63 6f 6d 70 61 72 65 28 65 29 7d 2c 69 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 74 3d 69 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 73 73 65 72 3d 45 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 74 3d 45 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 73 73 65 72 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 74 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 73 73 65 72 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 67 72 65 61 74 65 72 4f 72 45 71 75 61 6c 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 63 6f 6d 70 61 72 65 28 65 29 3e 3d 30 7d 2c 69 2e Data Ascii: ype.gt=o.prototype.greater,o.prototype.lesser=function(e){return 0>this.compare(e)},i.prototype.lt=i.prototype.lesser=E.prototype.lt=E.prototype.lesser=o.prototype.lt=o.prototype.lesser,o.prototype.greaterOrEquals=function(e){return this.compare(e)>=0},i.
2024-10-24 07:16:16 UTC	1369	IN	Data Raw: 73 55 6e 69 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 61 62 73 28 29 2e 76 61 6c 75 65 3d 3d 3d 42 69 67 49 6e 74 28 31 29 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 5a 65 72 6f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 31 7d 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 5a 65 72 6f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 30 3d 3d 3d 74 68 69 73 2e 76 61 6c 75 65 7d 2c 69 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 5a 65 72 6f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 76 61 6c 75 65 3d 3d 3d 42 69 67 49 6e 74 28 30 29 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 44 69 76 69 73 69 62 6c 65 42 79 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 46 28 65 Data Ascii: sUnit=function(){return this.abs().value===BigInt(1)},o.prototype.isZero=function(){return!1},E.prototype.isZero=function(){return 0===this.value},i.prototype.isZero=function(){return this.value===BigInt(0)},o.prototype.isDivisibleBy=function(e){var t=F(e

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.9	49796	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:17 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:17 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: ec87b83f-a01e-0053-3f64-238603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071617Z-17fbfdc98bbn5xh71qanksxprn00000006zg000000005na1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:17 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.9	49793	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:17 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:17 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 9728de04-701e-0097-2579-23b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071617Z-17fbfdc98bbcrtjhdvnfuyp288000000070g000000004pm5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:17 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.9	49792	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:17 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:17 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:17 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 610ea227-401e-00ac-206b-230a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071617Z-17fbfdc98bbczcjda6v8hpct4c00000000pg000000001us9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:17 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.9	49795	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:17 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:17 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: d7699e86-701e-0050-405d-236767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071617Z-17fbfdc98bbvcvlzx1n0fduhm0000000070g000000004bc5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:17 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.9	49794	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:17 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:17 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: fc76b70a-c01e-0034-0bf8-202af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071617Z-r1755647c66kv68zfmyfrbcqzg00000007ug000000005meb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:17 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.9	49800	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:18 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:18 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:18 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: fd7883f4-d01e-0017-7959-23b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071618Z-r1755647c66nxct5p0gnwngmx000000008sg000000000h23 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:18 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.9	49799	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:18 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:18 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:18 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 4aa30514-001e-0014-5150-235151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071618Z-17fbfdc98bbq2x5bzrteug30v800000006ug000000005skz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:18 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.9	49801	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:18 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:18 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:18 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 3ee1fb64-201e-00aa-2159-233928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071618Z-17fbfdc98bbndwgn5b4pg7s8bs00000006zg000000000src x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:18 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.9	49802	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:18 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:18 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:18 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 9175aec4-101e-0028-2a56-238f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071618Z-17fbfdc98bbgpkh7048gc3vfcc00000007000000000052qc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:18 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.9	49804	162.159.136.232	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:18 UTC	680	OUT	GET /assets/sentry.d30fc24f50e5e3e76b3e.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:18 UTC	962	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:18 GMT Content-Type: text/javascript Content-Length: 1131565 Connection: close CF-Ray: 8d782e40ec726b1f-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "4f8f7ac8f509d88d00832626b0034b06" Last-Modified: Thu, 24 Oct 2024 03:15:20 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HHxtnxN3ZOF6LsoCb2DprZ6n7b1Z6ZNf1b6qRFdKwH7EshhesPeNf1ChA8GoMLdgfDlf5biVlxpkKNYCblvi%2FyNLi5SUDwPGkzuTsNTMgPO6MU9%2BHyqnHoHgRiD3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:18 UTC	407	IN	Data Raw: 28 28 29 3d 3e 7b 76 61 72 20 65 3d 7b 36 35 34 38 36 31 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 65 3d 72 2e 6e 6d 64 28 65 29 3b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 73 28 39 30 30 37 31 39 39 32 35 34 37 34 30 39 39 32 29 2c 72 3d 22 30 31 32 33 34 35 36 37 38 39 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 22 2c 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 42 69 67 49 6e 74 3b 66 75 6e 63 74 69 6f 6e 20 5f 28 65 2c 74 2c 72 2c 6e 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 65 3f 5f 5b 30 5d 3a 76 6f 69 64 20 30 21 3d 3d 74 3f 31 30 21 3d 2b 74 7c 7c 72 3f 59 28 65 2c 74 2c 72 2c 6e 29 3a 46 28 65 29 3a 46 28 Data Ascii: (()=>{var e={654861:function(e,t,r){e=r.nmd(e);var n=function(e){"use strict";var t=s(9007199254740992),r="0123456789abcdefghijklmnopqrstuvwxyz",a="function"==typeof BigInt;function _(e,t,r,n){return void 0===e?_[0]:void 0!==t?10!=+t\|\|r?Y(e,t,r,n):F(e):F(
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 20 63 28 65 29 7b 72 65 74 75 72 6e 20 2d 39 30 30 37 31 39 39 32 35 34 37 34 30 39 39 32 3c 65 26 26 65 3c 39 30 30 37 31 39 39 32 35 34 37 34 30 39 39 32 7d 66 75 6e 63 74 69 6f 6e 20 73 28 65 29 7b 72 65 74 75 72 6e 20 65 3c 31 65 37 3f 5b 65 5d 3a 65 3c 31 65 31 34 3f 5b 65 25 31 65 37 2c 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 2f 31 65 37 29 5d 3a 5b 65 25 31 65 37 2c 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 2f 31 65 37 29 25 31 65 37 2c 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 2f 31 65 31 34 29 5d 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 65 29 7b 75 28 65 29 3b 76 61 72 20 72 3d 65 2e 6c 65 6e 67 74 68 3b 69 66 28 72 3c 34 26 26 30 3e 67 28 65 2c 74 29 29 73 77 69 74 63 68 28 72 29 7b 63 61 73 65 20 30 3a 72 65 74 75 72 6e 20 30 3b 63 61 73 65 20 31 3a 72 65 74 75 72 Data Ascii: c(e){return -9007199254740992<e&&e<9007199254740992}function s(e){return e<1e7?[e]:e<1e14?[e%1e7,Math.floor(e/1e7)]:[e%1e7,Math.floor(e/1e7)%1e7,Math.floor(e/1e14)]}function l(e){u(e);var r=e.length;if(r<4&&0>g(e,t))switch(r){case 0:return 0;case 1:retur
2024-10-24 07:16:18 UTC	1257	IN	Data Raw: 75 65 2c 6e 3d 74 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 74 2e 69 73 53 6d 61 6c 6c 3f 6e 65 77 20 6f 28 54 28 72 2c 4d 61 74 68 2e 61 62 73 28 6e 29 29 2c 74 68 69 73 2e 73 69 67 6e 29 3a 6e 65 77 20 6f 28 41 28 72 2c 6e 29 2c 74 68 69 73 2e 73 69 67 6e 29 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 70 6c 75 73 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 46 28 65 29 2c 72 3d 74 68 69 73 2e 76 61 6c 75 65 3b 69 66 28 72 3c 30 21 3d 3d 74 2e 73 69 67 6e 29 72 65 74 75 72 6e 20 74 68 69 73 2e 73 75 62 74 72 61 63 74 28 74 2e 6e 65 67 61 74 65 28 29 29 3b 76 61 72 20 6e 3d 74 2e 76 61 6c 75 65 3b 69 66 28 74 2e 69 73 53 6d 61 6c 6c 29 7b 69 66 28 63 Data Ascii: ue,n=t.value;return t.isSmall?new o(T(r,Math.abs(n)),this.sign):new o(A(r,n),this.sign)},o.prototype.plus=o.prototype.add,E.prototype.add=function(e){var t=F(e),r=this.value;if(r<0!==t.sign)return this.subtract(t.negate());var n=t.value;if(t.isSmall){if(c
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 6e 2c 28 67 28 74 2c 72 29 3e 3d 30 3f 61 3d 64 28 74 2c 72 29 3a 28 61 3d 64 28 72 2c 74 29 2c 6e 3d 21 6e 29 2c 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 28 61 3d 6c 28 61 29 29 29 3f 28 6e 26 26 28 61 3d 2d 61 29 2c 6e 65 77 20 45 28 61 29 29 3a 6e 65 77 20 6f 28 61 2c 6e 29 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 69 6e 75 73 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 73 75 62 74 72 61 63 74 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 73 75 62 74 72 61 63 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 46 28 65 29 2c 72 3d 74 68 69 73 2e 76 61 6c 75 65 3b 69 66 28 72 3c 30 21 3d 3d 74 2e 73 69 67 6e 29 72 65 74 75 72 6e 20 74 68 69 73 2e 61 64 64 28 74 2e 6e 65 67 61 74 65 28 29 29 3b 76 61 72 20 6e 3d 74 2e 76 61 6c 75 65 3b 72 65 74 75 Data Ascii: n,(g(t,r)>=0?a=d(t,r):(a=d(r,t),n=!n),"number"==typeof(a=l(a)))?(n&&(a=-a),new E(a)):new o(a,n)},o.prototype.minus=o.prototype.subtract,E.prototype.subtract=function(e){var t=F(e),r=this.value;if(r<0!==t.sign)return this.add(t.negate());var n=t.value;retu
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 69 2e 6c 65 6e 67 74 68 29 2b 31 35 65 2d 36 2a 74 2a 72 3e 30 29 3f 6e 65 77 20 6f 28 66 75 6e 63 74 69 6f 6e 20 65 28 74 2c 72 29 7b 76 61 72 20 6e 3d 4d 61 74 68 2e 6d 61 78 28 74 2e 6c 65 6e 67 74 68 2c 72 2e 6c 65 6e 67 74 68 29 3b 69 66 28 6e 3c 3d 33 30 29 72 65 74 75 72 6e 20 66 28 74 2c 72 29 3b 6e 3d 4d 61 74 68 2e 63 65 69 6c 28 6e 2f 32 29 3b 76 61 72 20 61 3d 74 2e 73 6c 69 63 65 28 6e 29 2c 5f 3d 74 2e 73 6c 69 63 65 28 30 2c 6e 29 2c 6f 3d 72 2e 73 6c 69 63 65 28 6e 29 2c 45 3d 72 2e 73 6c 69 63 65 28 30 2c 6e 29 2c 69 3d 65 28 5f 2c 45 29 2c 63 3d 65 28 61 2c 6f 29 2c 73 3d 65 28 41 28 5f 2c 61 29 2c 41 28 45 2c 6f 29 29 2c 6c 3d 41 28 41 28 69 2c 70 28 64 28 64 28 73 2c 69 29 2c 63 29 2c 6e 29 29 2c 70 28 63 2c 32 2a 6e 29 29 3b 72 65 74 Data Ascii: i.length)+15e-6tr>0)?new o(function e(t,r){var n=Math.max(t.length,r.length);if(n<=30)return f(t,r);n=Math.ceil(n/2);var a=t.slice(n),_=t.slice(0,n),o=r.slice(n),E=r.slice(0,n),i=e(_,E),c=e(a,o),s=e(A(_,a),A(E,o)),l=A(A(i,p(d(d(s,i),c),n)),p(c,2*n));ret
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 64 69 76 69 64 65 20 62 79 20 7a 65 72 6f 22 29 3b 69 66 28 65 2e 69 73 53 6d 61 6c 6c 29 72 65 74 75 72 6e 20 63 2e 69 73 53 6d 61 6c 6c 3f 5b 6e 65 77 20 45 28 52 28 4e 2f 41 29 29 2c 6e 65 77 20 45 28 4e 25 41 29 5d 3a 5b 5f 5b 30 5d 2c 65 5d 3b 69 66 28 63 2e 69 73 53 6d 61 6c 6c 29 7b 69 66 28 31 3d 3d 3d 41 29 72 65 74 75 72 6e 5b 65 2c 5f 5b 30 5d 5d 3b 69 66 28 2d 31 3d 3d 41 29 72 65 74 75 72 6e 5b 65 2e 6e 65 67 61 74 65 28 29 2c 5f 5b 30 5d 5d 3b 76 61 72 20 54 3d 4d 61 74 68 2e 61 62 73 28 41 29 3b 69 66 28 54 3c 31 65 37 29 7b 72 3d 6c 28 28 6e 3d 44 28 4e 2c 54 29 29 5b 30 5d 29 3b 76 61 72 20 4c 3d 6e 5b 31 5d 3b 72 65 74 75 72 6e 28 65 2e 73 69 67 6e 26 26 28 4c 3d 2d 4c 29 2c 22 6e 75 6d 62 65 72 22 Data Ascii: rror("Cannot divide by zero");if(e.isSmall)return c.isSmall?[new E(R(N/A)),new E(N%A)]:[_[0],e];if(c.isSmall){if(1===A)return[e,_[0]];if(-1==A)return[e.negate(),_[0]];var T=Math.abs(A);if(T<1e7){r=l((n=D(N,T))[0]);var L=n[1];return(e.sign&&(L=-L),"number"
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 65 77 20 45 28 72 29 29 3a 72 3d 6e 65 77 20 6f 28 72 2c 70 29 2c 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 68 3f 28 53 26 26 28 68 3d 2d 68 29 2c 68 3d 6e 65 77 20 45 28 68 29 29 3a 68 3d 6e 65 77 20 6f 28 68 2c 53 29 2c 5b 72 2c 68 5d 7d 66 75 6e 63 74 69 6f 6e 20 67 28 65 2c 74 29 7b 69 66 28 65 2e 6c 65 6e 67 74 68 21 3d 3d 74 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 65 2e 6c 65 6e 67 74 68 3e 74 2e 6c 65 6e 67 74 68 3f 31 3a 2d 31 3b 66 6f 72 28 76 61 72 20 72 3d 65 2e 6c 65 6e 67 74 68 2d 31 3b 72 3e 3d 30 3b 72 2d 2d 29 69 66 28 65 5b 72 5d 21 3d 3d 74 5b 72 5d 29 72 65 74 75 72 6e 20 65 5b 72 5d 3e 74 5b 72 5d 3f 31 3a 2d 31 3b 72 65 74 75 72 6e 20 30 7d 66 75 6e 63 74 69 6f 6e 20 55 28 65 29 7b 76 61 72 20 74 3d 65 2e 61 62 73 28 29 Data Ascii: ew E(r)):r=new o(r,p),"number"==typeof h?(S&&(h=-h),h=new E(h)):h=new o(h,S),[r,h]}function g(e,t){if(e.length!==t.length)return e.length>t.length?1:-1;for(var r=e.length-1;r>=0;r--)if(e[r]!==t[r])return e[r]>t[r]?1:-1;return 0}function U(e){var t=e.abs()
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 31 5d 3b 69 66 28 2d 31 3d 3d 3d 6f 29 72 65 74 75 72 6e 20 61 2e 69 73 45 76 65 6e 28 29 3f 5f 5b 31 5d 3a 5f 5b 2d 31 5d 3b 69 66 28 61 2e 73 69 67 6e 29 72 65 74 75 72 6e 20 5f 5b 30 5d 3b 69 66 28 21 61 2e 69 73 53 6d 61 6c 6c 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 54 68 65 20 65 78 70 6f 6e 65 6e 74 20 22 2b 61 2e 74 6f 53 74 72 69 6e 67 28 29 2b 22 20 69 73 20 74 6f 6f 20 6c 61 72 67 65 2e 22 29 3b 69 66 28 74 68 69 73 2e 69 73 53 6d 61 6c 6c 26 26 63 28 74 3d 4d 61 74 68 2e 70 6f 77 28 6f 2c 69 29 29 29 72 65 74 75 72 6e 20 6e 65 77 20 45 28 52 28 74 29 29 3b 66 6f 72 28 72 3d 74 68 69 73 2c 6e 3d 5f 5b 31 5d 3b 21 30 26 69 26 26 28 6e 3d 6e 2e 74 69 6d 65 73 28 72 29 2c 2d 2d 69 29 2c 30 21 3d 3d 69 3b 29 7b 3b 69 2f 3d 32 2c 72 3d 72 2e 73 71 Data Ascii: 1];if(-1===o)return a.isEven()?_[1]:_[-1];if(a.sign)return _[0];if(!a.isSmall)throw Error("The exponent "+a.toString()+" is too large.");if(this.isSmall&&c(t=Math.pow(o,i)))return new E(R(t));for(r=this,n=_[1];!0&i&&(n=n.times(r),--i),0!==i;){;i/=2,r=r.sq
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 63 74 69 6f 6e 28 65 29 7b 69 66 28 65 3d 3d 3d 31 2f 30 29 72 65 74 75 72 6e 20 2d 31 3b 69 66 28 65 3d 3d 3d 2d 31 2f 30 29 72 65 74 75 72 6e 20 31 3b 76 61 72 20 74 3d 46 28 65 29 2c 72 3d 74 68 69 73 2e 76 61 6c 75 65 2c 6e 3d 74 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 73 69 67 6e 21 3d 3d 74 2e 73 69 67 6e 3f 74 2e 73 69 67 6e 3f 31 3a 2d 31 3a 74 2e 69 73 53 6d 61 6c 6c 3f 74 68 69 73 2e 73 69 67 6e 3f 2d 31 3a 31 3a 67 28 72 2c 6e 29 2a 28 74 68 69 73 2e 73 69 67 6e 3f 2d 31 3a 31 29 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6d 70 61 72 65 54 6f 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6d 70 61 72 65 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6d 70 61 72 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 65 3d 3d 3d 31 Data Ascii: ction(e){if(e===1/0)return -1;if(e===-1/0)return 1;var t=F(e),r=this.value,n=t.value;return this.sign!==t.sign?t.sign?1:-1:t.isSmall?this.sign?-1:1:g(r,n)*(this.sign?-1:1)},o.prototype.compareTo=o.prototype.compare,E.prototype.compare=function(e){if(e===1
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 73 3d 45 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 71 3d 45 2e 70 72 6f 74 6f 74 79 70 65 2e 67 72 65 61 74 65 72 4f 72 45 71 75 61 6c 73 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 71 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 67 72 65 61 74 65 72 4f 72 45 71 75 61 6c 73 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 73 73 65 72 4f 72 45 71 75 61 6c 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 30 3e 3d 74 68 69 73 2e 63 6f 6d 70 61 72 65 28 65 29 7d 2c 69 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 71 3d 69 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 73 73 65 72 4f 72 45 71 75 61 6c 73 3d 45 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 71 3d 45 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 73 73 65 72 4f 72 45 71 75 61 6c 73 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 6c Data Ascii: s=E.prototype.geq=E.prototype.greaterOrEquals=o.prototype.geq=o.prototype.greaterOrEquals,o.prototype.lesserOrEquals=function(e){return 0>=this.compare(e)},i.prototype.leq=i.prototype.lesserOrEquals=E.prototype.leq=E.prototype.lesserOrEquals=o.prototype.l

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.9	49798	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:18 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:19 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 2df5d45d-601e-003e-40f7-213248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071619Z-r1755647c66j878m0wkraqty3800000007wg000000003c05 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:19 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.9	49806	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:19 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:19 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:19 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: aaa69ab3-801e-0047-5050-237265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071619Z-17fbfdc98bbg2mc9qrpn009kgs0000000710000000004mzy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:19 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.9	49805	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:19 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:19 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:19 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 47efb004-101e-0017-69d3-2047c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071619Z-r1755647c66tmf6g4720xfpwpn0000000a6g000000003456 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:19 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.9	49809	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:19 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:19 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:19 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 46032cb8-c01e-007a-5b59-23b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071619Z-17fbfdc98bbvcvlzx1n0fduhm0000000073g0000000021h3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:19 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.9	49808	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:19 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:19 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:19 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 5a8d2ac8-001e-0034-336b-23dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071619Z-17fbfdc98bb9dlh7es9mrdw2qc00000006s00000000055ap x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:19 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.9	49811	162.159.136.232	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:20 UTC	684	OUT	GET /assets/webMinimal.183cbc8427e6b143ce21.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:20 UTC	963	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:20 GMT Content-Type: text/javascript Content-Length: 14624305 Connection: close CF-Ray: 8d782e49ec1d4868-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "216cb783d60a3e7c57c9d9ffea99dc3f" Last-Modified: Thu, 24 Oct 2024 03:15:20 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EnPlPvEu7umhdzg5wUNzYa6YW%2FX6uGv92pkf2fDhWKbqdJsb9kaSvZOK3HwD4plAaKG96dD%2BCyttIkcdZ2BfIqBf9K8pe2qV9ZQ5GxEdEVXTJPzkkm43Ia4JtnTa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:20 UTC	406	IN	Data Raw: 28 28 29 3d 3e 7b 76 61 72 20 65 3d 7b 33 38 35 30 30 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 7b 22 2e 2f 64 65 2e 6a 73 6f 6e 61 22 3a 5b 22 36 34 34 37 35 33 22 2c 22 33 30 32 34 34 22 5d 2c 22 2e 2f 7a 68 2d 43 4e 2e 6a 73 6f 6e 61 22 3a 5b 22 34 39 34 30 36 32 22 2c 22 35 36 34 34 36 22 5d 2c 22 2e 2f 64 61 2e 6a 73 6f 6e 61 22 3a 5b 22 34 34 38 36 37 22 2c 22 35 37 33 38 37 22 5d 2c 22 2e 2f 65 6c 2e 6a 73 6f 6e 61 22 3a 5b 22 35 38 31 31 34 34 22 2c 22 35 35 36 30 31 22 5d 2c 22 2e 2f 74 72 2e 6a 73 6f 6e 61 22 3a 5b 22 31 34 36 38 37 38 22 2c 22 38 34 33 38 35 22 5d 2c 22 2e 2f 65 73 2d 45 53 2e 6a 73 6f 6e 61 22 3a 5b 22 38 37 32 35 35 30 22 2c 22 34 35 37 34 37 22 5d 2c 22 2e 2f 68 72 2e 6a 73 6f 6e 61 22 3a 5b 22 Data Ascii: (()=>{var e={385007:function(e,t,n){var r={"./de.jsona":["644753","30244"],"./zh-CN.jsona":["494062","56446"],"./da.jsona":["44867","57387"],"./el.jsona":["581144","55601"],"./tr.jsona":["146878","84385"],"./es-ES.jsona":["872550","45747"],"./hr.jsona":["
2024-10-24 07:16:20 UTC	1369	IN	Data Raw: 2d 42 52 2e 6a 73 6f 6e 61 22 3a 5b 22 32 34 36 32 39 37 22 2c 22 33 39 34 22 5d 2c 22 2e 2f 72 6f 2e 6a 73 6f 6e 61 22 3a 5b 22 33 37 31 39 30 22 2c 22 35 33 32 36 39 22 5d 2c 22 2e 2f 73 76 2d 53 45 2e 6a 73 6f 6e 61 22 3a 5b 22 33 33 35 34 31 37 22 2c 22 31 31 31 39 33 22 5d 2c 22 2e 2f 72 75 2e 6a 73 6f 6e 61 22 3a 5b 22 38 30 39 34 36 34 22 2c 22 31 32 36 31 31 22 5d 2c 22 2e 2f 76 69 2e 6a 73 6f 6e 61 22 3a 5b 22 31 33 39 31 30 37 22 2c 22 34 35 35 37 36 22 5d 2c 22 2e 2f 69 64 2e 6a 73 6f 6e 61 22 3a 5b 22 34 39 32 32 34 38 22 2c 22 37 37 38 30 30 22 5d 2c 22 2e 2f 69 74 2e 6a 73 6f 6e 61 22 3a 5b 22 35 31 35 36 33 30 22 2c 22 37 38 36 37 30 22 5d 2c 22 2e 2f 75 6b 2e 6a 73 6f 6e 61 22 3a 5b 22 31 36 37 31 31 31 22 2c 22 35 38 35 34 38 22 5d 2c 22 Data Ascii: -BR.jsona":["246297","394"],"./ro.jsona":["37190","53269"],"./sv-SE.jsona":["335417","11193"],"./ru.jsona":["809464","12611"],"./vi.jsona":["139107","45576"],"./id.jsona":["492248","77800"],"./it.jsona":["515630","78670"],"./uk.jsona":["167111","58548"],"
2024-10-24 07:16:20 UTC	1263	IN	Data Raw: 72 5f 32 35 30 30 78 31 30 30 30 2e 70 6e 67 22 3a 22 39 32 38 34 30 30 22 2c 22 2e 2f 73 74 69 63 6b 65 72 73 2d 6c 61 75 6e 63 68 2f 32 30 32 30 5f 50 4d 4d 5f 53 54 49 43 4b 45 52 53 5f 4d 72 6b 74 5f 44 65 73 6b 74 6f 70 48 65 72 6f 5f 4c 65 66 74 5f 31 38 30 78 32 32 30 2e 70 6e 67 22 3a 22 31 34 38 38 32 31 22 2c 22 2e 2f 73 74 69 63 6b 65 72 73 2d 6c 61 75 6e 63 68 2f 32 30 32 30 5f 50 4d 4d 5f 53 54 49 43 4b 45 52 53 5f 4d 72 6b 74 5f 44 65 73 6b 74 6f 70 48 65 72 6f 5f 52 69 67 68 74 5f 31 38 30 78 32 32 30 2e 70 6e 67 22 3a 22 39 38 32 35 36 33 22 2c 22 2e 2f 73 74 69 63 6b 65 72 73 2d 6c 61 75 6e 63 68 2f 32 30 32 30 5f 50 4d 4d 5f 53 54 49 43 4b 45 52 53 5f 4d 72 6b 74 5f 44 65 73 6b 74 6f 70 5f 43 68 61 6e 67 65 6c 6f 67 5f 36 35 38 58 32 32 Data Ascii: r_2500x1000.png":"928400","./stickers-launch/2020_PMM_STICKERS_Mrkt_DesktopHero_Left_180x220.png":"148821","./stickers-launch/2020_PMM_STICKERS_Mrkt_DesktopHero_Right_180x220.png":"982563","./stickers-launch/2020_PMM_STICKERS_Mrkt_Desktop_Changelog_658X22
2024-10-24 07:16:20 UTC	1369	IN	Data Raw: 69 6f 6e 20 69 28 65 29 7b 72 65 74 75 72 6e 20 6e 28 61 28 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 29 7b 69 66 28 21 6e 2e 6f 28 72 2c 65 29 29 7b 76 61 72 20 74 3d 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 66 69 6e 64 20 6d 6f 64 75 6c 65 20 27 22 2b 65 2b 22 27 22 29 3b 74 68 72 6f 77 20 74 2e 63 6f 64 65 3d 22 4d 4f 44 55 4c 45 5f 4e 4f 54 5f 46 4f 55 4e 44 22 2c 74 7d 72 65 74 75 72 6e 20 72 5b 65 5d 7d 69 2e 6b 65 79 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 72 29 7d 2c 69 2e 72 65 73 6f 6c 76 65 3d 61 2c 65 2e 65 78 70 6f 72 74 73 3d 69 2c 69 2e 69 64 3d 22 31 34 38 36 36 30 22 7d 2c 35 37 37 33 39 31 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 7b 22 2e 2f 69 6d Data Ascii: ion i(e){return n(a(e))}function a(e){if(!n.o(r,e)){var t=Error("Cannot find module '"+e+"'");throw t.code="MODULE_NOT_FOUND",t}return r[e]}i.keys=function(){return Object.keys(r)},i.resolve=a,e.exports=i,i.id="148660"},577391:function(e,t,n){var r={"./im
2024-10-24 07:16:20 UTC	1369	IN	Data Raw: 22 2c 22 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 65 6d 6f 6a 69 2d 34 38 2e 70 6e 67 22 3a 22 33 33 32 39 33 36 22 2c 22 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 70 69 63 6b 65 72 2d 32 32 2e 70 6e 67 22 3a 22 38 39 39 35 36 35 22 7d 3b 66 75 6e 63 74 69 6f 6e 20 69 28 65 29 7b 72 65 74 75 72 6e 20 6e 28 61 28 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 29 7b 69 66 28 21 6e 2e 6f 28 72 2c 65 29 29 7b 76 61 72 20 74 3d 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 66 69 6e 64 20 6d 6f 64 75 6c 65 20 27 22 2b 65 2b 22 27 22 29 3b 74 68 72 6f 77 20 74 2e 63 6f 64 65 3d 22 4d 4f 44 55 4c 45 5f 4e 4f 54 5f 46 4f 55 4e 44 22 2c 74 7d 72 65 74 75 72 6e 20 72 5b 65 5d 7d 69 2e 6b 65 79 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 Data Ascii: ","./spritesheet-emoji-48.png":"332936","./spritesheet-picker-22.png":"899565"};function i(e){return n(a(e))}function a(e){if(!n.o(r,e)){var t=Error("Cannot find module '"+e+"'");throw t.code="MODULE_NOT_FOUND",t}return r[e]}i.keys=function(){return Objec
2024-10-24 07:16:20 UTC	1369	IN	Data Raw: 22 2c 22 2e 2f 68 61 6c 6c 6f 77 65 65 6e 5f 63 61 6c 6c 5f 63 61 6c 6c 69 6e 67 2e 6d 70 33 22 3a 22 32 39 37 38 39 38 22 2c 22 2e 2f 68 61 6c 6c 6f 77 65 65 6e 5f 63 61 6c 6c 5f 72 69 6e 67 69 6e 67 2e 6d 70 33 22 3a 22 36 31 32 33 36 33 22 2c 22 2e 2f 68 61 6c 6c 6f 77 65 65 6e 5f 64 65 61 66 65 6e 2e 6d 70 33 22 3a 22 35 37 38 31 34 22 2c 22 2e 2f 68 61 6c 6c 6f 77 65 65 6e 5f 64 65 66 65 61 6e 2e 6d 70 33 22 3a 22 38 31 39 30 39 38 22 2c 22 2e 2f 68 61 6c 6c 6f 77 65 65 6e 5f 64 69 73 63 6f 6e 6e 65 63 74 2e 6d 70 33 22 3a 22 33 38 32 34 37 32 22 2c 22 2e 2f 68 61 6c 6c 6f 77 65 65 6e 5f 6d 65 73 73 61 67 65 31 2e 6d 70 33 22 3a 22 37 37 32 36 33 37 22 2c 22 2e 2f 68 61 6c 6c 6f 77 65 65 6e 5f 6d 75 74 65 2e 6d 70 33 22 3a 22 35 33 39 37 31 36 22 2c Data Ascii: ","./halloween_call_calling.mp3":"297898","./halloween_call_ringing.mp3":"612363","./halloween_deafen.mp3":"57814","./halloween_defean.mp3":"819098","./halloween_disconnect.mp3":"382472","./halloween_message1.mp3":"772637","./halloween_mute.mp3":"539716",
2024-10-24 07:16:20 UTC	1369	IN	Data Raw: 6d 6f 76 65 64 2e 6d 70 33 22 3a 22 34 32 36 33 35 34 22 2c 22 2e 2f 76 69 62 69 6e 67 5f 77 75 6d 70 75 73 2e 6d 70 33 22 3a 22 37 37 38 31 38 34 22 7d 3b 66 75 6e 63 74 69 6f 6e 20 69 28 65 29 7b 72 65 74 75 72 6e 20 6e 28 61 28 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 29 7b 69 66 28 21 6e 2e 6f 28 72 2c 65 29 29 7b 76 61 72 20 74 3d 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 66 69 6e 64 20 6d 6f 64 75 6c 65 20 27 22 2b 65 2b 22 27 22 29 3b 74 68 72 6f 77 20 74 2e 63 6f 64 65 3d 22 4d 4f 44 55 4c 45 5f 4e 4f 54 5f 46 4f 55 4e 44 22 2c 74 7d 72 65 74 75 72 6e 20 72 5b 65 5d 7d 69 2e 6b 65 79 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 72 29 7d 2c 69 2e 72 65 73 6f 6c 76 65 3d 61 2c 65 2e 65 78 70 Data Ascii: moved.mp3":"426354","./vibing_wumpus.mp3":"778184"};function i(e){return n(a(e))}function a(e){if(!n.o(r,e)){var t=Error("Cannot find module '"+e+"'");throw t.code="MODULE_NOT_FOUND",t}return r[e]}i.keys=function(){return Object.keys(r)},i.resolve=a,e.exp
2024-10-24 07:16:20 UTC	1369	IN	Data Raw: 6d 28 6c 32 7c 75 6c 29 7c 65 72 28 69 63 7c 6b 30 29 7c 65 73 6c 38 7c 65 7a 28 5b 34 2d 37 5d 30 7c 6f 73 7c 77 61 7c 7a 65 29 7c 66 65 74 63 7c 66 6c 79 28 5c 2d 7c 5f 29 7c 67 31 20 75 7c 67 35 36 30 7c 67 65 6e 65 7c 67 66 5c 2d 35 7c 67 5c 2d 6d 6f 7c 67 6f 28 5c 2e 77 7c 6f 64 29 7c 67 72 28 61 64 7c 75 6e 29 7c 68 61 69 65 7c 68 63 69 74 7c 68 64 5c 2d 28 6d 7c 70 7c 74 29 7c 68 65 69 5c 2d 7c 68 69 28 70 74 7c 74 61 29 7c 68 70 28 20 69 7c 69 70 29 7c 68 73 5c 2d 63 7c 68 74 28 63 28 5c 2d 7c 20 7c 5f 7c 61 7c 67 7c 70 7c 73 7c 74 29 7c 74 70 29 7c 68 75 28 61 77 7c 74 63 29 7c 69 5c 2d 28 32 30 7c 67 6f 7c 6d 61 29 7c 69 32 33 30 7c 69 61 63 28 20 7c 5c 2d 7c 5c 2f 29 7c 69 62 72 6f 7c 69 64 65 61 7c 69 67 30 31 7c 69 6b 6f 6d 7c 69 6d 31 6b 7c Data Ascii: m(l2\|ul)\|er(ic\|k0)\|esl8\|ez([4-7]0\|os\|wa\|ze)\|fetc\|fly(\-\|_)\|g1 u\|g560\|gene\|gf\-5\|g\-mo\|go(\.w\|od)\|gr(ad\|un)\|haie\|hcit\|hd\-(m\|p\|t)\|hei\-\|hi(pt\|ta)\|hp( i\|ip)\|hs\-c\|ht(c(\-\| \|_\|a\|g\|p\|s\|t)\|tp)\|hu(aw\|tc)\|i\-(20\|go\|ma)\|i230\|iac( \|\-\|\/)\|ibro\|idea\|ig01\|ikom\|im1k\|
2024-10-24 07:16:20 UTC	1369	IN	Data Raw: 2c 6e 29 7b 76 61 72 20 72 3d 7b 22 2e 2f 67 67 2d 6d 6f 6e 6f 2f 67 67 6d 6f 6e 6f 2d 34 30 30 2d 6e 6f 72 6d 61 6c 2e 77 6f 66 66 32 22 3a 5b 22 33 34 39 33 37 34 22 5d 2c 22 2e 2f 61 62 63 2d 67 69 6e 74 6f 2d 6e 6f 72 64 2f 61 62 63 67 69 6e 74 6f 6e 6f 72 64 2d 38 30 30 2d 65 78 74 72 61 62 6f 6c 64 69 74 61 6c 69 63 2e 77 6f 66 66 32 22 3a 5b 22 38 35 38 38 35 35 22 5d 2c 22 2e 2f 6e 6f 74 6f 2d 73 61 6e 73 2f 6e 6f 74 6f 73 61 6e 73 2d 36 30 30 2d 73 65 6d 69 62 6f 6c 64 2e 77 6f 66 66 32 22 3a 5b 22 33 38 31 31 37 36 22 5d 2c 22 2e 2f 67 67 2d 73 61 6e 73 2f 67 67 73 61 6e 73 2d 37 30 30 2d 62 6f 6c 64 2e 77 6f 66 66 32 22 3a 5b 22 39 30 39 36 37 31 22 5d 2c 22 2e 2f 67 67 2d 73 61 6e 73 2f 67 67 73 61 6e 73 2d 35 30 30 2d 6d 65 64 69 75 6d 2e 77 Data Ascii: ,n){var r={"./gg-mono/ggmono-400-normal.woff2":["349374"],"./abc-ginto-nord/abcgintonord-800-extrabolditalic.woff2":["858855"],"./noto-sans/notosans-600-semibold.woff2":["381176"],"./gg-sans/ggsans-700-bold.woff2":["909671"],"./gg-sans/ggsans-500-medium.w
2024-10-24 07:16:20 UTC	1369	IN	Data Raw: 69 63 2e 77 6f 66 66 32 22 3a 5b 22 36 36 37 35 22 5d 2c 22 2e 2f 66 72 61 75 6e 63 65 73 2f 66 72 61 75 6e 63 65 73 2d 76 66 2e 77 6f 66 66 32 22 3a 5b 22 38 39 34 37 35 37 22 5d 2c 22 2e 2f 6e 6f 74 6f 2d 73 61 6e 73 2f 6e 6f 74 6f 73 61 6e 73 2d 34 30 30 2d 6e 6f 72 6d 61 6c 69 74 61 6c 69 63 2e 77 6f 66 66 32 22 3a 5b 22 31 30 31 31 30 33 22 5d 2c 22 2e 2f 67 67 2d 6d 6f 6e 6f 2f 67 67 6d 6f 6e 6f 2d 37 30 30 2d 62 6f 6c 64 2e 77 6f 66 66 32 22 3a 5b 22 37 35 37 38 38 33 22 5d 2c 22 2e 2f 63 6f 72 69 6e 74 68 69 61 2f 63 6f 72 69 6e 74 68 69 61 2d 34 30 30 2d 6e 6f 72 6d 61 6c 2e 77 6f 66 66 32 22 3a 5b 22 36 32 32 38 31 34 22 5d 2c 22 2e 2f 67 67 2d 73 61 6e 73 2f 67 67 73 61 6e 73 2d 36 30 30 2d 73 65 6d 69 62 6f 6c 64 2e 77 6f 66 66 32 22 3a 5b 22 Data Ascii: ic.woff2":["6675"],"./fraunces/fraunces-vf.woff2":["894757"],"./noto-sans/notosans-400-normalitalic.woff2":["101103"],"./gg-mono/ggmono-700-bold.woff2":["757883"],"./corinthia/corinthia-400-normal.woff2":["622814"],"./gg-sans/ggsans-600-semibold.woff2":["

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.9	49810	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:20 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:20 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:20 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 514e14b5-c01e-0014-51c9-20a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071620Z-r1755647c66cdf7jx43n17haqc0000000a6g0000000034bp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:20 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.9	49814	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:20 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:20 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:20 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 1f9beeb1-d01e-0014-170b-22ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071620Z-r1755647c66m4jttnz6nb8kzng00000007zg0000000015ga x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:20 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.9	49813	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:20 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:20 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:20 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 55d9b643-201e-003f-330b-226d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071620Z-r1755647c66xrxq4nv7upygh4s0000000300000000000r03 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:20 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.9	49812	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:20 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-24 07:16:21 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=34126 Date: Thu, 24 Oct 2024 07:16:20 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.9	49816	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:20 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:21 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:20 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 44b73ccb-201e-0096-2a5d-23ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071620Z-17fbfdc98bbn5xh71qanksxprn000000070g000000004dhr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:21 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.9	49815	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:20 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:21 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:20 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: b7bcbf2c-f01e-0071-0ae2-20431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071620Z-r1755647c66s2pfjx11r8ys39000000000kg000000006859 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:21 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.9	49817	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:21 UTC	883	OUT	GET /assets/591980d24607547de30a.css HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:21 UTC	955	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:21 GMT Content-Type: text/css Content-Length: 41018 Connection: close CF-Ray: 8d782e502bc38d26-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "fbec530f567cb32c81348642102c8348" Last-Modified: Fri, 11 Oct 2024 19:21:44 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oBnnYJPo7WaUGzZbNh%2B7LuTTqbWsXBoGwJzbyh%2BTcteREwRs2ReLXVq2fHxGuJ1ZhFqf88kiOsgn3B%2BS020GoFRCJULeueVNP3vk88ER9erOjhaA7oXekQGLrQO4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:21 UTC	414	IN	Data Raw: 2e 64 69 73 63 6f 72 64 4c 6f 67 6f 5f 62 38 33 61 30 35 7b 68 65 69 67 68 74 3a 33 36 70 78 3b 77 69 64 74 68 3a 31 31 32 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 61 73 73 65 74 73 2f 32 33 61 37 61 33 66 64 36 36 32 34 33 34 32 31 31 37 62 66 2e 73 76 67 29 6e 6f 2d 72 65 70 65 61 74 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 66 6c 65 78 2d 73 68 72 69 6e 6b 3a 30 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 36 70 78 7d 2e 61 75 74 68 42 6f 78 5f 62 38 33 61 30 35 7b 77 69 64 74 68 3a 34 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 63 75 73 74 6f 6d 2d 61 75 74 68 2d 62 6f 78 2d 61 75 74 68 2d 62 6f 78 2d 70 61 64 64 69 6e 67 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 38 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 76 61 72 28 2d Data Ascii: .discordLogo_b83a05{height:36px;width:112px;background:url(/assets/23a7a3fd6624342117bf.svg)no-repeat;display:none;flex-shrink:0;margin-bottom:16px}.authBox_b83a05{width:480px;padding:var(--custom-auth-box-auth-box-padding);font-size:18px;box-shadow:var(-
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 74 2d 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 2e 61 75 74 68 42 6f 78 45 78 70 61 6e 64 65 64 5f 62 38 33 61 30 35 7b 77 69 64 74 68 3a 37 38 34 70 78 7d 2e 63 65 6e 74 65 72 69 6e 67 57 72 61 70 70 65 72 5f 62 38 33 61 30 35 7b 77 69 64 74 68 3a 31 30 30 25 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 61 76 61 74 61 72 5f 62 38 33 61 30 35 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 32 34 70 78 7d 40 6d 65 64 69 61 28 6d 61 78 2d 77 69 64 74 68 3a 34 38 35 70 78 29 7b 2e 61 75 74 68 42 6f 78 5f 62 38 33 61 30 35 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 72 69 67 68 74 3a 30 3b 62 6f 74 74 6f Data Ascii: t-text-decoration:underline;text-decoration:underline}.authBoxExpanded_b83a05{width:784px}.centeringWrapper_b83a05{width:100%;text-align:center}.avatar_b83a05{margin-bottom:24px}@media(max-width:485px){.authBox_b83a05{position:absolute;top:0;right:0;botto
2024-10-24 07:16:21 UTC	1268	IN	Data Raw: 74 73 2f 31 37 61 39 31 65 39 62 34 65 37 65 62 33 39 32 31 65 64 35 2e 73 76 67 29 6e 6f 2d 72 65 70 65 61 74 3b 77 69 64 74 68 3a 31 33 30 70 78 7d 2e 61 75 74 68 42 6f 78 5f 62 38 33 61 30 35 5b 64 61 74 61 2d 74 68 65 6d 65 3d 64 61 72 6b 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 6d 6f 62 69 6c 65 2d 70 72 69 6d 61 72 79 29 7d 2e 61 75 74 68 42 6f 78 5f 62 38 33 61 30 35 5b 64 61 74 61 2d 74 68 65 6d 65 3d 64 61 72 6b 5d 20 2e 64 69 73 63 6f 72 64 4c 6f 67 6f 5f 62 38 33 61 30 35 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 61 73 73 65 74 73 2f 32 33 61 37 61 33 66 64 36 36 32 34 33 34 32 31 31 37 62 66 2e 73 76 67 29 6e 6f 2d 72 65 70 65 61 74 3b 77 69 64 74 68 3a 31 33 30 70 78 7d 2e 74 69 74 6c Data Ascii: ts/17a91e9b4e7eb3921ed5.svg)no-repeat;width:130px}.authBox_b83a05[data-theme=dark]{background:var(--background-mobile-primary)}.authBox_b83a05[data-theme=dark] .discordLogo_b83a05{background:url(/assets/23a7a3fd6624342117bf.svg)no-repeat;width:130px}.titl
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 7d 2e 62 6c 6f 63 6b 5f 62 38 33 61 30 35 7b 77 69 64 74 68 3a 31 30 30 25 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 62 75 74 74 6f 6e 5f 62 38 33 61 30 35 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 34 70 78 7d 2e 6c 69 6e 6b 42 75 74 74 6f 6e 5f 62 38 33 61 30 35 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 2e 69 6e 76 69 74 65 49 63 6f 6e 5f 62 38 33 61 30 35 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 69 Data Ascii: pointer-events:none}.block_b83a05{width:100%;text-align:left}.button_b83a05{font-size:16px;line-height:24px}.linkButton_b83a05{display:block;padding-left:0;padding-right:0}.inviteIcon_b83a05{display:inline-flex;align-items:center;justify-content:center}.i
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 74 74 6f 6d 3a 31 30 70 78 7d 2e 70 68 6f 6e 65 46 69 65 6c 64 50 6f 70 6f 75 74 5f 66 66 37 36 31 62 20 2e 63 6f 75 6e 74 72 79 49 74 65 6d 5f 66 66 37 36 31 62 7b 77 69 64 74 68 3a 31 30 30 25 7d 2e 70 68 6f 6e 65 46 69 65 6c 64 50 6f 70 6f 75 74 5f 66 66 37 36 31 62 20 2e 63 6f 75 6e 74 72 79 4e 61 6d 65 5f 66 66 37 36 31 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 38 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 38 70 78 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 65 6c 6c 69 70 73 69 73 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 74 65 78 74 2d 6d 75 74 65 64 2d 6f 6e 2d 64 65 66 61 75 6c 74 29 7d 2e 70 Data Ascii: ttom:10px}.phoneFieldPopout_ff761b .countryItem_ff761b{width:100%}.phoneFieldPopout_ff761b .countryName_ff761b{font-size:13px;line-height:18px;margin-right:8px;white-space:nowrap;text-overflow:ellipsis;overflow:hidden;color:var(--text-muted-on-default)}.p
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 38 70 78 7d 2e 73 70 61 63 65 64 42 75 74 74 6f 6e 5f 61 34 64 39 62 64 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 34 70 78 7d 2e 65 6c 65 76 61 74 65 64 5f 63 38 35 63 64 63 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 32 70 78 20 31 30 70 78 20 30 20 68 73 6c 28 76 61 72 28 2d 2d 70 72 69 6d 61 72 79 2d 39 30 30 2d 68 73 6c 29 2f 2e 32 29 2c 30 20 30 20 30 20 31 70 78 20 76 61 72 28 2d 2d 70 72 69 6d 61 72 79 2d 37 30 30 29 7d 2e 62 75 74 74 6f 6e 5f 63 38 35 63 64 63 7b 6d 61 72 67 69 6e 3a 31 32 70 78 20 61 75 74 6f 20 32 30 70 78 3b 77 69 64 74 68 3a 38 35 25 7d 2e 62 75 74 74 6f 6e 54 69 74 6c 65 5f 63 38 35 63 64 63 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 6d 61 72 67 69 6e 3a 32 30 70 78 20 32 30 70 78 Data Ascii: rgin-bottom:8px}.spacedButton_a4d9bd{margin-top:24px}.elevated_c85cdc{box-shadow:0 2px 10px 0 hsl(var(--primary-900-hsl)/.2),0 0 0 1px var(--primary-700)}.button_c85cdc{margin:12px auto 20px;width:85%}.buttonTitle_c85cdc{text-align:center;margin:20px 20px
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 35 32 38 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 7d 2e 67 75 69 6c 64 43 6f 6e 74 61 69 6e 65 72 5f 65 37 33 35 32 38 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 61 70 70 49 6e 5f 65 37 33 35 32 38 7b 6d 61 72 67 69 6e 3a 34 70 78 20 30 7d 2e 61 70 70 47 75 69 6c 64 4e 61 6d 65 5f 65 37 33 35 32 38 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 68 65 61 64 65 72 2d 70 72 69 6d 61 72 79 29 7d 2e 69 6e 76 69 74 65 4a 6f 69 6e 43 6f 6e 74 61 69 6e 65 72 5f 65 37 33 35 32 38 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 Data Ascii: 528{margin-top:8px}.guildContainer_e73528{display:flex;align-items:center;justify-content:center}.appIn_e73528{margin:4px 0}.appGuildName_e73528{color:var(--header-primary)}.inviteJoinContainer_e73528{display:flex;align-items:center;justify-content:center
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 7d 2e 63 6f 6e 74 61 69 6e 65 72 5f 61 34 65 63 36 32 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 2e 65 76 65 6e 74 4e 61 6d 65 5f 61 34 65 63 36 32 7b 6d 61 78 2d 77 69 64 74 68 3a 35 33 34 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 65 6c 6c 69 70 73 69 73 7d 2e 65 76 65 6e 74 4e 61 6d 65 5f 61 34 65 63 36 32 3a 68 6f 76 65 72 7b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 2e 64 65 73 63 72 69 70 74 69 6f 6e 5f 61 34 65 63 36 32 7b 6d 61 72 67 69 Data Ascii: }.container_a4ec62{display:flex;flex-direction:column}.eventName_a4ec62{max-width:534px;overflow:hidden;white-space:nowrap;text-overflow:ellipsis}.eventName_a4ec62:hover{-webkit-text-decoration:underline;text-decoration:underline}.description_a4ec62{margi
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 2e 68 65 61 64 65 72 5f 61 37 31 61 31 63 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 32 70 78 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 65 6c 6c 69 70 73 69 73 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 69 6e 74 65 72 61 63 74 69 76 65 2d 6e 6f 72 6d 61 6c 29 7d 2e 63 6f 6e 74 65 6e 74 5f 61 37 31 61 31 63 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 66 6c 6f 77 3a 72 6f 77 20 77 72 61 70 3b 67 61 70 3a 31 36 70 78 7d 2e 67 75 69 6c Data Ascii: sizing:border-box;display:flex;flex-direction:column}.header_a71a1c{font-weight:700;margin-bottom:12px;white-space:nowrap;text-overflow:ellipsis;overflow:hidden;color:var(--interactive-normal)}.content_a71a1c{display:flex;flex-flow:row wrap;gap:16px}.guil
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 6d 61 6c 29 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 65 6c 6c 69 70 73 69 73 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 63 6f 75 6e 74 5f 61 37 31 61 31 63 3a 6c 61 73 74 2d 63 68 69 6c 64 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 7d 2e 67 75 69 6c 64 4e 61 6d 65 57 72 61 70 70 65 72 5f 61 37 31 61 31 63 7b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 3a 30 20 31 20 61 75 74 6f 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 2e 67 75 69 6c 64 4e 61 6d 65 5f 61 37 31 61 31 63 7b 66 6c 65 78 3a 31 20 31 20 61 75 74 6f 3b 6d 69 6e 2d 77 69 64 74 68 3a 30 3b 6f 76 65 72 66 6c Data Ascii: mal);white-space:nowrap;text-overflow:ellipsis;overflow:hidden}.count_a71a1c:last-child{margin-right:0}.guildNameWrapper_a71a1c{align-items:center;display:flex;flex:0 1 auto;overflow:hidden;max-width:100%}.guildName_a71a1c{flex:1 1 auto;min-width:0;overfl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.9	49821	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:21 UTC	883	OUT	GET /assets/2917679ca8a08c390036.css HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:21 UTC	959	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:21 GMT Content-Type: text/css Content-Length: 957 Connection: close CF-Ray: 8d782e52d9c23464-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "20ddaa519e404695d0657d3868d2701f" Last-Modified: Tue, 25 Jun 2024 20:41:32 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dnS0yTJ%2FdGmypYEZlh96lNjTxKNWSWDn7mKEDfLc6%2F%2By9LD98o9LCLGseDww6Zs6BgZ2sDnfhBuVIs%2Fd8vSUQIqxjgQLbL%2FQdogCLtmxgrnfiaUsfuDP9LY5IOs%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:21 UTC	410	IN	Data Raw: 2e 77 72 61 70 70 65 72 5f 63 64 32 32 65 37 2c 2e 61 63 74 69 76 65 57 72 61 70 70 65 72 5f 63 64 32 32 65 37 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 6c 65 66 74 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 7a 2d 69 6e 64 65 78 3a 31 30 30 32 7d 2e 77 72 61 70 70 65 72 5f 63 64 32 32 65 37 7b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 7d 2e 76 69 64 65 6f 57 72 61 70 70 65 72 5f 63 64 32 32 65 37 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 2d 35 30 25 29 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 7a 2d 69 6e 64 65 78 3a 32 30 30 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a Data Ascii: .wrapper_cd22e7,.activeWrapper_cd22e7{height:100%;left:0;position:absolute;top:0;width:100%;z-index:1002}.wrapper_cd22e7{pointer-events:none}.videoWrapper_cd22e7{position:absolute;transform:translate(-50%,-50%);top:50%;left:50%;z-index:200;pointer-events:
2024-10-24 07:16:21 UTC	547	IN	Data Raw: 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 3b 7a 2d 69 6e 64 65 78 3a 32 30 30 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 7d 2e 67 61 64 69 65 6e 74 48 69 67 68 6c 69 67 68 74 5f 63 64 32 32 65 37 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 39 30 64 65 67 2c 76 61 72 28 2d 2d 70 72 65 6d 69 75 6d 2d 74 69 65 72 2d 32 2d 70 75 72 70 6c 65 2d 66 6f 72 2d 67 72 61 64 69 65 6e 74 73 29 30 25 2c 76 61 72 28 2d 2d 70 72 65 6d 69 75 6d 2d 74 69 Data Ascii: ;pointer-events:none;z-index:200;top:0;left:0;width:100%;height:100%}.gadientHighlight_cd22e7{position:absolute;width:100%;height:100%;pointer-events:none;background-image:linear-gradient(90deg,var(--premium-tier-2-purple-for-gradients)0%,var(--premium-ti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.9	49825	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:21 UTC	909	OUT	GET /assets/8234e0a75aa9afb205bd.woff2 HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://discord.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:21 UTC	963	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:21 GMT Content-Type: font/woff2 Content-Length: 43364 Connection: close CF-Ray: 8d782e52ea28464d-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "281bba49537cf936d1a0df10fb719f63" Last-Modified: Wed, 05 Jun 2024 19:27:59 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dr0QKM3glA%2BGbZ4lM2F3Mb5RTo0rXMI%2FNqmoBzD9NVMiVvt977Gov38s1HH0C%2FbvwKBi%2B6Hke%2FzACxCNlq1YDC%2FW9xUnQtboDu5ay8l9ZtSijKw14gVB8UH68q3n"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:21 UTC	406	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 a9 64 00 11 00 00 00 01 97 38 00 00 a9 00 00 03 00 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 82 78 1b 81 aa 40 1c a1 5c 06 60 00 8e 58 08 82 3e 09 9f 03 11 0c 0a 83 b6 0c 82 f9 22 01 36 02 24 03 9a 0c 0b 8d 08 00 04 20 05 95 05 07 b5 4b 0c 83 0e 5b 1e 71 91 02 aa 63 ed 9f 01 10 35 aa 6e 43 00 a8 fc 55 97 9b e7 1d 3f c1 94 ab 71 1c 7a 6e 1d 3c a9 96 2d ea 01 dc 61 a3 9c 43 cd b3 ad 4a 3b ec c5 38 fb ff ff ff ff 73 93 85 1c d6 ce d2 99 4d 12 40 35 a1 75 ff 46 97 94 11 14 29 17 27 a2 4e f3 02 39 7b 55 92 27 09 e7 75 81 0d f6 7c d8 3b 57 ae f3 99 9d f2 91 1f 67 7a 3b 6d 0e 6f 92 bc 26 41 82 b7 bb f7 be 6f da 2e 8b 93 9b ea bc c6 bb b0 94 56 6d 2f 90 f6 04 01 61 9a 56 4e 46 8b fb ac f0 b5 b4 ba fc 54 2f 24 Data Ascii: wOF2d8x@\`X>"6$ K[qc5nCU?qzn<-aCJ;8sM@5uF)'N9{U'u\|;Wgz;mo&Ao.Vm/aVNFT/$
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 15 81 3c 0e 08 97 f0 0c 4a 3f b2 39 42 1e 26 c8 b5 66 fb 64 cb 29 07 54 b2 d9 0e 53 ba 80 20 6e 03 2a f6 e3 67 37 4e f7 e2 d1 92 77 19 3d 8e d7 06 7c ed 21 e6 a3 cd 0f af b9 bc 62 f7 ee 73 da ed 0f 9f f1 e6 17 08 7f 71 49 3c 46 3a c6 db dd 70 93 b5 17 79 0b 0c e5 32 07 68 a2 2b 31 4c a5 2c b1 6d 47 5c cf 17 34 aa 45 25 2b 72 aa 97 0e 81 f1 b5 d8 1e a2 b9 dd fd 6f 23 37 46 86 d4 48 a1 2d 2a c6 68 a1 0d 52 1b 98 45 58 64 48 59 b3 00 a1 0d c0 d1 0a 28 06 b4 01 08 2d 4a b6 c5 d8 00 4d 67 88 b5 25 6d e3 8d 35 49 d3 a6 8d 88 de 5d 72 51 6f d2 24 4d c5 d1 2a 6d 11 f5 6d e0 1b c1 64 4c 90 6d cc 90 6e ce 7e 03 e6 ec 99 02 63 6c 54 d0 6d f6 9e 3d 8b 28 0b 88 33 8b 2a b8 c8 ae d9 43 7a 81 8f 70 04 03 2e b9 00 b8 d4 95 bb 6b 81 e9 89 e2 64 46 3f 8a 14 2e 09 f4 80 e0 Data Ascii: <J?9B&fd)TS ng7Nw=\|!bsqI<F:py2h+1L,mG\4E%+ro#7FH-hREXdHY(-JMg%m5I]rQo$MmmdLmn~clTm=(3Czp.kdF?.
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: d0 b9 63 7d 4f 7a fa df 93 dc df 6f ad 51 cf a8 51 15 15 11 15 55 a3 af e6 7e fc 4e ec ff a5 6f e9 fb db d2 b7 ec 75 55 45 44 8c 71 8c 63 8c 88 ab 2e a4 4b a9 8c 04 d7 7d 25 1e 17 8b 09 c6 2c 81 7f b5 96 fa 19 69 bc 37 e0 62 4a e9 2c b0 e5 22 bf 5b 09 6e 19 3f 4e fa cc ba e4 a7 9f b3 42 02 9a 64 d7 6b 29 d5 2c 0a 28 6d 80 61 5a 61 1e e5 f7 ac cc 59 d5 0e a0 0e 48 01 36 90 20 c8 bf 7b ed 8c 15 e7 c1 00 e8 67 f4 70 7b 34 01 70 18 87 ff 97 b1 e8 c1 70 0c c4 4b 30 48 a8 18 90 38 a3 20 e3 89 04 23 46 14 8c 16 49 30 3a 4c c1 98 ea 09 26 d4 60 48 fe fa 1b 0c 33 05 ca 3b 74 50 83 45 42 3d b1 f6 50 03 d6 11 34 68 53 83 5e 5e 77 d0 b0 0d 06 0d df 9c a0 d1 8b 0f 9a b8 c4 a0 19 cb 08 9a bd db 41 ef ee 41 d0 47 7b 14 f4 c9 9e 04 cd 5f 7e d0 a2 15 07 2d db f3 a0 e5 a3 Data Ascii: c}OzoQQU~NouUEDqc.K}%,i7bJ,"[n?NBdk),(maZaYH6 {gp{4ppK0H8 #FI0:L&`H3;tPEB=P4hS^^wAAG{_~-
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 0b a0 80 d5 6a 5a 67 dc 88 a2 a9 90 57 6d 98 e4 27 b0 7a df c2 2b ef d6 50 60 35 95 ab c7 fb 4c e9 13 fe b9 9a 9b 8f 2b 99 7c d7 f2 2e 75 42 1d 20 4b 96 2a bd 65 0d d4 a4 d1 08 cc e9 d9 eb c4 6b 3a 74 96 66 47 4b bc f5 44 88 d2 be d5 81 bf d5 97 d8 57 4c de a4 af c8 2d da f2 19 ca d9 7d 34 f2 4f 83 ee bc 9b 3e c5 82 e3 c4 12 58 3a 2b 80 3d e8 72 a2 7c 1e 7d 83 cd 2e 48 b6 67 b3 3b 9e 16 fa b6 41 67 54 27 dd 78 f3 41 ed fc 13 cf d9 77 f7 20 b1 b0 bb 6f 00 da f8 2e ec 12 e4 86 cf 8e 8d 27 d4 ca e4 85 f3 0d dc 9d dd 03 05 c2 a2 ca 03 a5 87 0b b1 ce 9d ab 01 6c d4 c6 17 db 7c bf 53 65 ce 51 3b 37 22 08 64 b8 3f eb 98 c9 26 fa f7 76 77 ec 8d 25 cf 59 e6 a6 02 8c 99 7b a6 d6 79 72 a3 99 13 ca c7 c3 85 1c bb db b3 de 8e 45 5e 70 1c b4 03 b8 bc 93 7d 37 be 19 64 Data Ascii: jZgWm'z+P`5L+\|.uB K*ek:tfGKDWL-}4O>X:+=r\|}.Hg;AgT'xAw o.'l\|SeQ;7"d?&vw%Y{yrE^p}7d
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 1b 63 ac 71 c6 9b 68 c6 f7 9a 3a dd bc e7 7d 69 3e 40 87 95 fc 6f 33 75 9a 7e e6 f3 db 15 56 fa 4a fa 3d a9 ce 7a 1b 7c ed 1b 1b a3 d3 f4 7b 3f a4 23 46 7b fc ec 17 bf da 3b 1e 73 3c fa ba 4f b3 ba 07 84 cb c2 99 bd 56 62 a9 2f ad b6 c6 77 ef 4e 3f fa c9 c9 ed c3 19 74 f8 5e 26 a4 69 68 6a 69 eb e8 ea e9 1b a0 54 1a 9d c1 64 b1 31 43 dc 2a c1 e1 f2 8a 3f 08 e1 c6 54 9a 89 a9 99 b9 85 a5 95 35 9d c1 64 d9 d8 da d9 bb 72 60 3b 72 8a 7f 63 ec b4 49 13 c0 6a b3 5b 41 b4 eb aa e0 74 a0 02 75 b0 c2 a2 d3 95 a5 b3 db ac 1d b1 c5 e4 2c 2b 4b de ca d2 cb af 30 dc a1 4a 54 85 aa 01 90 86 5c 78 76 d8 ba 42 31 46 b1 1b 82 6a 80 7e 54 2f 1d ed eb d6 be be 5b 7a 4f c7 7b 59 37 f4 d4 a0 89 97 d1 fc cf 67 49 62 97 dd 0f 03 e0 8c 4c 00 c4 a4 32 fd 48 b7 a5 ef 52 62 97 1e Data Ascii: cqh:}i>@o3u~VJ=z\|{?#F{;s<OVb/wN?t^&ihjiTd1C*?T5dr`;rcIj[Atu,+K0JT\xvB1Fj~T/[zO{Y7gIbL2HRb
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 7e eb 8b 16 ca c1 6e 59 42 44 b6 4e 26 94 86 1a 13 93 22 01 fd a8 a4 b6 e9 28 58 ae bd 8c e1 84 e4 0d 29 97 83 28 04 ec 69 8e eb ef e4 06 53 22 8c 79 3e fc c1 4b 57 66 b8 cc c9 1a 2b 33 3e d4 66 70 3e ce a0 50 fa 29 c8 88 0c 44 10 05 22 91 84 c8 b2 28 70 19 79 a8 20 26 52 51 01 4d 64 e3 a7 a5 70 07 18 42 2e 93 16 c3 b1 e4 e4 bd e7 4e 4a b4 54 c0 34 32 53 8b 27 f9 3a b7 e1 6f f7 fa e1 8f 6a a5 61 d5 c0 e2 12 d3 41 d4 60 0b e3 f2 be 01 b3 6a e1 b5 63 44 de bf da a5 0d 80 cc e0 b7 87 d6 ba 4e 3d eb dd 2c bd 97 c5 cc 0d 75 11 04 51 d0 36 b2 57 01 5c 24 b0 82 39 a8 42 db 92 c6 08 92 64 d9 8e 0c e0 73 24 b3 82 f6 3b c8 e7 ee 0a 34 43 4d 1f 0e 96 41 b6 03 16 c6 c1 38 86 60 07 51 a5 b3 8f 7a f4 c3 a9 eb 7f 5e bb c2 d1 cd 9d 53 ec 96 cd 75 46 09 5b d1 35 76 4b 0b Data Ascii: ~nYBDN&"(X)(iS"y>KWf+3>fp>P)D"(py &RQMdpB.NJT42S':ojaA`jcDN=,uQ6W\$9Bds$;4CMA8`Qz^SuF[5vK
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 4a 9e a6 eb 8f a2 85 bb fd e6 7f 3f 5c d0 06 5d c0 00 9b 28 66 5c d2 46 f4 9c 42 5b 95 86 0b 03 01 30 50 52 90 12 98 51 c1 a8 01 0d 30 d2 6b 3c 54 46 46 53 93 a2 9a 60 60 b3 5c e2 eb f9 90 c5 58 99 ad 3f 4a 43 1c 3d 2e a3 86 0e f5 42 4f 84 7d 93 e6 4a fb 61 37 14 70 80 1d 75 c3 69 d3 9b d7 2e 41 82 5d 2f d0 96 7c 75 f2 c2 5d 7a ac 37 a1 b7 9f dc 4b 85 c6 c5 60 37 04 aa bf 91 0c ee 53 79 e6 47 0a 07 62 1c 8a 4c 88 b7 c2 0b 74 84 1d 5a d0 0a f6 a2 50 23 d4 fb 97 7a 11 2b e9 0a 1c 35 47 c9 d1 b0 07 c5 46 55 b0 a4 cd b1 88 90 66 86 00 d9 f9 68 49 aa 85 09 56 de 15 00 c0 fb 00 39 f1 55 9b 1b e7 f9 4f f2 08 50 ca 88 b5 a9 03 6b 29 f0 f8 17 76 d6 25 be 9e 1a ea a0 39 b4 cc 6c 22 2c a4 d5 64 13 b1 6a b7 f2 2b e4 c5 ed da 41 fd 50 49 1f 27 3f 9b 5b f1 4d df 8f 4f Data Ascii: J?\](f\FB[0PRQ0k<TFFS``\X?JC=.BO}Ja7pui.A]/\|u]z7K`7SyGbLtZP#z+5GFUfhIV9UOPk)v%9l",dj+API'?[MO
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 47 cf ff 60 34 85 4a 69 5f 62 4b f1 ad 65 79 46 16 e0 a6 ea 23 49 e9 16 ac 44 34 6c 69 75 98 71 6f ec 21 47 9b 57 05 9f 14 0e a9 a5 bc c8 ab 44 c7 49 4a a9 48 70 2d d6 51 2c 95 7a ec a2 8b 58 ea b2 06 c7 1c ca 68 c3 15 ac 95 cf 83 59 22 53 53 e1 24 03 48 82 5f a3 2a 0a 1c 46 35 e8 02 ad ef 56 1e 06 a8 75 91 e0 97 09 db 8c 6d a2 47 43 13 b1 a5 ba 05 db 0e 3f 0c 3e 84 8b 11 b6 cc 20 40 45 06 f6 2a 39 5d 31 9b f4 30 7b 28 ea f7 38 8c 33 d6 03 da 3b c2 d5 7d 94 f1 e3 e7 0d 5a 09 7b b8 25 a6 c5 af 72 42 cf e4 73 a5 6c e3 96 bc ca 91 15 6c 64 07 9a d6 df 1d 97 7e 6c b4 45 dd a2 2d fe cf f3 e9 c6 5f 23 38 86 e7 04 59 dd 60 d2 c5 54 7e 17 67 d1 aa dd 86 34 64 1f d7 bd 48 06 d9 7b f7 f0 9e 0b 5e c4 a9 4a e0 32 f2 b1 17 ec 39 cb 59 35 97 0b 6f dc 73 2c aa af 22 e4 Data Ascii: G`4Ji_bKeyF#ID4liuqo!GWDIJHp-Q,zXhY"SS$H_F5VumGC?> @E9]10{(83;}Z{%rBslld~lE-_#8Y`T~g4dH{^J29Y5os,"
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: df 55 6c fb 42 37 6b b3 17 b3 84 a5 2c 7d d9 bb b7 bc 90 11 88 7f 7b 96 b7 a7 1b d8 e0 86 36 bc 91 df 5e cb 09 93 93 36 f5 cc 66 37 17 32 7c 51 1a 0a 5b 47 6d e1 81 83 5b 56 de 6d 47 dd 85 8d 89 60 61 a4 c5 f0 6d 0f 82 8d b7 ba 73 cb 95 e7 a9 7c 05 0a 15 29 56 a2 43 e3 2d b6 dc 95 91 f3 56 b5 60 37 6e f1 8c ba f3 a7 4d 51 99 d8 02 f0 87 32 38 d1 9f 90 41 50 56 00 87 80 a9 88 21 c0 24 cb 0e 1c ac 89 96 b8 7d 40 d9 89 1d 35 cc db 4a bd ba 64 55 22 06 2f 67 b7 bc cd fd a3 d8 99 0d fe 2a 75 1d 3b 4a 3c 1c 2c c2 66 a7 f1 a2 ad d9 db 7d 0b 82 01 83 b7 c6 c4 83 c0 31 1a ae 4c a3 33 86 97 3c 6c 94 c4 0c 59 0c 64 92 8d 63 d3 bb 70 55 88 9e be 15 38 a5 b1 99 f0 f3 57 7e 7c b5 e2 39 4a 56 d5 83 4c 00 20 b8 44 48 76 e7 69 4d 29 fa e7 3e 0e 0f 4f e4 c8 95 e7 29 08 6b Data Ascii: UlB7k,}{6^6f72\|Q[Gm[VmG`ams\|)VC-V`7nMQ28APV!$}@5JdU"/g*u;J<,f}1L3<lYdcpU8W~\|9JVL DHviM)>O)k
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: f9 46 ed 52 c2 42 92 76 3d 55 37 d3 74 23 75 11 e9 17 9d 51 51 19 16 99 41 89 59 94 90 79 f1 99 f5 28 cf 68 b9 95 1a a5 87 79 74 3f d7 1e e4 5e 6e c7 2b ca bf 62 2f 3a 57 79 01 bd ec 7c 01 b1 cb ca a1 8a 02 13 d5 27 26 e3 92 8a 7b 4b bd f4 d0 5b 7f 7d 3c aa 99 e6 92 b5 d1 56 8a a6 1a 68 a7 b5 16 5a 8d e1 18 0f 16 3d 40 52 41 2d 15 85 60 c2 d0 21 8d ca 28 8c f2 7c b7 44 ee c5 84 06 3e f2 82 b7 cd 26 83 00 1d e8 a1 79 c3 6b dc 92 66 80 81 f0 90 72 69 6d 88 a1 aa ee 4e 82 89 26 9b 64 8a a9 a6 9b e1 2d ef f8 c0 87 e6 5b f0 a8 18 28 33 8a 54 93 cd be 13 d4 54 46 6b 78 ba 10 23 ba b9 d7 62 3b c1 a1 c1 6d b6 fb 45 ba 95 f7 7f 3f 3f f8 d8 3e 9f d8 6f 8e df bd 68 09 d7 e8 69 de e5 74 ac bc bc e2 d5 85 5f 0f 3c 9f 70 d1 86 a8 1d b7 0e 04 5a b1 f0 16 1b 2d d8 79 8f Data Ascii: FRBv=U7t#uQQAYy(hyt?^n+b/:Wy\|'&{K[}<VhZ=@RA-`!(\|D>&ykfrimN&d-[(3TTFkx#b;mE??>ohit_<pZ-y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.9	49822	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:21 UTC	909	OUT	GET /assets/b21c5111a12372139409.woff2 HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://discord.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:21 UTC	957	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:21 GMT Content-Type: font/woff2 Content-Length: 39724 Connection: close CF-Ray: 8d782e52ec9a6c4c-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "ff5eccde83f118cea0224ebbb9dc3179" Last-Modified: Wed, 05 Jun 2024 19:27:57 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MVYhFBeixklOnGg9ijVKd2JUxAPdLZHQVPbDmQx5P%2F3vLb%2BdQd5clpvksUH3PsrY90GXiXikXGDLJG809DSiEkzQYuiuj%2BEQUi8BrXjDsw50NdtJNcN0E0JWmqyr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:21 UTC	412	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 9b 2c 00 11 00 00 00 01 7c 50 00 00 9a c6 00 02 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 83 04 1b 81 9a 02 1c a0 20 06 60 00 8e 50 08 82 40 09 8d 57 11 0c 0a 83 a6 04 82 e9 3c 01 36 02 24 03 99 60 0b 8c 72 00 04 20 05 93 3c 07 b4 46 0c 83 60 5b 70 56 71 85 9a 77 ff 53 49 86 ba 2b 9e 53 7f 66 3b 64 53 c3 b6 69 f1 b3 9e ab 20 43 d4 b7 62 6a d8 36 8d 88 77 3b 80 2f d5 fe e1 b2 ff ff ff 4f 4d 26 cf b8 bf 5b b9 6d 6f 2d a1 c0 c7 87 0c 8f 88 34 46 60 04 0f 84 53 65 52 f8 58 7a 50 ae 67 0f ac 6a 0a b9 4c f5 96 a2 0b a2 53 18 54 28 61 c5 15 79 a3 44 90 d3 06 6f 64 bb 2f 29 e3 02 f7 d8 e1 7c 6c f7 1d 0f 7a 6e f4 d2 91 ef a0 54 d0 e2 bc 92 4f 70 5a 50 08 bc b0 b3 63 5c 8c f2 c3 da 25 92 48 96 cb ba 79 04 09 Data Ascii: wOF2,\|PB `P@W<6$`r <F`[pVqwSI+Sf;dSi Cbj6w;/OM&[mo-4F`SeRXzPgjLST(ayDod/)\|lznTOpZPc\%Hy
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 31 ad 6a 65 8b 23 ae 7e 5f a8 88 df fc ff ea 9a 85 13 21 d7 85 e4 99 f9 37 13 65 7f 9e e6 f4 fd ff cf 73 b9 5c 84 60 47 d0 5e b3 15 af 68 d2 42 b2 04 93 09 74 52 a3 4e d5 c0 2b 22 78 55 81 0e e6 ca a8 33 aa 46 7d 30 f8 ff df cd 7a f7 bd 90 40 5e 92 06 69 42 5e 0a 13 b4 0e 75 26 1d ab 0f 9d b3 5f 7b 98 24 5d 0e ab 8c 88 af 98 fe b9 7f 8a 38 6b c6 9a 8c 18 fc 3f ff 63 cf ff e6 5e e7 7e 15 a0 fd 41 32 cd d6 18 54 95 24 16 69 10 09 9d fa 13 59 63 78 21 62 7e 06 78 bb fd bb 33 3a 67 ee 5b ce ba 21 c9 58 95 ce b8 b3 66 67 74 ec 64 75 66 12 92 cc fb 92 75 5a 57 21 d9 19 97 8c 79 f9 c6 aa 28 5d d6 8f 24 d9 49 66 5f fc 9f cd f6 67 36 39 b7 45 66 de 27 7b e2 98 6e 64 43 0e d3 59 74 36 f1 ee 2a c4 3b ee 0d 5c 05 15 4d f5 17 0d dd 15 0d 45 27 da 5e 49 cb dc fb ce 72 Data Ascii: 1je#~_!7es\`G^hBtRN+"xU3F}0z@^iB^u&_{$]8k?c^~A2T$iYcx!b~x3:g[!XfgtdufuZW!y(]$If_g69Ef'{ndCYt6*;\ME'^Ir
2024-10-24 07:16:21 UTC	1269	IN	Data Raw: 3c 93 28 2a 8d a5 65 b0 b6 1c 36 54 c0 e6 1e 79 3b 43 20 cb 04 b2 5a 87 3d 95 73 a0 1a 8e f6 8a da 9a a9 af 8d 86 3a bd cf 11 c8 ef 05 f2 27 1d 7e ed 1d 7f 34 ce df 7d e4 72 73 5c ed 3b 77 5a e3 61 db 3c 6f d7 7b 85 00 df e8 d0 de 91 d2 d9 b1 5a 40 16 90 88 84 5c 42 18 4a 14 73 49 e0 55 52 28 25 87 a5 60 04 15 9e a8 d2 f0 fa f2 67 86 80 00 16 e8 85 05 72 f6 b9 56 4e 20 ce 51 f7 8e 08 01 41 72 6f 1c 15 06 8a 42 88 3d 16 74 86 1b 49 c8 1c 58 94 a2 16 6d 42 6e eb 1f 11 06 4a 04 e3 47 65 dc a0 b4 6a 70 e8 88 f3 4e f4 0d e0 73 d0 99 e7 39 20 80 f3 28 80 70 31 94 5a 4a d7 ea b7 30 a5 7b a5 47 a5 b6 cd 2f c1 70 10 fe 6b 64 31 d7 2b 39 37 bf e2 34 ef 34 ce 5a d3 c9 38 50 94 47 07 fe 33 ae 63 8a 00 41 1c 67 38 09 b1 b3 1c 04 71 d1 45 37 c1 5d 62 6b 25 ba 57 da 5a Data Ascii: <(*e6Ty;C Z=s:'~4}rs\;wZa<o{Z@\BJsIUR(%`grVN QAroB=tIXmBnJGejpNs9 (p1ZJ0{G/pkd1+9744Z8PG3cAg8qE7]bk%WZ
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 43 c3 e1 26 06 d5 d7 fb bc 6b 06 14 a1 93 35 aa 30 d6 ee dc 5d 5b 71 93 ac 74 16 fd a7 16 e9 3e 52 0b c6 0b f2 e7 58 f4 b5 23 56 6d 4d e9 a6 f8 8a cf 04 6c e2 2f 74 32 9d 73 5e fd 73 d7 af a1 86 a6 ba 76 f5 7a a3 d9 73 a1 c5 c7 40 d0 48 72 8e 5d 16 3c 5f 9d f1 2f bd 1f 7f 1d e8 99 47 3b f0 c8 b4 ab 91 cf 4a 3f 49 a2 dc c9 12 52 a2 73 ea 97 fa a7 eb 09 fa 76 e7 b0 16 9e 3a 0e 2a 65 1e fb 8d 19 d1 6c 32 42 8b d3 e1 1c d3 5e ae 46 2a d2 7d d6 ec 4b e7 4b 32 87 13 da 24 9d 1c b1 c2 8c 5e 99 8e 9c b7 15 7c d5 af a7 38 79 45 a6 9c fe cc a6 74 13 a2 e2 65 5e 1d f9 5b 8a 78 70 6e 30 e9 6f cd 9f 9a 03 29 4c 7d 5c 11 b8 51 fa 2a 8d 1f 10 92 de 6c 0d 25 73 1d 39 7d 5b 60 83 c1 eb 8d aa 91 7e 64 4e 5e da ab c6 70 56 54 5a 8f a6 eb 67 e3 90 d4 ea 37 56 83 f6 7f 5e 76 Data Ascii: C&k50][qt>RX#VmMl/t2s^svzs@Hr]<_/G;J?IRsv:el2B^F}KK2$^\|8yEte^[xpn0o)L}\Q*l%s9}[`~dN^pVTZg7V^v
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: f8 0c 9f cf 11 6c 07 ec 80 b3 93 40 a1 4f a0 c1 f8 d1 a8 09 a6 d9 53 f8 28 39 3b a3 4f b4 73 38 0f 7c 46 24 10 e1 25 48 83 ad 01 c6 fd 10 0f c0 78 aa 51 2f 44 0a c6 b3 c5 68 be b8 0e 3e 04 3f 33 18 3f 87 f7 0b 90 df c1 fa 17 b4 17 60 bc 0d 5b 02 60 4a 9b a9 3e f1 2a 29 7c 4b 8e dc 15 c5 31 0b 32 47 bb 47 65 0b 90 f3 48 43 24 c1 da 40 e7 10 bf 6c 22 40 43 a6 05 56 6d 51 97 cc 42 6a 42 53 d9 c9 ba e5 a0 3f b1 ac 4d ed a0 97 8d c0 b0 18 53 2e 04 69 5f ee 04 5f 42 04 29 85 8c 58 1c 2b fe 53 7d 40 0b 25 b6 98 6d 30 0c 6f 8a 42 dc 12 56 ec c0 04 d9 29 a2 ec e9 a7 20 51 15 53 2b e2 9b 11 60 93 31 ad 17 8e c5 a4 6d 4d 24 26 67 c3 8c 44 22 68 c8 d9 dd c6 30 a4 3a 12 ed c2 12 7e 24 14 55 cb 6a 8c 9f 29 63 4b 8f e6 15 c4 58 a6 f6 58 a9 7c df 77 ec e1 20 3b 02 b8 9d Data Ascii: l@OS(9;Os8\|F$%HxQ/Dh>?3?`[`J>*)\|K12GGeHC$@l"@CVmQBjBS?MS.i__B)X+S}@%m0oBV) QS+`1mM$&gD"h0:~$Uj)cKXX\|w ;
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 4f 4d 1a 85 a0 43 06 e3 04 7f 1d 7b 2f a4 bc 49 a9 ac 58 4d c5 57 d4 ec ac 26 11 34 2e 52 64 b4 9a 77 57 3b d5 2c e5 b8 b4 93 24 74 98 6d 32 64 09 03 35 69 4a 9b 51 b0 a0 67 ea 9a 26 c8 95 60 75 33 36 f8 10 25 96 66 d5 ee f5 c1 54 02 69 60 0a c6 a4 28 73 d9 5d 4b e3 26 4c 0e 1e 61 69 96 f0 6a 80 0a 81 01 5f 2e 3d 05 59 08 41 c0 bd d2 8c b9 7e a8 81 96 7f 68 8a ea 8b aa 01 9d e2 e9 be c4 3d 04 6e 6e b9 94 06 d2 98 49 d7 5a ea 3c 9d 27 13 b2 48 ec 2c 3d 66 92 8f 08 ec f4 44 61 22 2a ab a4 b4 71 09 69 c8 42 1e aa e8 69 71 e9 b0 07 35 d4 a3 03 4d 18 b4 ef ca a2 9e 5d de 6a 1d 37 5a ee 84 88 53 13 73 6b 1d 03 4d d3 7c 7e a9 09 4e 6b 3c 3a 82 b6 e5 81 69 45 64 80 a6 10 52 99 9d 18 a5 47 00 24 3e 0d b9 1a a3 04 35 ab 22 42 f3 3a 6f ef 1d 21 5e 41 df 1a 95 b3 08 Data Ascii: OMC{/IXMW&4.RdwW;,$tm2d5iJQg&`u36%fTi`(s]K&Laij_.=YA~h=nnIZ<'H,=fDa"*qiBiq5M]j7ZSskM\|~Nk<:iEdRG$>5"B:o!^A
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: ca c6 c7 ec ba e7 b1 9c 32 19 38 ca 9c ea 3e f0 09 9f da f7 84 bc 2c 4e 33 60 c0 80 01 52 ba eb 88 f6 b9 d6 63 38 be 81 98 13 ea cb 8d 31 41 84 10 3c 41 c9 e9 4d ca d0 94 c3 aa cd 85 b1 72 68 1d 15 b5 30 05 8d 20 42 08 e9 30 44 18 0a 11 da 51 7c 6d 2a 48 30 86 27 cc b5 e1 bd 5a b5 97 99 a7 26 4b 89 59 3d 19 2b 80 73 e4 77 87 b5 b8 f2 a3 fb 09 52 4e ee 7a cb b2 f6 f5 0d 87 7e 66 49 1c c2 e3 39 4c 1e c2 e4 12 10 4b 36 fe 3b 29 f0 50 8f 71 39 04 50 22 87 7a 8e 56 66 46 a6 ba 7b c1 86 7a 79 1a 6b 8a 6a 23 4a 63 06 b5 62 42 2e 27 ba d3 53 b2 47 16 e5 33 53 1e c2 cb 50 2e 75 f0 a4 a6 2a 3c 6a ce c1 53 1b 54 74 4a ee 81 ea 80 2a 71 d0 e2 c5 53 3a 94 c4 a9 5b 58 72 f7 ca 1e fb c8 2c 99 e3 30 5d d3 55 69 12 d3 ee 94 1e 98 6a 28 c0 5a 9b 08 1c 2e e6 ac a9 d6 13 ca Data Ascii: 28>,N3`Rc81A<AMrh0 B0DQ\|mH0'Z&KY=+swRNz~fI9LK6;)Pq9P"zVfF{zykj#JcbB.'SG3SP.u<jSTtJ*qS:[Xr,0]Uij(Z.
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 77 41 12 4d c8 05 66 60 e7 af ce b3 eb 94 67 4f a0 f5 da aa 2a 50 db 7d 6d de bd 74 69 cb 9d 53 c3 2d 12 2e d3 12 91 c8 44 25 3a 31 b9 99 f8 e6 13 ad 1f ce 3b a8 7e 08 d6 ee 7d db 17 a7 cd f7 c5 30 6e 66 f8 7f ec b3 b1 dc 29 a7 9d 59 58 ae 85 4a 3e 50 27 b6 78 3b 59 ef de ba 80 3e f1 c5 5a bb 2a c6 2e 04 57 dd d9 09 dc 18 7c 46 e9 46 c1 48 64 57 d8 eb 83 b1 38 a5 85 ed e9 a2 59 e0 33 4c 37 4e 2a 93 6a ab 1b 42 fd 9b 68 3d ea 2e 77 24 57 c8 a7 9c 6e 9c cc 91 e9 1c 8d 9d 03 53 8c 11 f7 37 12 cd 03 9f 83 ba 71 0a b7 52 ef 6c 0a 0f 4e b3 66 32 dc 3d b1 02 f0 49 a9 1b a7 f2 e4 06 57 73 64 68 33 67 a5 e3 c3 1b 17 c0 67 a9 6e bc 84 af 30 ba 5b 36 0e cf f0 76 36 3d 7d 89 3f e0 d3 56 37 5e 2a 50 56 79 fc 5d 23 09 c1 c9 e7 97 3f 69 00 9f c7 ba 71 9a 50 65 f2 b6 76 Data Ascii: wAMf`gOP}mtiS-.D%:1;~}0nf)YXJ>P'x;Y>Z.W\|FFHdW8Y3L7NjBh=.w$WnS7qRlNf2=IWsdh3ggn0[6v6=}?V7^PVy]#?iqPev
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 37 b2 c9 bd dd bb 20 98 c6 2c fa 2b 1c 04 5f 14 82 50 e9 47 7f ec c4 48 91 26 43 96 6c c3 cc 31 cf 7c 79 4a 2d b7 4b 99 6a 35 0e ed cb a6 36 97 20 ba 91 2b 8d fe d1 ec b2 56 6d fc cb 41 8e 84 07 89 48 87 3c 22 11 b9 68 46 3b 3a 31 08 21 c4 b8 c5 3d 5e f1 ce d5 cc a6 95 ff e2 47 2f 36 be bd fd dd fe 8e d3 f6 b4 97 54 4f 42 7e 26 80 ae 76 46 6f 35 e5 45 a7 d7 94 9b 92 aa 65 a2 66 cc 47 a3 44 5b de e8 d2 e3 63 a2 71 f2 4a 25 9c 64 d2 c1 3b 9b 72 98 d4 33 cf 38 d3 cc 52 88 52 50 5e f9 14 5d e0 38 8a 2a a7 2d 6d 6b 7b 4f 14 73 b1 b7 75 f5 4e 1f 1a 69 bc 8f 4d b5 d1 d7 16 5b c5 d1 df 4e 00 09 59 44 08 28 2c f8 3d e6 19 91 58 b0 e4 43 4b 73 e2 bd 8f ab 3b 48 63 c9 f7 39 44 d3 21 9b 09 d6 64 e8 be a4 d8 5c 5a fd 4c a5 85 ce b4 96 76 5b a9 f6 2d 83 76 d3 6f a7 73 Data Ascii: 7 ,+_PGH&Cl1\|yJ-Kj56 +VmAH<"hF;:1!=^G/6TOB~&vFo5EefGD[cqJ%d;r38RRP^]8*-mk{OsuNiM[NYD(,=XCKs;Hc9D!d\ZLv[-vos
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: eb cb 68 21 99 70 a6 b4 ed b9 98 ca f2 01 34 c7 a0 0e 9c 13 0a 2b 18 62 3d 64 fc 73 aa 5d 60 66 1c da 91 27 2f e2 c9 f3 d7 d4 40 eb 13 64 fa 25 8a b3 62 fb d3 f5 67 87 78 56 a7 29 3f ab ab 5d ef 71 c3 a6 05 17 d0 15 84 52 61 da f0 e4 45 23 d5 42 c7 84 ed f2 2b 04 e7 15 f9 28 cc fe 81 dd ee 00 cb 63 5e 5b 33 12 6b e9 13 79 13 35 ed b3 dc c4 be 6f 56 03 5d 3f 28 c3 c1 95 32 f7 5f 54 87 5d d5 86 2e a8 c7 ee 03 bb 70 00 4e b2 93 97 32 cb 8d 8b 39 74 31 b2 b5 97 c6 3e 5b 7b f9 35 f5 b9 0f e0 b4 76 49 c5 9c 65 c2 89 9f 1f ab e3 c9 95 2e 13 88 72 c7 94 3c 0a eb 46 87 e3 7a 10 46 88 a7 6c 19 23 86 47 81 b8 3e 4a cc 78 4b 17 59 ac 64 a8 13 33 69 9e 63 4d c7 3c 44 5a 19 f6 8e b0 a6 3c e7 45 d5 b4 1b ce 7e b4 70 3f 38 3d d0 ad 4f c1 11 24 52 66 99 62 da 31 9c a2 a6 Data Ascii: h!p4+b=ds]`f'/@d%bgxV)?]qRaE#B+(c^[3ky5oV]?(2_T].pN29t1>[{5vIe.r<FzFl#G>JxKYd3icM<DZ<E~p?8=O$Rfb1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.9	49823	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:21 UTC	909	OUT	GET /assets/8bd8143eff37936894aa.woff2 HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://discord.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:21 UTC	961	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:21 GMT Content-Type: font/woff2 Content-Length: 45868 Connection: close CF-Ray: 8d782e52ee8a6ba9-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "d295c40af6fca08f8e0eb5425351f431" Last-Modified: Wed, 05 Jun 2024 19:27:55 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JlmLhqSzy2oNk%2FYW6hl%2FPDwrmergl6Vkd65w6a6xV02XLO6vgYPMNTWU7wBB1NQQLQYogLwfivZzPoEDq4wB3F%2F9GWEl8xyEQM%2Fet7srWAZDX8ln%2F1myCmL5FXS3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 b3 2c 00 11 00 00 00 01 a8 94 00 00 b2 c8 00 03 00 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 82 78 1b 81 cf 10 1c a1 5c 06 60 00 8e 58 08 82 40 09 9f 03 11 0c 0a 83 b3 54 82 f8 40 01 36 02 24 03 9a 0c 0b 8d 08 00 04 20 05 94 61 07 b5 4b 0c 83 78 5b 54 83 91 01 35 c7 ee 7f 28 a0 da 56 d9 4d aa fa 6d e0 04 d4 87 7b 81 39 86 a0 d3 ea b7 73 34 39 92 f8 79 62 6a d8 ee 1e 80 da 09 89 3e 7d db 6d cb b2 ff ff ff ff cf 4f 26 72 d8 25 e6 92 54 8b 81 51 ec 7f ff 03 35 c2 34 33 b8 79 44 ea d8 75 99 25 12 53 df 77 5e 90 42 f6 2e c2 bb ce 82 2a 31 70 7c 62 32 c4 bc 88 67 87 d4 9c cd 57 75 71 cd b7 42 1b 16 c3 32 a6 65 7e 09 33 0a 12 3e 11 49 c9 a6 8e 54 4c 50 db f5 63 aa 83 f9 8e b9 63 24 38 fc e9 54 6c 65 c5 09 17 Data Ascii: wOF2,x\`X@T@6$ aKx[T5(VMm{9s49ybj>}mO&r%TQ543yDu%Sw^B.*1p\|b2gWuqB2e~3>ITLPcc$8Tle
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 0b 9e cc 23 a1 30 d4 64 89 21 69 d4 ff 33 d5 2a ad 06 c4 19 b9 79 47 8e b7 d2 59 e9 5c bc c6 47 33 59 d6 f5 ab 0a dd 55 bf 9b 00 1a 20 d5 40 93 33 24 28 ed 92 e0 18 5a 19 50 06 8d 02 a9 06 48 dd 50 5a 47 69 9d 3b 63 0c 49 80 94 5d 4a 7e 9c 8f ee 7c ee cc 1a 1f 9d 0d 5d 10 5e 38 17 85 17 64 17 65 9b a6 97 e7 f7 7f aa 96 ed ff 18 fe 15 86 22 fc 84 c5 25 dd 3a d1 51 eb 90 5f bf 56 51 39 87 2e 65 62 06 20 f8 39 18 69 21 8a 4a 58 6e a2 93 76 2f 49 ba c4 75 52 ba 67 5c e6 85 58 39 a4 36 55 ae 2e 26 6d e5 14 53 51 da af 77 d9 6f 79 45 e9 a6 70 77 45 6d 9e ff e7 fa 9f de fd be 25 38 18 8e 63 fd cf 7b 7f e0 e8 e2 5b d1 10 66 38 71 22 01 5b f0 7c 2d 2d e9 4e bf 93 c3 0c 99 76 6c 01 e8 5a 74 80 45 0a 4e 23 69 43 bf 93 c3 7c 87 a9 95 73 96 53 64 72 c8 80 18 ba 8e 20 Data Ascii: #0d!i3*yGY\G3YU @3$(ZPHPZGi;cI]J~\|]^8de"%:Q_VQ9.eb 9i!JXnv/IuRg\X96U.&mSQwoyEpwEm%8c{[f8q"[\|--NvlZtEN#iC\|sSdr
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 95 d4 df da 67 57 e0 9b 4f 0e 39 22 0b 66 a7 19 c4 f4 b3 80 57 c1 f0 f6 59 10 e3 6a 17 e7 e8 82 2b 2e fd a3 a2 5f eb 21 57 ed 85 35 e7 0c 42 b2 b4 19 bc e6 a2 15 5d a8 e8 94 08 6d 3a fe 87 a9 1f c1 81 87 11 b4 11 c8 e4 1f 7a 3b 4f 9f 67 af 45 60 ff fd 40 0e 68 e6 01 72 83 4c f9 ea a9 18 24 b9 29 27 08 58 e8 0d 74 5a e1 4f be b0 9b a6 d6 dd 99 6a ea dc 4b 62 e0 b7 0a 80 5a 33 79 2c d6 ab 41 17 14 d7 b1 33 47 48 95 da a2 07 6c ed b8 f5 a3 35 47 bf 77 d5 c7 a0 54 d2 fa 90 b7 dd 9f c1 1a fc 42 1a 02 39 09 bd 1b 2e a2 8c 4c 30 96 71 7d 20 be 6a 07 0c d3 d8 5d b5 8b b7 c1 3a d8 f5 25 67 f5 b6 39 44 ca aa 7c cc d8 8b 6c 2f bc 35 57 ed 18 96 16 dc da 57 22 4b b1 c1 92 dd af 75 36 6f 6c e4 38 49 2e 70 58 9a bd c0 3f 42 3e 65 f0 ca ba e5 ff 71 64 84 70 be f9 a9 e7 Data Ascii: gWO9"fWYj+._!W5B]m:z;OgE`@hrL$)'XtZOjKbZ3y,A3GHl5GwTB9.L0q} j]:%g9D\|l/5WW"Ku6ol8I.pX?B>eqdp
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 6d e4 37 da 4c 6c 95 c7 3f 58 87 e9 66 33 94 38 c9 d5 9f bf 6d 80 cb de f0 93 e2 d3 f1 4d 66 7b 2d 02 87 33 52 35 d7 5a c3 09 31 a1 dc 34 33 0d 50 5f 4e 33 b0 bb 8b 14 c2 13 0a 62 ce f1 a9 2d 5e 93 78 b7 ee 6f 45 3f 53 c6 94 43 4e 56 cc cb ad 75 c2 4e b3 88 63 72 b9 fa 45 fc 94 9d fd 15 86 41 1f e4 d0 3a d4 d4 7f 64 cd a7 43 ef 35 1c 34 d0 74 fd 0d 65 63 a0 b1 f5 c3 37 6c 90 8a aa 36 3f 8d 03 ba 18 36 be c0 b0 94 a8 16 1b 20 e3 1a 9a 27 d2 7d 74 51 1b 9f 41 e0 5b aa 0c f2 4f ad ce d9 19 0c b7 19 40 1b e9 38 6c f9 43 22 d1 00 50 46 9f 43 3e fb 08 03 fa 42 b3 d8 c2 1a fc c8 2d 64 b9 fb 5f 17 b4 ca f2 d1 c3 3e 05 b1 74 5c 00 bb df 42 ef a7 c6 2e 23 4c c4 c7 7a 94 44 77 0c 02 7c 74 fd 64 4a 9b e4 73 bd fe c6 e1 8c 85 1e dd f9 47 6a 2a 0b d3 9f 74 fe aa 97 39 Data Ascii: m7Ll?Xf38mMf{-3R5Z143P_N3b-^xoE?SCNVuNcrEA:dC54tec7l6?6 '}tQA[O@8lC"PFC>B-d_>t\B.#LzDw\|tdJsGj*t9
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: d5 97 9a 6b a9 b7 ef 11 ea 6f bd cd b6 40 da 62 f0 17 60 ff e9 d4 a1 a1 c7 80 1b ee 78 e0 89 17 de f8 e0 8b 1f fe 04 60 24 8e 11 26 9b 62 aa 69 a6 9b 6f 95 d5 d6 58 6b 9d f5 36 da 64 b3 2d b6 da 66 bb 1d 8e 3a e6 b8 13 4e 7a 14 1a 10 2d 88 0e c4 12 f5 f8 1b 60 a0 13 9e e9 5b 51 07 1d 7b 45 f5 fc 12 84 92 d7 7d 10 22 38 79 76 0a 21 84 81 c4 d3 18 c4 a6 0b 41 92 5b 5d 56 b1 1b 0a 19 d1 62 e9 22 ab 28 53 56 5b 8f b1 a1 2c d9 68 07 ce 91 9b 2a 47 9d c4 78 9b 8a c1 80 6a 28 a0 11 1d 02 5b 2c 20 4d 5f 01 69 6c f9 00 5a 10 50 32 a7 62 31 2d 3e 8b 92 8a e7 b4 28 9d 8a d7 80 ea 6d 87 d8 06 00 2c 15 0c 20 7b 67 0a a0 40 d0 2c 7b 00 6e 79 95 10 bf 7c 40 d8 0c 68 0b 48 7b 81 f9 7d 09 66 d1 02 b4 56 05 cc 4d 60 6e 1d 43 c7 b9 13 04 86 35 97 92 7e 4a e7 65 e5 86 7c 44 Data Ascii: ko@b`x`$&bioXk6d-f:Nz-`[Q{E}"8yv!A[]Vb"(SV[,h*Gxj([, M_ilZP2b1->(m, {g@,{ny\|@hH{}fVM`nC5~Je\|D
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 0f 1f 3d 51 53 d7 00 5b 1d 5b 59 e9 aa e7 2d 38 2a 46 8a df 03 8c b4 1f 87 b5 06 fe 48 06 dc 16 43 fd e1 56 00 92 38 1b 67 a8 38 3a d1 05 09 07 47 39 ae ac 82 ca ae 84 bf f2 ff 00 95 0e 73 ea 51 0a 06 df e5 74 32 1d 83 79 20 09 26 29 b6 2a 17 d1 c0 13 e2 3b 1c 80 b1 07 09 07 47 99 9a 53 8f ef 57 01 e5 dd 02 85 1f b8 17 c1 77 a1 c6 db 3e 01 e8 a5 3a a1 68 92 f9 25 17 f8 e6 35 01 cf 5d 71 50 75 de 62 ae ee b1 84 58 53 62 7e 23 02 8c 9e 70 b9 d3 9a c7 1f 33 92 4e a6 f9 7d 07 0c d7 85 18 07 22 0d c2 56 9e b4 8c 60 9c 5d 8c fc 25 fe d2 e0 c3 d8 70 26 7a 83 03 4f a3 f9 1f 07 b8 e2 0d 6f 5e 57 58 7c 1a d8 2e 20 6e fc e5 7d a8 bb d0 41 c2 39 2c 04 09 02 3d a7 2c 73 39 5d b2 cb 69 3e 71 51 7b 4d 6a 39 9d e5 5c c6 94 f3 17 53 4e de 57 38 24 3c 36 1f 3c 4d 9d 09 86 Data Ascii: =QS[[Y-8FHCV8g8:G9sQt2y &);GSWw>:h%5]qPubXSb~#p3N}"V`]%p&zOo^WX\|. n}A9,=,s9]i>qQ{Mj9\SNW8$<6<M
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: d0 a0 42 fd 5e 93 39 23 54 46 b1 bb 5c 1d a2 04 0d 7a 4c 62 d5 85 e6 c6 47 10 34 a9 30 99 33 07 e6 63 af 2d 15 55 53 23 b5 e3 30 6e e3 24 ce db d5 0c 87 27 42 0d d4 a3 45 bc 76 4e b7 a3 3c ef a3 e9 6e 7f 7b 7b 86 3e c3 4f b7 fd af 74 ec a9 4e 48 9c 81 3c a3 dd 91 ae 87 d7 69 99 19 64 47 be 94 93 0c 4d a8 5a 81 2e 97 ab d0 31 42 28 ca 56 95 3a 68 74 6f 83 f1 48 f3 2d ba 7f 8a d4 59 6d af 9b a5 36 4f 53 52 b1 07 8b dd d0 07 1d 30 c8 5e f7 a3 10 da 85 c8 fe 5e 9e 6d 3c 94 4a d9 69 61 27 59 45 b5 d0 7c 40 5f 04 2c 02 40 b2 77 16 fb b3 1d 85 a6 61 7d e5 d5 f6 18 b8 54 3b bb f4 32 eb f7 43 09 df ab 67 8a 81 90 92 41 a6 df 88 9b 12 57 4c 1d 24 15 95 41 9f 21 9a 22 ab 01 39 39 b8 91 43 e0 f2 15 86 9a 49 a4 24 f5 28 8c cb d4 0c 30 a5 37 4c c8 8a 32 c0 ae ff 89 1d Data Ascii: B^9#TF\zLbG403c-US#0n$'BEvN<n{{>OtNH<idGMZ.1B(V:htoH-Ym6OSR0^^m<Jia'YE\|@_,@wa}T;2CgAWL$A!"99CI$(07L2
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: b8 43 53 30 24 1a a3 71 a7 6b 9a 36 77 5b 8e 40 a7 70 ec b9 86 2c 8b af 06 33 1f fc 83 f5 a0 4a c9 f9 e2 17 41 f4 ff 89 6b 01 7a 8f 76 dc 14 b4 fa cf c7 61 5d 73 77 75 66 3b 0d 2a 6f d7 ac 37 05 da c5 05 dd 70 42 13 7a 38 73 8f 38 cf 7e ea f5 e0 b4 df ad e1 1c 6f 09 3d f8 a1 6e 5c 52 c7 50 9a 7c 02 d5 19 72 97 f8 ba 78 e1 3e 01 b3 c7 e7 d4 f9 31 76 82 11 01 6a eb 54 69 33 f0 c4 c4 97 29 e4 6e bd ae eb 11 9e 71 c2 b6 01 82 9f 4e 29 24 46 a8 37 06 57 c6 39 20 1c 7f 3e 10 47 06 dd bc a5 80 21 76 c8 a4 1c 19 de 13 c2 1b d2 fa 7c a0 8d 7d 28 60 d5 e9 ea 78 d8 ef 9c f4 31 a4 fe 8d 5c c4 98 b4 d6 c5 32 1b 03 34 78 af a2 c4 43 cb ad 5a 01 96 e4 16 a8 81 88 90 82 9f 5d 87 9b 63 f9 5b b5 96 0c 6c c4 52 eb 06 b2 20 3d 0d 95 9b 07 55 18 b1 ab 30 59 83 6c 17 3e b3 01 Data Ascii: CS0$qk6w[@p,3JAkzva]swuf;*o7pBz8s8~o=n\RP\|rx>1vjTi3)nqN)$F7W9 >G!v\|}(`x1\24xCZ]c[lR =U0Yl>
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 6e 33 11 68 23 f1 52 17 ec c2 53 bf df 20 70 d4 7b 0a 53 4e ec 58 31 87 71 91 28 06 e4 21 c5 97 db db a6 e0 1d 01 b3 8a 39 c6 f0 9a 99 08 65 ef 7b 68 d5 c9 2c 33 f8 ac da 2e 11 83 aa 97 b5 a1 74 0f 3e d8 8d 8d d0 ba 06 93 c3 55 1e bd 98 38 39 71 28 c1 9b 5d 2f f0 e0 52 3a 4a b0 c2 03 06 7e 35 dc f0 47 45 41 22 30 e0 83 31 6b 4b 0f 72 e0 92 47 0e 5a 72 cb c1 4b 2e 39 64 c9 c9 d0 08 1d 7a 7c f7 03 14 6f 4a 0e 18 97 0e 50 8e c0 4a e9 5b ab f5 2a 6d 68 a3 7a ec 84 c8 52 67 ae 5c 83 90 31 1f 7d d6 35 35 e8 34 68 d2 8a 83 19 63 15 dc 67 2e ec 2e 0d 16 2a 34 ea 31 2e 41 96 32 58 5d 86 4c 59 75 08 eb c9 e2 be 74 22 e4 20 a0 39 55 6a 12 16 91 28 5b b9 af ba 0d 9b b6 06 47 3f 83 d3 2f fc 9a 3f 42 5d 9f 80 d9 0f d9 86 df 86 d5 8f df 85 5f 87 e6 c7 f9 c5 4f 00 87 52 Data Ascii: n3h#RS p{SNX1q(!9e{h,3.t>U89q(]/R:J~5GEA"01kKrGZrK.9dz\|oJPJ[mhzRg\1}554hcg..41.A2X]LYut" 9Uj([G?/?B]_OR
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 53 78 2a 4f fd 19 3c 63 17 e7 24 38 a9 4e ba 97 f3 e5 7e 3d bf 92 9f 8a 34 79 e6 86 5b d8 41 43 a5 cb 9c c3 9c 65 01 87 73 1a 6b d8 c8 36 76 0a 93 b4 0a 45 c5 95 54 56 64 80 2c 55 30 74 06 5d 0f dd a4 cd da a1 46 23 5d 54 bb a6 39 28 7c a2 33 e2 5c 38 6b 9d a1 5b 42 24 02 6b 31 53 8b 78 d6 84 31 c5 02 bf d8 e4 5f d9 87 45 c2 7d 67 0e 40 67 87 0b 56 04 23 3e b5 84 93 7c 8a 4f d5 69 38 43 17 c0 76 4f 42 93 da a4 77 b9 5d 4f ae a4 a7 42 3e 8f 5e 40 26 b6 b1 8b 14 43 0f 2c e6 58 56 0f b4 dc 7f 59 fa 4a 29 6e 1c 68 7f 5c 87 03 80 4a 0a 7d 81 97 9b 6e 73 ff c7 58 fc c4 f8 f7 69 3c bb da a1 31 85 49 4f 6a 62 13 51 42 e1 7b df 61 f6 c6 71 46 be 47 16 1e 1f b2 3f fe 1d fb 83 4e ef bb 5c 7b 2b 38 d7 1b 97 9e 7f 7e 59 7f 4d cb a2 5d ba 65 c1 2e 11 f0 c7 3d bf 8c 3f Data Ascii: Sx*O<c$8N~=4y[ACesk6vETVd,U0t]F#]T9(\|3\8k[B$k1Sx1_E}g@gV#>\|Oi8CvOBw]OB>^@&C,XVYJ)nh\J}nsXi<1IOjbQB{aqFG?N\{+8~YM]e.=?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.9	49824	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:21 UTC	909	OUT	GET /assets/452d7be36bf4b23241bd.woff2 HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://discord.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:21 UTC	960	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:21 GMT Content-Type: font/woff2 Content-Length: 139388 Connection: close CF-Ray: 8d782e52f886e946-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "db985aaa3c64f10506d96d876e350d47" Last-Modified: Fri, 06 Jan 2023 01:15:23 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kAdpg%2BxekfaWczwJOIgA8tSPoiUkznqMaCwDZHAhBcNqJ%2FxZnHwzezsIr3kv4wXcjSiVnGd8a6jVgWIHc2cfX2Gmc06rrYvNQvZrSsoj9AXF02AL5SyzoOC%2F%2Bmu8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:21 UTC	409	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 02 20 7c 00 0f 00 00 00 06 39 84 00 02 20 1b 00 02 01 cb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 8b 66 1b 84 bc 76 1c d3 04 06 60 00 95 1a 11 08 0a 8f 8e 18 8c 96 65 01 36 02 24 03 f3 54 0b f3 58 00 04 20 05 8a 7c 07 82 bd 5b 0c 07 5b f2 42 b5 cf 7f 63 dc 7b bd ab ca ee 3a ec 77 e9 06 54 0a 6c 1b db 86 04 43 d3 54 2b cf d8 ef 47 93 a0 c6 18 de 1b 02 46 e5 5c 73 1a c7 a8 bb 6d 8c f0 4a 0f 6e 60 eb b6 d2 f1 d0 79 03 f3 aa 36 f2 3c a5 e9 ff ff ff ff ff ff ff ff ff ff ff bf 97 e4 c7 63 9b bd 99 9f cc fc 23 17 e1 08 97 01 82 c8 a1 15 b0 1e d4 0b 6d d5 b6 bb 6e b7 10 85 75 b0 ce 23 24 48 e1 02 2b 19 94 cb 19 31 29 94 6f 71 b6 6c d3 8e 40 b5 0b e9 55 85 87 eb 23 54 70 50 0c fc 10 43 ef c9 88 58 6b 89 60 9c 6b c0 Data Ascii: wOF2 \|9 fv`e6$TX \|[[Bc{:wTlCT+GF\smJn`y6<c#mnu#$H+1)oql@U#TpPCXk`k
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 4d c9 ad 35 e9 32 c2 0c 88 a0 e4 fc e5 1a 29 d9 60 a7 4e a8 96 c2 8a 44 2e 66 77 54 7a ab fe 61 df 41 88 20 8d fc db a8 29 c8 3d 2e 5c 59 9d b7 5a 0f 27 29 2b 12 99 08 2f fc 92 95 ed 30 7b c4 94 84 38 db 91 e1 32 36 75 8f 3b 3c 61 c0 ac a0 f1 c9 0d 1a 3c d3 d6 ed b1 3d 9e 13 9f c5 ee 65 71 3b 6b 44 a6 a2 b0 82 59 d7 e1 49 5e bf ef 60 f1 52 88 b3 6e af f9 8f 54 3d 1c 52 a1 2a b0 54 14 4a 6c df b9 57 ff e0 70 d5 86 bb 5d df 05 2a b8 ca 18 35 19 28 79 23 07 e8 13 a3 50 d3 47 f6 4e f2 de e9 f5 b4 87 10 df 24 49 76 08 e4 9d ff 88 cd a1 7e ef 0f 8b 02 6e 73 93 f6 9e 4a e4 f0 1d e5 54 75 59 21 6f c2 07 6a 7a b0 96 09 50 35 7c 40 9f 11 48 e0 54 75 a6 50 b1 62 21 54 85 eb ab 72 37 aa ac 2c 3c e9 75 c9 4f f4 98 e3 af 13 3f 9a 8d 9f 91 19 bf 4a f4 39 bb fe 9d e7 19 Data Ascii: M52)`ND.fwTzaA )=.\YZ')+/0{826u;<a<=eq;kDYI^`RnT=RTJlWp]5(y#PGN$Iv~nsJTuY!ojzP5\|@HTuPb!Tr7,<uO?J9
2024-10-24 07:16:21 UTC	1269	IN	Data Raw: e1 d4 e7 05 b9 67 4b 77 27 9d 2c cb b6 3c e3 38 d3 c9 7e ef 8f 39 4b c7 04 b4 45 78 02 58 44 ca 58 cd 4d a9 3d 07 21 19 8c ae 12 c9 23 bc 3a 89 82 8b 63 99 80 6c f6 71 e6 f5 63 7c 59 c2 03 7f 96 5c 8c d9 6a 40 f9 9a 0e f4 09 03 80 a1 80 94 3a a5 9c 53 28 1f 98 37 b8 ac 95 da 4e 32 74 88 8f 77 aa 49 6a e9 c9 41 f8 fa 80 66 0f c6 b5 3b 67 42 75 2a 76 96 39 28 83 7b 4b 24 22 ee 47 e7 9b 6f 9d 6e 99 ee 52 aa 24 10 46 85 9f f2 b1 0a 2a 7c 84 7c 48 08 a7 db cb 90 75 c8 36 84 48 76 5b d8 a7 16 70 94 c9 09 24 1e 82 9b 58 ea 02 8d e3 3d 3d d5 65 f7 14 00 37 40 1c 9d a7 22 0f 7b 97 e1 53 25 05 7e b0 94 2b b0 25 5b 8a 0b 98 48 76 99 ea fb e1 c3 af ef 9e 1f 32 0a 4d e1 90 38 2c c2 a1 0c 46 7c ab f0 c9 a2 6c 48 f6 4d 08 ac ae 11 61 b3 b4 55 db 0e 51 6d d9 3d 00 2b 20 Data Ascii: gKw',<8~9KExXDXM=!#:clqc\|Y\j@:S(7N2twIjAf;gBuv9({K$"GonR$F\|\|Hu6Hv[p$X==e7@"{S%~+%[Hv2M8,F\|lHMaUQm=+
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 5c d4 ef a9 5e d3 43 c8 38 1b 9d 73 ac 2e cc 88 98 21 f7 04 9e 31 26 c9 2e 88 2f 08 93 55 7c 3c f8 9d 94 ee dc 07 8a 45 8f 2b 72 8a d3 a1 f6 05 23 21 5f 45 39 1e fc 4e 04 6d 7e e9 8e 22 5c 00 1c 06 83 13 cc 9b 43 b9 38 b1 89 f8 e6 bf d7 e9 b7 bd 4f c0 ff 4f b8 89 54 ec 3f 05 67 1a 38 f9 a5 ed 4b 2f bb 3f bb d9 3d 1e 28 7a 92 a8 92 6c 3f 0b 17 21 37 51 e2 08 51 f2 90 dc 54 20 2a d8 96 90 28 2d 1f d7 43 3a cd 39 36 c6 e7 3c 24 d1 1d 1b 24 1b bb ff 00 2e 04 ff e2 96 d2 6d 64 ff e3 1a 37 9c 5e 49 77 a6 f4 e5 2c 67 b9 9c 63 a6 d7 dd 6e 96 7f b7 fc 8b e5 f4 b2 9d dd 62 78 1e 7e 99 3f 9d cc 3d bf 5f fa ca 38 1d 69 e1 0f b3 94 cd fb fd d1 ab ec 32 6b 51 91 14 e1 90 08 59 e1 79 ba a9 4d ca 7a d9 fe 58 47 47 18 66 89 2e cd b2 6b 80 25 d8 07 ce 82 ff 68 a9 1a b6 79 Data Ascii: \^C8s.!1&./U\|<E+r#!_E9Nm~"\C8OOT?g8K/?=(zl?!7QQT *(-C:96<$$.md7^Iw,gcnbx~?=_8i2kQYyMzXGGf.k%hy
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: cd 56 3b 6c e5 3b 5f 9a 6b ef ab 4f 5f 39 1c ae b1 af 7d 2d 0f 6f ff 28 1f dd ca 67 6e 7a 73 94 c3 b4 68 d9 6c d5 a9 08 d1 40 d8 4f 70 88 ec 28 d5 71 ba 33 5c 97 64 b9 43 26 fd 63 37 b1 39 3f 1b e5 74 e6 7b 90 08 46 92 a3 26 37 3a 4a 93 74 a6 15 56 80 a3 3f e5 80 c1 df 37 6f 67 c6 43 f4 24 98 e4 49 96 3e 19 72 26 5f e1 14 29 99 4a 9f e7 b3 ba a9 d3 3a ad ba e6 a4 de 31 1a 18 b3 91 21 33 c5 33 9b e4 14 e4 6a 1e 2b c7 ab 42 a5 a2 46 b5 06 35 9a d4 64 a3 b6 f6 6a 6f 56 17 37 ac c8 78 d2 54 b9 c9 04 72 4c a4 48 f3 8b 06 4b 4c 35 4a 7a f0 99 1e 7e 30 2f ff 58 9c 90 72 46 69 91 51 22 51 51 52 61 10 06 8b 98 04 c5 77 55 42 a2 92 90 96 9a 82 0c 6e 2b 85 ba ac b4 e4 67 a6 6c f7 95 c7 4a 75 3e 68 bc 70 45 88 56 34 ac 92 65 28 43 96 b2 64 2b 5b ae f2 14 aa 58 a9 ca Data Ascii: V;l;_kO_9}-o(gnzshl@Op(q3\dC&c79?t{F&7:JtV?7ogC$I>r&_)J:1!33j+BF5djoV7xTrLHKL5Jz~0/XrFiQ"QQRawUBn+glJu>hpEV4e(Cd+[X
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 2c 12 21 7b 02 61 84 91 bc 21 87 c7 df 6e 0c 30 b5 22 77 6e d0 bc 7e e9 b1 78 fb 49 b1 5a c3 8f 23 3f 6e ad 6d df 1f 1d ae 42 a3 fe e9 c1 db ff 7c 3f fc 4e 90 98 ab e7 30 e7 af f6 31 c3 13 ac aa e4 42 db 3f 19 4b d9 53 13 c4 bd 67 e3 6c d0 43 6c 87 ef 01 ce 47 fc 9f 0c 4d 0a cd 2d 5a a1 f1 8d ed c0 43 3d 07 e4 2c dc 5e dd 61 53 84 77 70 b7 e8 75 9e 9e 6b e8 df ae bf 7f 28 5e 65 b2 96 be 28 f1 3e ae ba 67 ea 66 25 63 3b 47 e1 20 d2 0d 7d 19 8b 0c 17 e3 91 60 27 b5 49 d5 07 95 04 d3 a3 2c bc 67 ba fd 67 a5 e3 11 8c 5e 41 74 c6 e1 e7 f8 d8 17 1f 77 04 67 f5 7a 21 9b f0 fc 25 d5 ee 77 9b 93 d2 09 05 c4 b6 8b e7 a5 8f a2 d3 75 7f 30 53 46 12 74 29 14 2f 49 f3 a4 9a 8e ae d2 bc 42 ba f7 0e 2b 60 1e 20 fc 47 5f b4 09 37 11 18 18 b0 b8 ae f1 ac fb 1d 57 cf 97 7a Data Ascii: ,!{a!n0"wn~xIZ#?nmB\|?N01B?KSglClGM-ZC=,^aSwpuk(^e(>gf%c;G }`'I,gg^Atwgz!%wu0SFt)/IB+` G_7Wz
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 1d ce 68 6a dc e3 70 35 37 d7 36 ef 5b 4f ed e0 8d a5 83 c4 ee b2 21 d2 1d b8 d0 ec 2d 1d c5 5d f0 79 48 3b 79 35 72 28 92 33 e5 74 9f 7a 28 2d 4b 57 a1 d2 b4 99 da b6 dc c6 8e dd 3c f8 10 bf 1f 91 68 db 96 be d5 7f ea 23 0d 71 66 ea a6 6a c9 51 47 25 8e 92 44 1c 25 84 48 e8 a8 24 49 e8 28 77 b4 f6 f1 dc c2 65 76 96 93 15 5d 65 4e d3 66 1e ff 62 d5 f6 87 dc 91 dd 41 4f 52 bf b9 4f 89 a9 7b 6e ff 56 f3 d4 fe fc 11 33 fe 90 09 c5 10 af 63 fb 29 0e be 41 62 d3 7d 6c 1e b8 77 cc 62 1f 36 77 fb c3 ef 53 df b9 0b 98 1b 8f 1b 4e 6d 3d b1 a3 9c cd 2d 96 76 23 d2 cb 1f d7 bd 57 92 29 28 c0 14 44 10 41 86 9c e3 d1 84 a9 9c 6e 66 72 4b 6d bb fa 81 b6 ab ff 1c 9d 04 00 c0 39 69 c9 56 fd b7 d4 13 b7 29 2e d5 d9 c1 1f 7a 7c ba 4d cf 56 e6 cc be 39 18 38 f7 9c b8 e7 23 Data Ascii: hjp576[O!-]yH;y5r(3tz(-KW<h#qfjQG%D%H$I(wev]eNfbAORO{nV3c)Ab}lwb6wSNm=-v#W)(DAnfrKm9iV).z\|MV98#
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: a4 52 25 8d 26 e9 74 fd 7b 7d c1 82 21 1d 8d 05 4b a6 74 36 f7 ad 5a fb d6 ed 7d db b6 53 8a 8a 39 ca ca 49 15 95 f2 aa aa 49 e5 a9 05 42 2c 12 3b 44 22 c5 0a a5 44 a7 57 64 30 8a 6d 76 ec 70 3a c4 e5 76 93 c7 2b f1 f9 1d 11 08 2a 0a 85 9d 12 89 e2 54 5a 92 c9 2a 2a 14 9d 50 2a 3b a2 52 75 5d ad 2e 6e 34 15 b5 da 6e d1 e9 ba 61 30 14 8f c6 68 32 95 ce e6 ec b3 73 d6 c5 25 ba ba 76 0d 00 3a 60 b1 84 ab b5 f4 e6 d3 b2 bd 14 10 fb 0a 70 05 5e 09 49 e3 55 d0 54 5e 0d 2b c7 6b e0 b9 bd 16 91 e0 75 c8 dc de 80 2e df 1b 31 e5 79 13 36 f9 9b 71 b9 bd 05 df 48 6f 25 24 7f 1b 31 b7 0e 83 44 d7 4d 25 49 34 8e 95 6c 2a 59 aa f1 54 99 5a bc 6c 0d 01 91 5b 55 a9 dd 50 4d 6e aa a5 b7 91 0d 54 54 96 a6 59 43 47 c7 4c ad 24 4b 3b cb d5 4b 0a 71 91 d8 b0 a7 43 f8 9c 94 50 Data Ascii: R%&t{}!Kt6Z}S9IIB,;D"DWd0mvp:v+TZP;Ru].n4na0h2s%v:`p^IUT^+ku.1y6qHo%$1DM%I4l*YTZl[UPMnTTYCGL$K;KqCP
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 45 a2 c6 bd 64 bd fb 29 4e 3a 2d ce 64 ea 59 e7 c8 85 02 b9 b3 53 53 2c da 46 47 5d 33 33 2d ab 56 39 d7 45 50 8b 8c 34 dd fa 11 21 31 05 21 2d 0d 21 3d 8b fe 38 8e f3 a6 5c 98 bc 62 2a 25 15 30 35 35 48 b5 0d 30 4d 4d 30 cd 6d 48 ed ed 0c 4f 92 ab a7 a8 a9 6e 7a a2 87 99 ea 65 27 fa b8 a9 7e 7e 62 40 40 be 8a 10 41 42 06 65 68 48 41 86 55 68 44 43 46 75 68 dc 84 26 6c 68 ca 85 66 7c 68 2e 84 16 62 68 29 85 96 33 64 25 c7 3e 28 90 d5 12 fb a8 42 d6 6b ec 93 06 d9 6c b1 3f 90 50 15 02 12 84 81 05 71 c0 11 44 83 16 c4 80 11 9e 0b ae 70 3c f0 84 e7 7b 32 27 a0 e4 85 d4 9c 02 2d 2f a2 e7 c4 cc 48 ca 8e b4 f1 d3 50 98 c6 e2 34 95 a6 99 ac 99 cb 1b 85 a2 09 80 06 04 9b 08 6a 60 b8 48 90 c8 08 5a 64 58 64 0c 2f 0a 22 32 41 16 4b 65 64 4a 55 ac d5 91 19 4d b1 d5 Data Ascii: Ed)N:-dYSS,FG]33-V9EP4!1!-!=8\b*%055H0MM0mHOnze'~~b@@ABehHAUhDCFuh&lhf\|h.bh)3d%>(Bkl?PqDp<{2'-/HP4j`HZdXd/"2AKedJUM
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: b6 f7 aa e6 5b 84 1a 0e 60 20 8d 8b 0e ad 49 b1 a5 6a 56 66 39 3a cc e3 16 3e a8 b0 62 5d 2b ab 5c f7 aa c2 eb 51 75 5f 7c bc 4c c7 7d 7e d1 e6 8b 79 d9 c2 37 0d 34 e5 db 66 9b 33 ac c5 56 8d 68 a3 9f c6 cc 95 db 3a 4c ee 70 d4 60 ca cc 06 56 b3 86 b5 fc c2 3a d6 b3 21 6c 6c 45 9b ec f1 c1 89 a9 cc d0 c9 19 cf c4 8d a3 0f b7 b8 cd 9d 70 b7 4d dc 9b 61 a2 89 58 66 64 5c 1f 09 1f 75 dd b0 a6 ec fe c7 e8 c8 e1 83 f8 b1 95 e7 94 3a 7a f9 fe 84 43 6f ed 08 14 3a fa f8 1a be 46 45 cd 1e a1 1f 8a 79 df be 81 a5 bc 79 6f 71 b9 87 96 a8 78 0e 54 f3 12 de b9 da ec 25 1a e9 dd 26 2c a5 5a 3c a8 68 49 cb 5a 11 31 5b fd bd ac 35 7b 11 00 05 f6 18 8d 25 90 28 40 4f 8c a7 36 fa 34 9b aa 67 1c 53 40 43 bc d0 18 61 47 c4 1f 98 cb 4a 40 e6 7d 31 04 19 df a6 33 d0 84 53 f3 Data Ascii: [` IjVf9:>b]+\Qu_\|L}~y74f3Vh:Lp`V:!llEpMaXfd\u:zCo:FEyyoqxT%&,Z<hIZ1[5{%(@O64gS@CaGJ@}13S

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.9	49818	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:21 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:21 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:21 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 11479f8e-d01e-00ad-32c9-20e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071621Z-r1755647c66f2zlraraf0y5hrs00000007ug000000005tfp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:21 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.9	49819	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:21 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:21 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:21 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 44b68622-401e-0067-4450-2309c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071621Z-r1755647c66l72xfkr6ug378ks000000087g0000000055qx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:21 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.9	49820	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:21 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:21 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:21 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 667d1099-601e-003e-17c9-203248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071621Z-r1755647c66lljn2k9s29ch9ts00000009d000000000429n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:21 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.9	49827	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:21 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:21 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:21 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: ef02ab36-401e-0064-3bb0-2054af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071621Z-r1755647c66zs9x4962sbyaz1w00000007r000000000040b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:21 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.9	49826	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:21 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:21 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:21 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 7898325b-901e-00ac-11c9-20b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071621Z-r1755647c66kv68zfmyfrbcqzg00000007xg000000003ea2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:21 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.9	49830	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:21 UTC	909	OUT	GET /assets/48a594e29497835802fe.woff2 HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://discord.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:22 UTC	962	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:22 GMT Content-Type: font/woff2 Content-Length: 179380 Connection: close CF-Ray: 8d782e55af17e52c-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "7cf1be7696bf689b97230262eade8ad8" Last-Modified: Fri, 06 Jan 2023 01:15:24 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EgvlnExRv49OpPQuKXlrJtOgjhttOE3ZGT1j06WlcVUrPGE%2FWsHkc94FzsfyFIGg%2FShocjbrZCto7xIBlN%2BeUUY8Y7V9ZGssv1nLDWFhnPxyM%2B%2BQxh5znnB7WaOt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:22 UTC	407	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 02 bc b4 00 0f 00 00 00 08 95 4c 00 02 bc 51 00 02 01 cb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 91 08 1b 84 de 46 1c 83 85 76 06 60 00 98 3a 11 08 0a 94 9e 24 90 9b 10 01 36 02 24 03 81 92 40 0b 81 92 44 00 04 20 05 8e 5a 07 83 c6 5c 0c 07 5b 6c 49 d7 01 3c 15 fb ed ed 72 73 b7 4a 08 99 9c a8 e3 48 80 48 cd 47 ca ac ff 4c 63 36 87 58 fe 07 c0 01 a2 a2 ed 32 e9 06 f8 8f 31 dc fb 9c 42 08 d3 dd 64 35 b2 61 96 8e 31 0c d8 00 14 ab f4 5f 28 05 44 c6 d8 26 76 84 ba 1e cc 2e 11 af 5b e0 95 04 51 3d e1 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff bb 4b fe 13 ea f4 fd 7f d2 ff 77 27 9f 2c 79 6c d9 60 0c 31 78 30 8c 59 61 85 11 42 02 85 50 68 9b d2 36 6d 0d 44 89 15 a2 10 6b 45 c5 42 60 9d 7a 47 34 91 92 a5 25 Data Ascii: wOF2LQFv`:$6$@D Z\[lI<rsJHHGLc6X21Bd5a1_(D&v.[Q=Kw',yl`1x0YaBPh6mDkEB`zG4%
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 4e db d6 8b 8a d3 16 b1 87 e1 88 b1 c7 75 69 40 05 27 9a 6d f5 b3 7e a3 64 fe 51 a2 13 76 70 42 76 a6 2b 70 c8 db 39 b2 6c 0f 1d f4 8b 53 62 b9 b3 73 25 05 b9 80 5e 32 0a e5 84 e4 dc da 5a 5d 95 7c 12 15 81 1d e1 b8 ed 3d 2c 15 15 a2 10 a8 40 e9 95 b5 9c aa 1a 5e e3 06 1d 35 92 c8 77 0c 36 f9 61 b7 32 d1 db b1 dd 9f 24 a4 bd 84 5b 76 b9 aa 41 95 15 73 47 a7 74 8e cf f2 89 0a 54 ee e8 4c ad 18 7e a1 f7 8c 88 48 34 b7 a3 26 23 98 92 b6 c0 5d d7 d7 c8 57 e7 e0 be 5d ec 56 92 04 09 0a a2 50 74 17 c4 a2 da aa 92 6f d6 59 15 d4 05 de e8 81 54 e9 e3 2f 96 9f 71 53 d3 93 a8 ba f4 63 a0 4f 28 3c ef cc 2d 27 50 a3 39 73 f0 fc 1d 2f e4 74 b1 d3 47 20 bf be 9a df f1 12 07 f7 b0 6f d6 88 df 62 84 c3 05 b9 38 33 17 5e 22 4b b6 fd 03 b9 83 dd 4a 2b 95 ec 7a 5e 32 78 8b Data Ascii: Nui@'m~dQvpBv+p9lSbs%^2Z]\|=,@^5w6a2$[vAsGtTL~H4&#]W]VPtoYT/qScO(<-'P9s/tG ob83^"KJ+z^2x
2024-10-24 07:16:22 UTC	1271	IN	Data Raw: 33 8a 1e 2b 8c 86 51 08 43 18 86 30 0c 6e 04 37 5c 1a ee b8 35 dc 70 0d 79 13 9d 26 74 94 da 64 c0 24 f9 65 d9 fe de 66 fa 79 39 dc 92 7b 21 a5 d5 ff 29 5a ac 6d 6c c3 a5 0b 34 80 28 1a 8c 34 c6 40 85 39 76 80 79 92 1d fb de aa 76 88 96 ae 69 1b 31 3d 31 df db 13 f3 5c 72 c9 25 b9 e4 62 5e 49 d3 26 15 0b a9 39 05 0a 5e c5 0b 14 e8 43 e9 17 5a f0 2f f0 e8 3f f6 68 81 87 81 75 3d df 41 68 42 fc f0 bd 91 b5 b3 d0 81 68 66 85 e2 55 b2 09 13 6b d1 d2 3f a2 21 d3 4d 6c 3a 43 fa 84 ea 9a ea dd 9e 09 1e 8a 58 83 46 29 c0 27 ec b9 f9 9f 5b 6a 7b bd a3 74 31 cb 10 d3 76 9b 83 7e fd 7f 92 a4 9b 24 49 92 24 49 92 24 c9 48 92 24 23 49 7a 49 92 b1 2f 9d 5f 92 ac 74 7e 59 49 3a bf 24 9d 5f 56 3a bf 64 ad ac 24 2b 59 59 49 46 92 24 63 25 49 92 8c 24 49 c6 c8 c0 bf cf 7e Data Ascii: 3+QC0n7\5py&td$efy9{!)Zml4(4@9vyvi1=1\r%b^I&9^CZ/?hu=AhBhfUk?!Ml:CXF)'[j{t1v~$I$I$H$#IzI/_t~YI:$_V:d$+YYIF$c%I$I~
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 9a c1 8d 15 87 80 6e 62 22 63 fd 8b 46 90 45 f8 eb 7e 34 96 50 18 63 54 11 81 78 30 69 bf 1c 15 4c 07 ab 0f b8 20 aa ba bd 32 0f c4 0f 86 40 40 d5 f9 c5 15 23 16 08 25 c5 05 b7 c8 3a 3e 29 ac 13 d0 c2 a9 3b e1 7d 06 84 cf 68 79 f8 77 af d3 43 ce 77 dd 8b 44 c8 e2 15 e9 cc 2f 6b a6 80 df c7 57 5a 8c ab 90 60 bc e7 ff 4c b5 4a fb b3 06 4b 00 eb 58 e2 9a a2 d6 89 bb e7 30 ba 35 b8 0d 12 6a 2f 48 18 6e 14 56 fd 42 b3 ab ba 08 12 e8 1e ce 75 37 64 48 70 0c cd 18 34 20 07 70 0c 21 52 6f 41 69 0d 75 96 3a 63 5d 24 80 e3 24 9e a1 d1 cc 5b 91 e7 24 9e f3 3e 72 26 3a 1f db ec a2 e4 82 f8 22 e7 c2 bd f0 d2 e4 82 ec a2 d0 f9 cc cf 7f af d3 7e 7b 05 71 22 08 24 92 ed 64 f0 54 7b 2a c9 34 4f e6 ff bd 99 56 fa ea 57 21 f9 e5 3d 3d 49 04 24 84 a9 36 ee 58 2e 11 c5 98 e2 Data Ascii: nb"cFE~4PcTx0iL 2@@#%:>);}hywCwD/kWZ`LJKX05j/HnVBu7dHp4 p!RoAiu:c]$$[$>r&:"~{q"$dT{*4OVW!==I$6X.
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: ea 06 0a a4 46 d2 15 ce b4 b6 37 b4 dd 81 ae 14 c6 a0 90 a2 c7 7f 50 04 d5 79 a8 ee 99 d6 34 1f 53 f8 fb ac 55 b9 c9 f2 34 82 6b 93 da ec f0 13 0d 8f 83 27 eb 30 f0 94 67 83 a9 0f 1e fb e9 2c 4b b7 d2 16 78 51 14 e7 e7 92 58 0e a5 fa 07 3b ec d4 41 d5 70 c8 de 83 d6 53 49 88 ba 8c e7 ed 4b 26 76 91 b7 10 21 06 33 98 61 58 b6 4c 51 a5 a8 af 3e 6b 66 55 44 e6 e3 95 af 24 11 42 08 61 84 10 c6 08 f7 1c c6 14 c6 88 a2 f0 18 63 8a da e3 bc 4d 03 b9 b3 c4 3e 9f 04 11 91 20 72 48 10 91 70 88 88 88 64 c8 5c f6 8e df b3 4c fd cf f7 fb ff 49 7a ec fe ec cd d4 18 a3 6a 54 c5 a8 aa 8a a8 aa 88 a8 65 89 8a 88 88 88 1a 3d e7 ed ff ba fc f3 73 cf d8 5b 48 46 5b 32 7d 44 e4 70 d3 30 24 93 78 b3 55 6d 14 e2 a7 fb 21 12 24 04 69 24 34 4d 23 8d 34 8d 04 69 44 82 34 43 08 22 Data Ascii: F7Py4SU4k'0g,KxQX;ApSIK&v!3aXLQ>kfUD$BacM> rHpd\LIzjTe=s[HF[2}Dp0$xUm!$i$4M#4iD4C"
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 7b e8 a2 50 0f 23 39 49 aa 53 b0 5d 12 d9 2e 2b e9 44 ea 40 4b 74 82 24 20 4a 62 d2 24 a5 48 0a aa a4 56 98 12 9b 55 2b 2b 67 74 63 d2 ad bf f9 55 b8 67 bb 77 1b ac 42 9d ce 56 c2 66 1f 91 83 0c bc 30 bc 75 02 ad 1f 8f bd 6f 46 a7 d4 0d 48 42 2c 5b cf 46 12 2b a1 62 6d 78 a9 2d 71 4f 69 94 aa 88 36 1d 31 ea 6d 7c f0 29 3e f9 16 53 7e c6 ef f8 1b 42 ec 02 32 e2 cc 34 ab 98 4d ca 49 c9 3d a2 97 a0 0a 97 d8 ba c4 ce 65 f6 ad 3e bd ac d3 5c 35 cd 53 d3 fb d3 f3 9a 97 d6 f4 f2 da 5e 5d c7 6b 1b 8e f7 df 53 c5 3b 4c 3b b0 86 f7 36 e5 a3 2d bd 7c b5 b5 5d 58 e1 fb 6d fa 69 ab ff b9 8e 4f 25 35 19 74 04 0a f4 96 9a f5 b9 07 e7 e6 d6 8d 83 3a bd 26 20 f1 0e 85 d4 04 79 32 b5 2a 74 2a fd 64 f4 9e 78 8c fb 72 8f 15 9e e8 bd 36 78 e3 54 7c 96 31 b2 ae c9 7e 7d af 3c Data Ascii: {P#9IS].+D@Kt$ Jb$HVU++gtcUgwBVf0uoFHB,[F+bmx-qOi61m\|)>S~B24MI=e>\5S^]kS;L;6-\|]XmiO%5t:& y2tdxr6xT\|1~}<
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: c7 c0 0a ab 7f 6a 6e e2 a0 8d 37 9d 6b 3c f3 f0 a5 e1 6b bf d6 b7 23 83 7d 36 f7 39 f0 63 e8 ae d4 7c fb 57 6a 95 f6 a1 64 9f aa 87 84 71 fb d2 e7 b4 c6 79 ee ce c1 dd be 94 f8 19 30 c8 e4 f7 4a fd 9a de 7f d8 39 99 12 d1 3f e0 48 ef b4 b6 d3 9a 79 1e 2b d5 1c 91 b6 eb 51 c9 7c b0 1b 15 c0 69 99 30 4f 60 32 7f da 47 b2 d5 74 52 7f 10 fb 0e 01 b6 be e9 32 21 96 a1 b8 40 0c ce 07 49 db a0 87 28 fb 7b 76 74 d7 fb c8 85 31 a8 f9 82 6f b0 97 29 8f f4 9e 26 fc 4d 4b 56 f9 4c 5e 12 97 1d 1d ff 44 dd 72 7a bf 82 c9 21 dd af 1b ef 41 44 ee 8d d5 3a 58 52 fb 09 4a 5f f4 80 b7 2c 76 8e 2b 11 19 05 13 3a 7d 33 2f 38 d5 59 d7 6f 7d ff 23 d9 dc c7 24 a5 34 8e bd f5 d4 7f a1 3e 23 b6 5a 57 b1 e5 17 f1 8d 9d f1 e9 91 81 8b a2 50 fa ad dc ca 1a 31 a7 c3 33 dd 65 e0 ae 1a Data Ascii: jn7k<k#}69c\|Wjdqy0J9?Hy+Q\|i0O`2GtR2!@I({vt1o)&MKVL^Drz!AD:XRJ_,v+:}3/8Yo}#$4>#ZWP13e
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 13 9b 55 e9 9c f3 2e b8 e8 92 cb 70 f0 ee 09 14 84 82 8a 86 2e 0d 43 3a 26 16 36 8e 8c 00 ed 3f 27 00 7c 19 08 9f 1b 2c e0 35 0d 81 95 19 04 30 01 4d e7 13 4e 70 df f7 09 19 5e df 8f 69 c2 4c 6e 1b 09 80 9b 23 72 a7 64 22 dc 94 98 89 88 88 89 98 99 88 e8 bb 42 90 6a 1a 99 85 87 92 c5 33 51 e0 73 7b c9 2c 15 b6 8f c7 1a ab ac f8 66 f8 44 be c7 92 5f d1 01 b4 35 79 34 c9 b1 5f d4 74 a9 71 20 9e 8a 94 36 94 c8 53 e7 d0 1f 56 bf c3 84 10 9a d4 a1 09 db 5c fa 14 d0 27 b0 d3 72 c3 96 28 b5 75 aa 22 63 fe bd 07 14 17 13 1e f6 ad 32 38 64 b0 b9 4e 6e 8d 74 2c b9 93 07 4f 5e bc f9 f0 75 dc 09 27 9d 7a ef 74 83 ce e0 65 b8 d4 77 85 3d e9 66 27 59 54 06 87 0c 36 95 dc 1c 3b c0 85 f8 dc f8 69 f3 6b 42 7f d2 53 f4 b7 5a 13 32 d8 1c 60 f2 1a ce 90 cb a1 a4 52 ae 82 96 Data Ascii: U.p.C:&6?'\|,50MNp^iLn#rd"Bj3Qs{,fD_5y4_tq 6SV\'r(u"c28dNnt,O^u'ztew=f'YT6;ikBSZ2`R
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 05 da 2e cd d9 0e 59 9e 76 29 8a b2 47 55 b8 bd ea 02 ec d3 64 e7 2d 5d ce de d6 17 ee 90 59 ce 8e 5a a6 77 cc ba 81 be 61 53 a4 f7 6c 0b f0 be 5d 9e 3e 70 c8 d9 87 8e d9 39 85 cb ce 69 7c 81 3e 26 16 e8 2c 39 bd 0b d4 da fb 11 23 a3 2b 40 b6 ae 82 79 b8 06 e5 e2 16 96 8b 7b 9c b4 6e f1 d2 aa 11 64 74 5f 98 bb 07 a2 b4 ee 8a 73 f1 a5 24 5b 5f cb b3 f5 48 91 af c7 aa 7c 7d ab 49 ab 5e 97 87 1f f4 f5 f4 27 43 46 bf 58 72 f5 2b c8 d7 73 58 4f 7f 45 b9 f8 03 e7 ee 2f b3 00 2f ac 8c 5e 92 4c 5e d1 6c bc 66 99 fc cd b3 f1 8f c8 e4 5f 99 8d ff 94 b7 55 e9 f7 8f 9d 07 c0 4f 93 15 b8 b4 59 89 47 97 2d 70 e9 b3 06 8f 39 f3 bc 3d 11 24 2f f7 70 0f 21 81 47 28 89 3c 43 48 7a 23 ce 3b 20 84 1f 14 23 08 09 10 47 79 49 e3 c0 27 a1 c1 37 69 87 4a 09 f3 4f 2b 0b cc aa 08 Data Ascii: .Yv)GUd-]YZwaSl]>p9i\|>&,9#+@y{ndt_s$[_H\|}I^'CFXr+sXOE//^L^lf_UOYG-p9=$/p!G(<CHz#; #GyI'7iJO+
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 37 21 07 8b 6e 0e df 30 8a 79 0c 66 db 57 cd 7c 7a ca be 37 08 f3 58 cb d6 8a f9 f3 29 95 2d 94 39 75 62 7e e7 b5 73 fa 4d f6 bc de dc 79 1d fa b8 58 ac 2b fc 08 52 68 b6 7d b4 e2 3c 9d be a6 88 11 84 82 58 d8 54 5c 61 db 77 01 ed 32 1b ed a2 14 5a 22 d5 74 91 56 21 b4 22 85 96 42 cf e6 1c d4 8f 02 1a 3e d0 36 4c df 25 74 86 39 e1 c3 e5 d8 cb 61 f3 7c a6 a1 12 06 5d 84 b6 8b 8f 48 7e 4e 27 5f 67 2b af 44 86 a7 4b 04 67 ba 76 72 bd 9f 32 b9 81 ed c7 55 e6 e7 3b ec 84 93 a1 73 73 f9 8c db fc 2d 14 6e fc e9 38 b5 70 9f 3f 6a e5 a1 3c 41 65 b8 f9 e6 42 2c 25 93 27 95 68 85 4e 6c 0b ff 95 74 de 24 67 bf 55 42 8b 58 a2 fd fd 59 71 16 a0 85 0c d2 c9 20 9d 0c d2 69 f6 6e 65 8c cc c0 70 04 06 0c 3b 30 d3 15 10 8c 3d bb 44 0a 09 07 c9 12 3b 6d ff 54 e0 5c a8 d6 bb Data Ascii: 7!n0yfW\|z7X)-9ub~sMyX+Rh}<XT\aw2Z"tV!"B>6L%t9a\|]H~N'_g+DKgvr2U;ss-n8p?j<AeB,%'hNlt$gUBXYq inep;0=D;mT\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.9	49828	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:21 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-24 07:16:22 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=34204 Date: Thu, 24 Oct 2024 07:16:22 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-24 07:16:22 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.9	49831	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:22 UTC	909	OUT	GET /assets/f5b8aa3411dfc24ff2e6.woff2 HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://discord.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:22 UTC	960	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:22 GMT Content-Type: font/woff2 Content-Length: 137140 Connection: close CF-Ray: 8d782e57df8a6b91-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "f9bf0f65660d23c6f359d22720fc55ae" Last-Modified: Fri, 06 Jan 2023 01:15:24 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e3t0z%2BXVJNFA0OpQiQGmx1ns5B2OTH9aqUnPYPSvbodW%2BKkt83gBbxs%2F%2Fclsx5rxAaRMoqNEtCQr2H3jh69P22qfk0j75DjLpEiW5e4R9hccw5dWCLOcc74dQS9B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:22 UTC	409	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 02 17 b4 00 0f 00 00 00 06 30 cc 00 02 17 55 00 02 01 cb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 8b 66 1b 84 bd 1a 1c d3 04 06 60 00 95 1a 11 08 0a 8e fc 24 8c 87 55 01 36 02 24 03 f3 54 0b f3 58 00 04 20 05 8b 14 07 82 bd 5b 0c 07 5b 9e 3b b5 0f fe 9b 8c fd 77 db 4e ad 83 0c c8 a5 5a 6a 55 00 00 95 5d 22 de 75 91 12 24 0f 6b b7 d9 3c f8 97 31 d6 db e0 33 40 69 96 9d 1d 36 0e 49 d7 a5 58 99 f1 af 1e c1 c9 d8 40 79 64 66 e7 68 23 cf 0a 15 d7 e7 1b fe ff ff ff ff ff ff ff ff ff ff ff 7b 49 7e 3c 3a f5 dd 49 ba fb 43 5f 0b 90 c4 b2 01 01 06 03 c6 23 f1 ae 5d 37 69 e3 c4 71 5b 08 2b 50 46 8c 55 e2 c4 c0 78 ef 1d 1c 9c a6 10 18 31 2e 18 62 05 ea 33 31 56 61 a8 98 bc c8 61 42 89 ca e4 ae d7 1f a0 6e d8 56 d8 a1 Data Ascii: wOF20Uf`$U6$TX [[;wNZjU]"u$k<13@i6IX@ydfh#{I~<:IC_#]7iq[+PFUx1.b31VaaBnV
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: c1 2d b9 63 dc bd 9f 08 0e 07 58 3c 3c 92 b4 b5 b0 d4 40 91 51 3d e7 db de 04 f3 eb cd a8 ec fa 3a a4 12 c3 1d 2b f1 ed 8a c9 14 46 b1 cf 7a e8 a5 95 4b da 13 59 85 e7 7b 74 a4 2e 7b c7 2a b3 70 7f b0 22 b1 49 0c 8f ec dd 0b e9 4d eb 58 7c 74 17 dd fb 1e a3 9a b7 c8 88 7d 8d ef cf d8 de e8 94 6e 6b 34 32 8b e6 12 53 5c 91 1e b9 1b b4 24 48 bb 19 c6 30 8a ff 9a 6d c7 05 ab 09 fc 0b 23 66 3e 45 55 11 fb 2d 7a cd 6b 7c fe b5 20 0f 85 59 17 27 e5 f4 3b 3c 3f 97 f8 e7 ec df 0f dc 53 82 43 ff 1f d9 8c 15 9b c9 8f f5 e9 96 b4 fc 05 1c a7 10 0c 98 77 65 55 22 df b2 c7 9f f9 45 53 ed 32 04 3e e5 25 f6 bb 1a 4f 8d d2 ba 71 f3 a2 40 83 d2 a9 bb 85 46 18 e6 ce 30 e6 97 61 52 a8 46 7c 5b 61 dd 97 12 56 71 fa 8c c6 7a 7c 48 51 5f 6d 2d 6a 81 33 78 31 d5 91 58 58 db 95 Data Ascii: -cX<<@Q=:+FzKY{t.{*p"IMX\|t}nk42S\$H0m#f>EU-zk\| Y';<?SCweU"ES2>%Oq@F0aRF\|[aVqz\|HQ_m-j3x1XX
2024-10-24 07:16:22 UTC	1262	IN	Data Raw: 9e 7c cc cc 47 b0 d5 ab 4a c7 13 ea 9e ba 36 04 28 6a 13 bc 05 10 cd e4 e3 6a bc a8 53 85 ff f8 fd fe f7 fe 9b 99 7b ae ad 7d ad 7d 71 4c 92 99 37 4a 20 45 32 8d 92 20 d1 5d 4b 60 62 bf 87 89 77 d3 c4 11 1a 09 7f e6 f6 c5 11 f7 64 da 88 e4 c5 d5 dd 4a 30 e2 df 5b 3a c9 bc 29 6c 3f 75 42 0b 52 04 af cf c8 fd 64 47 d3 6e 28 e4 25 94 45 39 e4 a9 f6 90 06 e1 c1 53 a4 d1 22 17 ae 4f 60 94 d4 05 15 19 9a 76 3c 96 0c 47 01 e7 6c e3 cc 4e 68 fd ef f7 0b b5 90 69 84 f2 f3 cb 37 72 36 2f 92 36 0f 62 83 a4 41 6c f0 77 16 31 a6 83 19 0d 67 69 40 10 80 ea f4 f3 ca 40 39 55 4d 17 16 1d 8b e4 2f 75 fa 61 4c c7 de ca 14 64 0f ce 24 9f 22 44 89 06 8b 3f fa a7 fa f6 e7 b6 d9 e9 7d cc df 52 ea b0 49 e9 fd e6 d2 97 e1 fb b0 d3 aa 05 16 58 e9 8f b3 c0 ba 52 2d 90 40 86 23 fe Data Ascii: \|GJ6(jjS{}}qL7J E2 ]K`bwdJ0[:)l?uBRdGn(%E9S"O`v<GlNhi7r6/6bAlw1gi@@9UM/uaLd$"D?}RIXR-@#
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: fb cd 73 f7 cc 9b e7 99 4d b9 c3 c6 78 da d3 3d a7 e3 1e 2f 0b ff d1 cc 2a ea 88 3f 67 26 51 cc 5e 16 40 ac 3b e5 3d 2a 9e 4d f4 6b 40 95 50 4f 11 b4 45 01 25 04 d5 8d 0f d4 9a fd ee f9 8b 30 b0 6e ca b3 88 9b dc 62 6c fa 5e 67 75 fd 1f b9 3d 02 3c d3 a2 27 e1 49 db 9d 35 29 dd 43 62 43 88 a7 ad 39 6e fc 7c 49 d6 13 22 c8 92 00 11 fb 3b 6b a0 c3 b7 e4 20 0b ec 46 d2 07 94 60 bf a2 83 84 23 d3 21 62 8c db 09 f7 0a 01 46 a4 1e 8c c0 29 e0 ce d8 1d c0 93 1c 6a 45 e8 2d 52 bb 48 dd 4b 87 cc 04 4f ce 87 63 df 8e 7b 9c 10 3d bd f9 ba c7 c3 1c f7 72 9c e3 1e 8e 93 c2 7d 3a 3f db 9d 2f cd 9d f4 4f 7a 1f 36 44 0e 42 df 59 33 b3 2b af a5 b1 3f e9 c0 8a 42 0e f9 7e 98 e4 43 a8 02 45 93 3a 45 77 2f 15 56 48 98 4e c4 01 0f 07 b9 75 52 29 9a 96 50 ec 86 cd ff 34 35 5b Data Ascii: sMx=/?g&Q^@;=Mk@POE%0nbl^gu=<'I5)CbC9n\|I";k F`#!bF)jE-RHKOc{=r}:?/Oz6DBY3+?B~CE:Ew/VHNuR)P45[
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 2d 15 df b2 08 2c 87 d0 f2 89 ae d0 cd 95 bb b7 4a 0f 57 ed c9 6a 3d db 58 e2 ab 7f 4a 92 f1 ee c0 f2 8b af b5 36 d9 96 43 ee 38 e5 7e ce 79 d8 a6 80 23 d0 c0 69 30 1d 06 db 31 09 9e c0 8d 13 b9 75 52 0f 4f e3 c5 c5 7b 7d c9 24 b4 92 36 44 c3 a8 8f c6 7d b6 83 b3 d3 7c f5 13 64 10 a4 28 71 c6 49 30 41 a2 89 92 4d 81 37 5d a6 d9 f2 2d 53 6f bd 26 5b f5 3a 15 a2 33 1d df fa 6a 69 ab 81 0e 18 ef 24 52 49 16 ba 64 bd e9 e6 b4 df 70 23 94 73 27 db 79 0e af 60 14 f6 e5 91 ae e5 d6 31 44 ff fe b2 66 f4 9a d5 de 00 7a 53 6c b5 fa bd d5 a7 a1 33 9f e6 db 07 7e 79 43 9e 3a 7f 24 7d c2 51 78 72 c1 b7 9e f9 c6 2b 63 79 bb 67 d5 fe 10 c7 c2 9d 0c 83 2d e0 f6 b7 2e 80 65 7f 07 90 ac 5a 29 6a aa 3c 22 52 5a e4 8d 9a 93 09 38 a2 75 34 c4 dc eb 65 03 1b de e9 3b b0 83 60 Data Ascii: -,JWj=XJ6C8~y#i01uRO{}$6D}\|d(qI0AM7]-So&[:3ji$RIdp#s'y`1DfzSl3~yC:$}Qxr+cyg-.eZ)j<"RZ8u4e;`
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: c2 25 e3 74 87 75 3a cd 74 35 4d 87 bf dd 9e dd 36 ea 76 87 f7 fc d8 4d c5 3b 82 9b 7b 73 b0 ed 8b ee 8c ca 64 bc cf c5 8d 0f 16 08 59 dd e3 63 bc 95 1e 49 3b 0d f3 e4 5c 4e 68 5f 3d b5 87 6e 7b 7a 96 e7 13 d3 7f ba 98 c8 26 3a e2 3f 02 33 46 5e 26 30 e4 88 ed a5 8f 23 b7 87 bb e7 a6 db d9 7f 50 95 f3 63 7d ed dd 27 80 5c 25 a9 21 bf aa 18 fd ba 11 51 dd 23 f2 e7 73 e7 97 3b f3 cf e2 a7 28 19 3b f3 4d ee 94 97 6a b4 43 d9 9c 78 55 01 e9 f7 b5 d3 6b 86 63 d8 62 f8 ac 8c 07 19 e9 9b 9a d1 c6 1e 41 b8 79 b6 aa 75 fd 93 61 3d de 67 3a 58 ac e4 74 90 b2 f8 a9 2b 8c a0 6a 87 c3 48 94 e1 9b 10 79 60 ca 43 a6 b6 5e b4 04 ef ed 88 bf 05 32 54 30 ff 7f f0 c5 b3 4b b6 6f 77 ef 07 28 07 f5 07 b3 fe e1 6d cc b7 95 1f 78 7b e7 22 5e b9 0f 6b f9 33 d8 d6 9c f8 e0 d1 c5 Data Ascii: %tu:t5M6vM;{sdYcI;\Nh_=n{z&:?3F^&0#Pc}'\%!Q#s;(;MjCxUkcbAyua=g:Xt+jHy`C^2T0Kow(mx{"^k3
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: de e3 a2 44 db 75 a0 e4 50 5a ae 54 23 55 1f 8d 89 05 b1 b6 66 3a 8d 66 a9 5b 95 01 9e 85 02 60 2f 48 9a a4 c9 ba c8 17 08 10 52 78 60 4c 45 e5 95 7c 35 79 ad dc 0c 6d 03 00 00 bc 89 c4 72 c6 8e 87 76 d2 aa 0c 43 39 5b 7e d1 38 90 cf 0a 8b d3 a7 75 b3 5e c5 7d db 00 a2 7e 22 ed 0b a1 71 a0 39 a2 e9 5a 44 69 61 12 fa 75 d4 fa f5 e1 5e ee 25 46 38 0e f6 94 40 ee e9 09 67 2e 37 4d d3 b3 f6 37 e3 ad f6 5b f4 a2 51 e4 8a 5a a2 87 97 b5 c0 4d 44 4d 12 d0 e5 0d 21 5c 5f 2f f9 73 3d ca 23 d8 c8 83 fb 90 b5 9a 97 7c 93 e1 e7 34 5d 65 3b 4d 47 b5 aa 57 98 c7 97 f3 70 b7 68 bf 99 7d ab 94 5b 6d ef 07 e7 ee 04 f4 fc 33 21 38 58 b7 59 fe b7 8a 99 86 52 5a cd 1c 29 76 0e 33 67 c7 93 e7 3e 95 19 cf 3b 35 71 7e 46 8b 03 61 7c b3 ec 36 ba e8 f3 03 87 57 5c 9e 95 e8 19 6a Data Ascii: DuPZT#Uf:f[`/HRx`LE\|5ymrvC9[~8u^}~"q9ZDiau^%F8@g.7M7[QZMDM!\_/s=#\|4]e;MGWph}[m3!8XYRZ)v3g>;5q~Fa\|6W\j
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 1b 63 2c 92 71 e3 85 19 6f b2 10 13 4c 15 6c a2 e9 1a cd 98 29 c3 ac d9 82 4c b1 2a 92 39 af 57 62 35 a0 30 6f 81 ab b1 16 52 b5 75 d0 32 ac 87 55 6a 03 bc 20 ef 23 aa b2 09 59 90 8f d0 55 d8 8a a9 dc 36 6c 21 a6 e2 0a 32 0d 5f bd 9d 84 42 cc 20 16 64 16 b9 10 b3 29 05 99 43 2d c4 5c 5a 41 e6 33 92 3a c0 4c e2 20 ab 68 47 85 49 9d 10 45 76 52 1c d5 69 69 31 ee 91 17 e5 5e 45 12 f7 29 c3 ba 5f 1d d9 03 9a a2 9c d7 8d ec 41 c3 30 2e 1b 57 e4 61 93 a2 5d 31 4d e2 11 b3 a8 1e b3 88 ec 71 cb b0 9e b2 09 eb 69 f5 ad f3 ac c6 d6 79 4e 73 bd 6b 5a db e7 ba 8e 26 dd d0 d5 a4 d7 f4 37 e7 4d c3 e1 3b 23 ed 74 db 68 f8 d1 78 3b bd 6b a2 59 ef 99 0c bf 98 6a ce 1d d3 75 3e 32 5b e7 63 a4 96 7d 6a be 65 9f 59 0c 59 96 9b f4 a5 95 76 fa ca 6a 93 fe 63 b3 69 ff b5 dd b2 Data Ascii: c,qoLl)L*9Wb50oRu2Uj #YU6l!2_B d)C-\ZA3:L hGIEvRii1^E)_A0.Wa]1MqiyNskZ&7M;#thx;kYju>2[c}jeYYvjci
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: fb 4a 6a c1 da be 91 5a b2 b6 9d d1 88 99 49 50 82 62 25 56 58 c2 18 3a 14 50 10 50 38 d5 12 6b 01 c8 5e 0a 9c 66 6a 14 75 2d 87 ea 43 aa 24 a4 4a 41 e9 5c 24 45 24 45 24 45 a6 1e 47 2d 8d 2a a0 19 f1 f0 54 c3 27 20 50 83 90 88 48 2d 62 12 12 29 a4 64 64 5c 80 9e 0d 0f 96 0d cb 36 fb 69 d5 12 e9 0e aa 7a fa 6a 60 a8 46 c6 de 0e f8 84 69 a9 91 37 1e 30 a1 33 48 3b 46 74 7f 12 36 09 6b 47 c2 24 49 db 28 62 12 66 0e 47 12 b2 49 58 35 49 40 c3 a1 10 49 82 62 45 d7 49 fb 64 13 26 8a b8 1e 8e c1 22 18 79 b1 c7 79 d7 ca b2 30 8a 58 18 f2 59 64 0a 96 57 19 36 0b 96 23 5c 30 9f f0 19 6c 26 a3 88 6c 84 0b 16 2e 38 dc 29 b8 e9 c7 b9 0e 0a 77 28 12 e9 0c 0e ca 3e cb 05 bd 38 c1 05 03 c7 45 31 29 9e 70 2d 9e a7 5b 4b 9e 6b cd bb d6 da ee c5 91 7a 31 2c b1 7e aa e7 f8 Data Ascii: JjZIPb%VX:PP8k^fju-C$JA\$E$E$EG-*T' PH-b)dd\6izj`Fi703H;Ft6kG$I(bfGIX5I@IbEId&"yy0XYdW6#\0l&l.8)w(>8E1)p-[Kkz1,~
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 6b af 19 ad 83 40 40 a0 20 d4 06 32 29 3b 6b 10 53 b4 8b 06 37 79 4c d5 b6 a9 43 ac 16 55 b6 98 96 3d 35 9d 98 4d db e7 0c 2b cb 2c c2 1f d6 8b 10 fe 98 c0 63 f4 55 1c f2 e5 df 7e 1b dc 97 ff fa 34 c8 b7 ff d4 42 90 ef 3e c5 32 e4 87 ff 09 90 1f ef fc cf 92 cf 79 32 ff a5 a6 bf fd 98 de e4 f7 74 29 8e fe c2 c0 30 48 19 2b 00 70 08 54 27 15 06 07 39 51 01 90 da a4 c6 75 63 7c 11 68 c4 56 c0 78 fc a0 6b 04 9e 85 17 3b cf bd 23 bf 1c 78 fb 5d e2 e5 71 90 80 4d e8 74 e8 13 f1 13 0e 92 c2 87 a2 18 dc f1 f6 cc 09 cf 8e 8b 0e 5e 02 16 0a 82 d2 84 81 8f 10 27 45 96 02 65 ae 5e 53 78 53 37 1d b4 f4 04 7c 10 96 1a 91 fb 62 79 cd f2 09 fc d8 1e 2c 8c 5d 32 e1 8f 82 28 0c 07 f1 40 6d a9 92 29 84 26 af 88 bd 03 bc b1 cd 0a 7d 52 25 a5 74 60 c4 e2 f6 2a 2e bc 5d 40 d0 Data Ascii: k@@ 2);kS7yLCU=5M+,cU~4B>2y2t)0H+pT'9Quc\|hVxk;#x]qMt^'Ee^SxS7\|by,]2(@m)&}R%t`*.]@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.9	49835	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:22 UTC	1638	OUT	GET /api/v9/experiments?with_guild_experiments=true HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Super-Properties: eyJvcyI6IldpbmRvd3MiLCJicm93c2VyIjoiQ2hyb21lIiwiZGV2aWNlIjoiIiwic3lzdGVtX2xvY2FsZSI6ImVuLVVTIiwiYnJvd3Nlcl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2IiwiYnJvd3Nlcl92ZXJzaW9uIjoiMTE3LjAuMC4wIiwib3NfdmVyc2lvbiI6IjEwIiwicmVmZXJyZXIiOiIiLCJyZWZlcnJpbmdfZG9tYWluIjoiIiwicmVmZXJyZXJfY3VycmVudCI6IiIsInJlZmVycmluZ19kb21haW5fY3VycmVudCI6IiIsInJlbGVhc2VfY2hhbm5lbCI6InN0YWJsZSIsImNsaWVudF9idWlsZF9udW1iZXIiOjMzODU0MCwiY2xpZW50X2V2ZW50X3NvdXJjZSI6bnVsbH0= X-Context-Properties: eyJsb2NhdGlvbiI6IkFjY2VwdCBJbnZpdGUgUGFnZSJ9 X-Debug-Options: bugReporterEnabled sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Discord-Timezone: America/New_York X-Discord-Locale: en-US sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:22 UTC	774	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:22 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=31536000; includeSubDomains; preload vary: Accept-Encoding via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: BYPASS Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QJbNculDmR6hbO9L9CL2C3uFhKU7bsGF%2BIUpIaOj9F5oFFJIgObqfakYMkyURM%2BXCjm4R9CrK5bmcY9H36Jph6SzKv1L2%2FkZzDx9rkZ%2BkZR%2FT8vzWaoKMcrXRCNa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Server: cloudflare CF-RAY: 8d782e58bc72e9b1-DFW
2024-10-24 07:16:22 UTC	595	IN	Data Raw: 37 63 39 64 0d 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 31 32 39 38 39 30 37 39 32 38 31 31 35 32 38 31 39 34 30 2e 63 41 59 6b 4d 74 33 50 78 32 32 58 59 42 75 62 35 71 31 6d 79 46 56 6e 39 65 73 22 2c 22 61 73 73 69 67 6e 6d 65 6e 74 73 22 3a 5b 5b 32 38 31 30 32 30 35 34 38 37 2c 31 2c 31 2c 2d 31 2c 33 2c 37 39 35 39 2c 30 2c 30 5d 2c 5b 32 36 31 37 32 31 38 34 34 34 2c 34 2c 31 2c 2d 31 2c 32 2c 39 32 33 39 2c 30 2c 30 5d 2c 5b 33 30 33 35 36 37 34 37 36 37 2c 30 2c 31 2c 2d 31 2c 30 2c 38 33 38 30 2c 30 2c 30 5d 2c 5b 31 36 30 39 37 38 32 31 35 31 2c 30 2c 31 2c 2d 31 2c 32 2c 34 32 37 32 2c 30 2c 30 5d 2c 5b 33 36 34 33 33 36 32 37 35 31 2c 30 2c 31 2c 2d 31 2c 30 2c 37 32 31 2c 30 2c 30 5d 2c 5b 33 37 35 33 30 33 34 34 36 36 2c 31 2c 32 Data Ascii: 7c9d{"fingerprint":"1298907928115281940.cAYkMt3Px22XYBub5q1myFVn9es","assignments":[[2810205487,1,1,-1,3,7959,0,0],[2617218444,4,1,-1,2,9239,0,0],[3035674767,0,1,-1,0,8380,0,0],[1609782151,0,1,-1,2,4272,0,0],[3643362751,0,1,-1,0,721,0,0],[3753034466,1,2
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 31 2c 2d 31 2c 30 2c 39 32 32 30 2c 30 2c 30 5d 2c 5b 33 35 35 37 34 38 30 37 31 32 2c 30 2c 31 2c 2d 31 2c 30 2c 35 34 33 39 2c 30 2c 30 5d 2c 5b 38 35 33 34 30 33 31 33 33 2c 34 2c 31 2c 2d 31 2c 30 2c 33 35 33 35 2c 30 2c 30 5d 2c 5b 32 34 39 31 30 30 35 30 31 39 2c 34 2c 31 2c 2d 31 2c 30 2c 34 31 34 31 2c 30 2c 30 5d 2c 5b 33 38 38 39 30 37 37 38 30 34 2c 32 2c 31 2c 2d 31 2c 30 2c 36 33 31 34 2c 30 2c 30 5d 2c 5b 34 30 37 39 32 31 34 33 31 39 2c 32 2c 31 2c 2d 31 2c 30 2c 31 31 35 30 2c 30 2c 30 5d 2c 5b 31 35 33 32 32 38 30 35 34 38 2c 31 36 2c 31 2c 2d 31 2c 35 2c 33 33 36 33 2c 30 2c 30 5d 2c 5b 31 30 39 35 37 37 39 31 35 34 2c 30 2c 31 2c 2d 31 2c 34 2c 34 32 38 34 2c 30 2c 30 5d 2c 5b 31 33 39 38 30 30 37 38 33 39 2c 30 2c 31 2c 2d 31 2c 32 2c Data Ascii: 1,-1,0,9220,0,0],[3557480712,0,1,-1,0,5439,0,0],[853403133,4,1,-1,0,3535,0,0],[2491005019,4,1,-1,0,4141,0,0],[3889077804,2,1,-1,0,6314,0,0],[4079214319,2,1,-1,0,1150,0,0],[1532280548,16,1,-1,5,3363,0,0],[1095779154,0,1,-1,4,4284,0,0],[1398007839,0,1,-1,2,
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 37 31 36 36 35 36 35 31 2c 30 2c 31 2c 2d 31 2c 31 2c 32 33 33 36 2c 30 2c 30 5d 2c 5b 33 37 33 35 33 31 31 35 36 2c 30 2c 33 2c 2d 31 2c 30 2c 38 33 37 31 2c 30 2c 30 5d 2c 5b 32 34 32 39 32 31 36 30 35 39 2c 30 2c 31 2c 2d 31 2c 30 2c 37 38 34 38 2c 30 2c 30 5d 2c 5b 31 36 31 37 37 34 39 37 34 33 2c 30 2c 31 2c 2d 31 2c 30 2c 33 37 35 38 2c 30 2c 30 5d 2c 5b 32 39 33 37 33 32 39 39 31 30 2c 31 2c 31 2c 2d 31 2c 32 2c 35 37 33 35 2c 30 2c 30 5d 2c 5b 32 38 38 39 36 38 37 30 36 2c 30 2c 31 2c 2d 31 2c 33 2c 36 32 30 37 2c 30 2c 30 5d 2c 5b 31 30 34 35 37 33 30 32 30 33 2c 33 2c 30 2c 2d 31 2c 31 2c 33 39 35 33 2c 30 2c 30 5d 2c 5b 33 35 32 32 33 37 38 37 31 36 2c 30 2c 31 2c 2d 31 2c 31 2c 37 38 36 38 2c 30 2c 30 5d 2c 5b 32 30 39 31 32 30 32 35 37 34 2c Data Ascii: 71665651,0,1,-1,1,2336,0,0],[373531156,0,3,-1,0,8371,0,0],[2429216059,0,1,-1,0,7848,0,0],[1617749743,0,1,-1,0,3758,0,0],[2937329910,1,1,-1,2,5735,0,0],[288968706,0,1,-1,3,6207,0,0],[1045730203,3,0,-1,1,3953,0,0],[3522378716,0,1,-1,1,7868,0,0],[2091202574,
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 2c 38 30 31 32 2c 30 2c 30 5d 2c 5b 33 39 35 30 38 34 37 35 33 37 2c 33 2c 31 2c 2d 31 2c 30 2c 36 35 37 37 2c 30 2c 30 5d 2c 5b 33 39 32 37 31 34 35 37 39 37 2c 30 2c 31 2c 2d 31 2c 33 2c 35 30 33 2c 30 2c 30 5d 2c 5b 32 32 34 30 30 39 38 30 32 35 2c 30 2c 31 2c 2d 31 2c 30 2c 39 38 33 35 2c 30 2c 31 5d 2c 5b 38 32 32 36 37 36 31 33 34 2c 32 2c 31 2c 2d 31 2c 30 2c 31 30 37 39 2c 30 2c 30 5d 2c 5b 31 38 39 34 32 38 38 31 31 33 2c 30 2c 32 2c 2d 31 2c 34 2c 35 38 34 32 2c 30 2c 30 5d 2c 5b 32 35 33 38 35 39 31 30 37 37 2c 30 2c 31 2c 2d 31 2c 36 2c 34 30 36 2c 30 2c 30 5d 2c 5b 32 30 35 33 31 36 32 38 32 31 2c 30 2c 31 2c 2d 31 2c 31 2c 32 31 36 30 2c 30 2c 30 5d 2c 5b 32 38 31 36 35 37 37 36 32 36 2c 30 2c 31 2c 2d 31 2c 32 2c 36 38 36 31 2c 30 2c 30 5d Data Ascii: ,8012,0,0],[3950847537,3,1,-1,0,6577,0,0],[3927145797,0,1,-1,3,503,0,0],[2240098025,0,1,-1,0,9835,0,1],[822676134,2,1,-1,0,1079,0,0],[1894288113,0,2,-1,4,5842,0,0],[2538591077,0,1,-1,6,406,0,0],[2053162821,0,1,-1,1,2160,0,0],[2816577626,0,1,-1,2,6861,0,0]
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 35 2c 31 2c 2d 31 2c 30 2c 32 34 32 39 2c 30 2c 31 5d 2c 5b 32 32 34 34 33 36 39 32 39 39 2c 34 2c 37 2c 2d 31 2c 30 2c 34 34 33 33 2c 30 2c 31 5d 2c 5b 33 37 37 35 35 39 34 37 33 31 2c 33 2c 31 2c 2d 31 2c 30 2c 34 32 36 34 2c 30 2c 30 5d 2c 5b 32 32 31 30 37 30 38 30 30 37 2c 32 2c 31 2c 2d 31 2c 30 2c 39 35 34 37 2c 30 2c 31 5d 2c 5b 32 34 39 31 39 34 33 34 34 37 2c 30 2c 31 2c 2d 31 2c 30 2c 34 39 32 32 2c 30 2c 31 5d 2c 5b 36 37 33 36 35 37 38 37 32 2c 30 2c 31 2c 2d 31 2c 32 2c 36 37 34 33 2c 30 2c 30 5d 2c 5b 33 38 37 32 37 35 37 39 38 2c 32 2c 32 2c 2d 31 2c 30 2c 37 34 39 36 2c 30 2c 31 5d 2c 5b 32 39 37 39 39 32 36 32 34 30 2c 30 2c 31 2c 2d 31 2c 30 2c 31 32 31 37 2c 30 2c 30 5d 2c 5b 34 34 30 39 38 30 34 37 38 2c 34 2c 33 2c 2d 31 2c 30 2c 34 Data Ascii: 5,1,-1,0,2429,0,1],[2244369299,4,7,-1,0,4433,0,1],[3775594731,3,1,-1,0,4264,0,0],[2210708007,2,1,-1,0,9547,0,1],[2491943447,0,1,-1,0,4922,0,1],[673657872,0,1,-1,2,6743,0,0],[387275798,2,2,-1,0,7496,0,1],[2979926240,0,1,-1,0,1217,0,0],[440980478,4,3,-1,0,4
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 33 34 33 38 37 32 31 30 2c 32 2c 33 2c 2d 31 2c 30 2c 38 32 32 2c 30 2c 30 5d 2c 5b 36 30 31 30 31 34 37 34 39 2c 34 2c 31 2c 2d 31 2c 30 2c 33 35 38 39 2c 30 2c 31 5d 2c 5b 37 35 38 34 31 33 37 37 32 2c 30 2c 31 2c 2d 31 2c 30 2c 32 38 32 33 2c 30 2c 30 5d 2c 5b 32 39 31 36 39 37 32 32 33 33 2c 34 2c 31 2c 2d 31 2c 30 2c 34 37 37 39 2c 30 2c 31 5d 2c 5b 34 32 38 37 32 38 38 37 37 30 2c 31 2c 30 2c 2d 31 2c 30 2c 32 37 39 2c 31 2c 31 5d 2c 5b 33 32 31 31 38 31 30 32 34 31 2c 31 2c 30 2c 2d 31 2c 30 2c 32 36 31 2c 31 2c 31 5d 2c 5b 32 31 38 36 30 35 34 31 33 33 2c 31 2c 30 2c 2d 31 2c 30 2c 33 31 39 39 2c 31 2c 31 5d 2c 5b 32 38 38 32 36 35 36 39 30 36 2c 32 2c 31 2c 2d 31 2c 30 2c 36 38 36 37 2c 31 2c 31 5d 2c 5b 35 32 39 33 30 36 32 34 30 2c 31 2c 30 2c Data Ascii: 34387210,2,3,-1,0,822,0,0],[601014749,4,1,-1,0,3589,0,1],[758413772,0,1,-1,0,2823,0,0],[2916972233,4,1,-1,0,4779,0,1],[4287288770,1,0,-1,0,279,1,1],[3211810241,1,0,-1,0,261,1,1],[2186054133,1,0,-1,0,3199,1,1],[2882656906,2,1,-1,0,6867,1,1],[529306240,1,0,
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 30 2c 31 5d 2c 5b 31 35 36 34 39 30 37 36 36 2c 30 2c 30 2c 2d 31 2c 30 2c 31 30 36 2c 30 2c 31 5d 2c 5b 36 39 32 35 36 34 37 39 39 2c 30 2c 31 2c 2d 31 2c 31 2c 36 38 31 2c 30 2c 30 5d 2c 5b 33 39 30 37 39 34 31 32 34 37 2c 31 2c 31 2c 2d 31 2c 30 2c 32 34 37 35 2c 30 2c 31 5d 2c 5b 32 30 31 32 30 36 38 37 35 32 2c 30 2c 31 2c 2d 31 2c 30 2c 32 38 39 2c 30 2c 30 5d 2c 5b 34 30 32 34 30 37 39 33 39 37 2c 30 2c 31 2c 2d 31 2c 30 2c 35 36 33 37 2c 30 2c 31 5d 2c 5b 32 37 31 37 36 34 37 39 30 37 2c 33 2c 31 2c 2d 31 2c 30 2c 32 36 33 39 2c 30 2c 31 5d 2c 5b 32 32 38 33 30 36 31 33 37 32 2c 32 2c 32 2c 2d 31 2c 30 2c 39 30 37 32 2c 30 2c 30 5d 2c 5b 31 33 36 32 36 32 36 33 35 33 2c 33 2c 31 2c 2d 31 2c 30 2c 38 37 32 38 2c 30 2c 31 5d 2c 5b 31 32 33 31 30 32 Data Ascii: 0,1],[156490766,0,0,-1,0,106,0,1],[692564799,0,1,-1,1,681,0,0],[3907941247,1,1,-1,0,2475,0,1],[2012068752,0,1,-1,0,289,0,0],[4024079397,0,1,-1,0,5637,0,1],[2717647907,3,1,-1,0,2639,0,1],[2283061372,2,2,-1,0,9072,0,0],[1362626353,3,1,-1,0,8728,0,1],[123102
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 35 33 33 32 30 35 35 38 22 2c 22 39 39 31 38 30 34 32 35 33 33 33 35 32 31 32 31 31 32 22 2c 22 38 34 30 32 39 36 36 30 37 37 38 35 32 38 37 37 36 33 22 2c 22 36 35 31 35 39 37 35 31 34 34 30 37 30 31 38 35 31 36 22 5d 5d 5d 5d 5d 5d 5d 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 30 5d 2c 5b 34 32 30 30 35 39 35 30 36 37 2c 22 32 30 32 32 2d 30 31 5f 67 75 69 6c 64 5f 72 6f 6c 65 5f 73 75 62 73 63 72 69 70 74 69 6f 6e 5f 74 72 69 61 6c 73 22 2c 30 2c 5b 5b 5b 5b 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5b 32 32 39 34 38 38 38 39 34 33 2c 5b 5b 32 36 39 30 37 35 32 31 35 36 2c 37 37 30 31 33 39 33 30 31 5d 2c 5b 31 39 38 32 38 30 34 31 32 31 2c 31 30 30 30 30 5d 5d 5d 5d 5d 2c 5b 5b 5b 2d 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 Data Ascii: 53320558","991804253335212112","840296607785287763","651597514407018516"]]]]]]]],null,null,0,0],[4200595067,"2022-01_guild_role_subscription_trials",0,[[[[1,[{"s":0,"e":10000}]]],[[2294888943,[[2690752156,770139301],[1982804121,10000]]]]],[[[-1,[{"s":0,"e
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 2c 6e 75 6c 6c 2c 30 2c 5b 5b 5b 5b 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5d 5d 5d 2c 5b 5d 2c 5b 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 30 5d 2c 5b 31 39 39 30 36 37 32 30 30 39 2c 6e 75 6c 6c 2c 30 2c 5b 5b 5b 5b 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5d 5d 5d 2c 5b 7b 22 62 22 3a 31 2c 22 6b 22 3a 5b 22 39 30 38 31 31 34 33 39 32 32 36 33 30 34 39 32 37 37 22 5d 7d 5d 2c 5b 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 30 5d 2c 5b 31 37 39 37 31 31 36 33 38 2c 6e 75 6c 6c 2c 30 2c 5b 5b 5b 5b 2d 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5d 5d 5d 2c 5b 7b 22 62 22 3a 36 2c 22 6b 22 3a 5b 22 39 30 38 31 31 34 33 39 32 32 36 33 30 34 39 32 37 37 22 2c Data Ascii: ,null,0,[[[[1,[{"s":0,"e":10000}]]],[]]],[],[],null,null,0,0],[1990672009,null,0,[[[[1,[{"s":0,"e":10000}]]],[]]],[{"b":1,"k":["908114392263049277"]}],[],null,null,0,0],[179711638,null,0,[[[[-1,[{"s":0,"e":10000}]]],[]]],[{"b":6,"k":["908114392263049277",
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 37 36 34 37 33 35 38 33 32 30 36 38 30 39 36 22 5d 7d 5d 2c 5b 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 30 5d 2c 5b 31 38 30 34 31 32 32 38 32 37 2c 22 32 30 32 32 2d 30 39 5f 67 75 69 6c 64 5f 6f 6e 62 6f 61 72 64 69 6e 67 5f 61 64 6d 69 6e 5f 6f 6e 6c 79 5f 6f 6c 64 22 2c 30 2c 5b 5b 5b 5b 2d 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5d 5d 5d 2c 5b 5d 2c 5b 5b 5b 5b 5b 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5b 31 36 30 34 36 31 32 30 34 35 2c 5b 5b 31 31 38 33 32 35 31 32 34 38 2c 5b 22 47 55 49 4c 44 5f 4f 4e 42 4f 41 52 44 49 4e 47 5f 41 44 4d 49 4e 5f 4f 4e 4c 59 22 5d 5d 5d 5d 5d 5d 5d 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 30 5d 2c 5b 32 34 35 37 39 30 33 31 30 37 2c 6e 75 6c Data Ascii: 764735832068096"]}],[],null,null,0,0],[1804122827,"2022-09_guild_onboarding_admin_only_old",0,[[[[-1,[{"s":0,"e":10000}]]],[]]],[],[[[[[1,[{"s":0,"e":10000}]]],[[1604612045,[[1183251248,["GUILD_ONBOARDING_ADMIN_ONLY"]]]]]]]],null,null,0,0],[2457903107,nul

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.9	49837	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:22 UTC	872	OUT	GET /assets/ac625b77a0bab0ee72df.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:22 UTC	966	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:22 GMT Content-Type: application/javascript Content-Length: 3530 Connection: close CF-Ray: 8d782e59bb023ab0-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "be6064ff8c1d480afb80fe48762a06c1" Last-Modified: Fri, 28 Jun 2024 00:43:11 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2oMHve79ryrqisSRrmIUMMXoJb82I41ycwffbf%2F60BoUtM9hjcQPLClLLpDtvUUeHLWUJQbd3MhIy1Ym%2BDRHUI5bI0Tlm7eGpZ1Gf1YJb8Bv1N1oGRUUHbZy8OzN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:22 UTC	403	IN	Data Raw: 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 7b 35 30 34 30 35 33 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 65 29 7b 65 2e 64 28 74 2c 7b 46 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 65 28 35 31 38 32 36 33 29 2c 65 28 39 37 30 31 37 33 29 2c 65 28 35 32 30 37 31 32 29 2c 65 28 32 36 38 31 31 31 29 2c 65 28 39 34 31 34 39 37 29 2c 65 28 33 32 30 32 36 29 2c 65 28 34 38 30 38 33 39 29 2c 65 28 37 34 34 32 38 35 29 2c 65 28 34 39 32 32 35 37 29 2c 65 28 38 37 33 38 31 37 29 2c 65 28 38 36 33 39 34 32 29 2c 65 28 36 34 32 35 34 39 29 2c 65 28 36 35 33 30 34 31 29 3b 76 61 72 20 6e 3d 65 28 37 38 38 39 30 30 29 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 72 29 7b 6c 65 74 20 74 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: (()=>{"use strict";var r={504053:function(r,t,e){e.d(t,{F:function(){return o}}),e(518263),e(970173),e(520712),e(268111),e(941497),e(32026),e(480839),e(744285),e(492257),e(873817),e(863942),e(642549),e(653041);var n=e(788900);function o(r){let t=function(
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 3d 72 5b 33 5d 7c 72 5b 34 5d 3c 3c 38 2c 73 3d 28 36 33 26 63 29 2f 36 33 2c 70 3d 28 63 3e 3e 36 26 36 33 29 2f 33 31 2e 35 2d 31 2c 64 3d 28 63 3e 3e 31 32 26 36 33 29 2f 33 31 2e 35 2d 31 2c 76 3d 63 3e 3e 32 33 2c 68 3d 6c 3e 3e 31 35 2c 62 3d 69 28 33 2c 68 3f 76 3f 35 3a 37 3a 37 26 6c 29 2c 67 3d 69 28 33 2c 68 3f 37 26 6c 3a 76 3f 35 3a 37 29 2c 79 3d 76 3f 28 31 35 26 72 5b 35 5d 29 2f 31 35 3a 31 2c 4f 3d 28 72 5b 35 5d 3e 3e 34 29 2f 31 35 2c 6d 3d 76 3f 36 3a 35 2c 77 3d 30 2c 78 3d 28 74 2c 65 2c 6e 29 3d 3e 7b 6c 65 74 20 6f 3d 5b 5d 3b 66 6f 72 28 6c 65 74 20 66 3d 30 3b 66 3c 65 3b 66 2b 2b 29 66 6f 72 28 6c 65 74 20 69 3d 66 3f 30 3a 31 3b 69 2a 65 3c 74 2a 28 65 2d 66 29 3b 69 2b 2b 29 6f 2e 70 75 73 68 28 28 28 72 5b 6d 2b 28 77 3e 3e Data Ascii: =r[3]\|r[4]<<8,s=(63&c)/63,p=(c>>6&63)/31.5-1,d=(c>>12&63)/31.5-1,v=c>>23,h=l>>15,b=i(3,h?v?5:7:7&l),g=i(3,h?7&l:v?5:7),y=v?(15&r[5])/15:1,O=(r[5]>>4)/15,m=v?6:5,w=0,x=(t,e,n)=>{let o=[];for(let f=0;f<e;f++)for(let i=f?0:1;ie<t(e-f);i++)o.push(((r[m+(w>>
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 74 5b 6e 5d 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 6f 29 72 65 74 75 72 6e 20 6f 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 66 3d 74 5b 6e 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 72 5b 6e 5d 2e 63 61 6c 6c 28 66 2e 65 78 70 6f 72 74 73 2c 66 2c 66 2e 65 78 70 6f 72 74 73 2c 65 29 2c 66 2e 65 78 70 6f 72 74 73 7d 65 2e 6d 3d 72 2c 65 2e 78 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 65 2e 4f 28 76 6f 69 64 20 30 2c 5b 22 37 38 31 38 37 22 2c 22 37 31 39 38 34 22 2c 22 34 33 32 32 32 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 28 22 31 37 31 37 31 36 22 29 7d 29 3b 72 65 74 75 72 6e 20 72 3d 65 2e 4f 28 72 29 7d 2c 65 2e 6e 3d 66 75 6e 63 74 69 6f 6e 28 72 29 7b 76 61 72 20 74 3d 72 26 26 72 2e 5f 5f 65 Data Ascii: t[n];if(void 0!==o)return o.exports;var f=t[n]={exports:{}};return r[n].call(f.exports,f,f.exports,e),f.exports}e.m=r,e.x=function(){var r=e.O(void 0,["78187","71984","43222"],function(){return e("171716")});return r=e.O(r)},e.n=function(r){var t=r&&r.__e
2024-10-24 07:16:22 UTC	389	IN	Data Raw: 37 31 39 38 34 22 2c 22 34 33 32 32 32 22 5d 2e 6d 61 70 28 65 2e 65 2c 65 29 29 2e 74 68 65 6e 28 72 29 7d 7d 29 28 29 2c 28 28 29 3d 3e 7b 76 61 72 20 72 3d 7b 37 37 34 35 39 3a 31 7d 3b 65 2e 66 2e 69 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 21 72 5b 74 5d 26 26 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 65 2e 70 2b 65 2e 75 28 74 29 29 7d 3b 76 61 72 20 74 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 2c 6e 3d 74 2e 70 75 73 68 2e 62 69 6e 64 28 74 29 3b 74 2e 70 75 73 68 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6f 3d 74 5b 30 5d 2c 66 3d 74 5b 31 5d 2c 69 3d 74 5b 32 5d 3b 66 6f 72 28 76 61 72 20 75 Data Ascii: 71984","43222"].map(e.e,e)).then(r)}})(),(()=>{var r={77459:1};e.f.i=function(t,n){!r[t]&&importScripts(e.p+e.u(t))};var t=this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[],n=t.push.bind(t);t.push=function(t){var o=t[0],f=t[1],i=t[2];for(var u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.9	49836	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:22 UTC	872	OUT	GET /assets/29a63f12209c956d9204.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:22 UTC	964	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:22 GMT Content-Type: application/javascript Content-Length: 2750 Connection: close CF-Ray: 8d782e59c979e52c-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "390a7ab1f964aa8cb1b87dd13732c3bc" Last-Modified: Tue, 30 Jul 2024 22:07:30 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tboqnkrqNGwewsY0OW5GJTYhtBSsBqPG2O0S4T4um6tJzN0j6FC9BYRYaeavbiKBYMzjh834SLum7bNiaJ4GUtzPhZhnTqcLmqXtl8VG6ddCfQnC%2FpsC0MyZu4Kl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:22 UTC	405	IN	Data Raw: 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 7b 31 33 37 39 32 30 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 2c 69 3b 6e 2e 64 28 72 2c 7b 4a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 7d 2c 7a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 7d 7d 29 2c 28 69 3d 65 7c 7c 28 65 3d 7b 7d 29 29 5b 69 2e 4e 4f 4e 45 3d 30 5d 3d 22 4e 4f 4e 45 22 2c 69 5b 69 2e 53 4f 43 49 41 4c 3d 31 5d 3d 22 53 4f 43 49 41 4c 22 2c 69 5b 69 2e 43 41 53 55 41 4c 3d 32 5d 3d 22 43 41 53 55 41 4c 22 2c 69 5b 69 2e 43 4f 4d 50 45 54 49 54 49 56 45 3d 33 5d 3d 22 43 4f 4d 50 45 54 49 54 49 56 45 22 2c 69 5b 69 2e 43 52 45 41 54 49 56 45 3d 34 5d 3d 22 43 52 45 41 54 49 56 45 22 2c 69 5b 69 2e 56 45 Data Ascii: (()=>{"use strict";var t={137920:function(t,r,n){var e,i;n.d(r,{J:function(){return u},z:function(){return e}}),(i=e\|\|(e={}))[i.NONE=0]="NONE",i[i.SOCIAL=1]="SOCIAL",i[i.CASUAL=2]="CASUAL",i[i.COMPETITIVE=3]="COMPETITIVE",i[i.CREATIVE=4]="CREATIVE",i[i.VE
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 3b 76 61 72 20 65 3d 6e 28 31 33 37 39 32 30 29 3b 66 75 6e 63 74 69 6f 6e 20 69 28 74 2c 72 29 7b 6c 65 74 20 6e 3d 30 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 72 2e 67 61 6d 65 73 26 26 28 6e 2b 3d 32 2a 72 2e 67 61 6d 65 73 2e 66 69 6c 74 65 72 28 72 3d 3e 74 2e 67 61 6d 65 73 2e 69 6e 63 6c 75 64 65 73 28 72 29 29 2e 6c 65 6e 67 74 68 29 2c 6e 75 6c 6c 21 3d 72 2e 70 6c 61 79 73 74 79 6c 65 26 26 28 72 2e 70 6c 61 79 73 74 79 6c 65 3d 3d 3d 74 2e 70 6c 61 79 73 74 79 6c 65 3f 6e 2b 3d 32 3a 65 2e 4a 5b 74 2e 70 6c 61 79 73 74 79 6c 65 5d 3d 3d 3d 65 2e 4a 5b 72 2e 70 6c 61 79 73 74 79 6c 65 5d 26 26 28 6e 2b 3d 31 29 29 2c 6e 75 6c 6c 21 3d 72 2e 74 72 61 69 74 73 26 26 28 6e 2b 3d 32 2a 41 72 72 61 79 Data Ascii: on(){return i}});var e=n(137920);function i(t,r){let n=0;return null!=r.games&&(n+=2r.games.filter(r=>t.games.includes(r)).length),null!=r.playstyle&&(r.playstyle===t.playstyle?n+=2:e.J[t.playstyle]===e.J[r.playstyle]&&(n+=1)),null!=r.traits&&(n+=2Array
2024-10-24 07:16:22 UTC	976	IN	Data Raw: 72 65 74 75 72 6e 20 74 68 69 73 7c 7c 46 75 6e 63 74 69 6f 6e 28 22 72 65 74 75 72 6e 20 74 68 69 73 22 29 28 29 7d 63 61 74 63 68 28 74 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 29 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 7d 7d 28 29 2c 6e 2e 6f 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 72 29 7d 2c 28 28 29 3d 3e 7b 76 61 72 20 74 3d 5b 5d 3b 6e 2e 4f 3d 66 75 6e 63 74 69 6f 6e 28 72 2c 65 2c 69 2c 75 29 7b 69 66 28 65 29 7b 75 3d 75 7c 7c 30 3b 66 6f 72 28 76 61 72 20 6f 3d 74 2e 6c 65 6e 67 74 68 3b 6f 3e 30 26 26 74 5b 6f 2d 31 5d 5b 32 5d 3e 75 3b 6f 2d 2d 29 74 5b 6f 5d Data Ascii: return this\|\|Function("return this")()}catch(t){if("object"==typeof window)return window}}(),n.o=function(t,r){return Object.prototype.hasOwnProperty.call(t,r)},(()=>{var t=[];n.O=function(r,e,i,u){if(e){u=u\|\|0;for(var o=t.length;o>0&&t[o-1][2]>u;o--)t[o]

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.9	49833	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:22 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:22 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:22 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 333fed2f-601e-003d-6b17-246f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071622Z-r1755647c66qqfh4kbna50rqv40000000a30000000006eht x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:22 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.9	49832	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:22 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:22 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:22 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 816a6405-301e-001f-06d8-21aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071622Z-17fbfdc98bbwfg2nvhsr4h37pn00000006yg000000003mad x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:22 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.9	49834	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:22 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:22 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:22 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 2a979a5c-f01e-003f-77f7-21d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071622Z-r1755647c66nfj7t97c2qyh6zg0000000690000000002xd4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:22 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.9	49840	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:22 UTC	868	OUT	GET /assets/55ad931ed92a15c15709.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:22 UTC	963	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:22 GMT Content-Type: text/javascript Content-Length: 109613 Connection: close CF-Ray: 8d782e5a1b964606-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "80f500d4d0495e5c74e9b92cbc26f088" Last-Modified: Tue, 15 Oct 2024 21:49:59 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WW83L%2FGEcR01VYzegeTna3153ugXE7FYYTYIHwUevb2rmwrsepYJULyJBtzRrb9npdRoq7X7G6PClEASI%2BJBBqb9iWJbHsxppYcBHFmVLDO3IKwdK8zE9gVk%2Fii1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:22 UTC	406	IN	Data Raw: 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 36 33 32 38 38 22 5d 2c 7b 34 37 33 34 35 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 3d 65 2e 6c 65 6e 67 74 68 2c 6f 3d 6e 5e 6e 2c 72 3d 30 3b 6e 3e 3d 34 3b 29 74 3d 28 36 35 35 33 35 26 28 74 3d 32 35 35 26 65 2e 63 68 61 72 43 6f 64 65 41 74 28 72 29 7c 28 32 35 35 26 65 2e 63 68 61 72 43 6f 64 65 41 74 28 2b 2b 72 29 29 3c 3c 38 7c 28 32 35 35 26 65 2e 63 68 61 72 43 6f 64 65 41 74 28 2b 2b 72 29 29 3c 3c 31 36 7c Data Ascii: (this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["63288"],{473452:function(e,t){"use strict";t.Z=function(e){for(var t,n=e.length,o=n^n,r=0;n>=4;)t=(65535&(t=255&e.charCodeAt(r)\|(255&e.charCodeAt(++r))<<8\|(255&e.charCodeAt(++r))<<16\|
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 26 74 29 2a 31 35 34 30 34 38 33 34 37 37 2b 28 28 28 74 3e 3e 3e 31 36 29 2a 31 35 34 30 34 38 33 34 37 37 26 36 35 35 33 35 29 3c 3c 31 36 29 29 2c 6e 2d 3d 34 2c 2b 2b 72 3b 73 77 69 74 63 68 28 6e 29 7b 63 61 73 65 20 33 3a 6f 5e 3d 28 32 35 35 26 65 2e 63 68 61 72 43 6f 64 65 41 74 28 72 2b 32 29 29 3c 3c 31 36 3b 63 61 73 65 20 32 3a 6f 5e 3d 28 32 35 35 26 65 2e 63 68 61 72 43 6f 64 65 41 74 28 72 2b 31 29 29 3c 3c 38 3b 63 61 73 65 20 31 3a 6f 5e 3d 32 35 35 26 65 2e 63 68 61 72 43 6f 64 65 41 74 28 72 29 2c 6f 3d 28 36 35 35 33 35 26 6f 29 2a 31 35 34 30 34 38 33 34 37 37 2b 28 28 28 6f 3e 3e 3e 31 36 29 2a 31 35 34 30 34 38 33 34 37 37 26 36 35 35 33 35 29 3c 3c 31 36 29 7d 72 65 74 75 72 6e 20 6f 5e 3d 6f 3e 3e 3e 31 33 2c 6f 3d 28 36 35 35 33 Data Ascii: &t)1540483477+(((t>>>16)1540483477&65535)<<16)),n-=4,++r;switch(n){case 3:o^=(255&e.charCodeAt(r+2))<<16;case 2:o^=(255&e.charCodeAt(r+1))<<8;case 1:o^=255&e.charCodeAt(r),o=(65535&o)1540483477+(((o>>>16)1540483477&65535)<<16)}return o^=o>>>13,o=(6553
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 75 72 6e 20 31 31 36 3d 3d 3d 61 2e 63 68 61 72 43 6f 64 65 41 74 28 33 29 3f 22 2d 77 65 62 6b 69 74 2d 22 2b 61 2b 61 3a 61 3b 63 61 73 65 20 39 36 33 3a 72 65 74 75 72 6e 20 31 31 30 3d 3d 3d 61 2e 63 68 61 72 43 6f 64 65 41 74 28 35 29 3f 22 2d 77 65 62 6b 69 74 2d 22 2b 61 2b 61 3a 61 3b 63 61 73 65 20 31 30 30 39 3a 69 66 28 31 30 30 21 3d 3d 61 2e 63 68 61 72 43 6f 64 65 41 74 28 34 29 29 62 72 65 61 6b 3b 63 61 73 65 20 39 36 39 3a 63 61 73 65 20 39 34 32 3a 72 65 74 75 72 6e 22 2d 77 65 62 6b 69 74 2d 22 2b 61 2b 61 3b 63 61 73 65 20 39 37 38 3a 72 65 74 75 72 6e 22 2d 77 65 62 6b 69 74 2d 22 2b 61 2b 22 2d 6d 6f 7a 2d 22 2b 61 2b 61 3b 63 61 73 65 20 31 30 31 39 3a 63 61 73 65 20 39 38 33 3a 72 65 74 75 72 6e 22 2d 77 65 62 6b 69 74 2d 22 2b 61 Data Ascii: urn 116===a.charCodeAt(3)?"-webkit-"+a+a:a;case 963:return 110===a.charCodeAt(5)?"-webkit-"+a+a:a;case 1009:if(100!==a.charCodeAt(4))break;case 969:case 942:return"-webkit-"+a+a;case 978:return"-webkit-"+a+"-moz-"+a+a;case 1019:case 983:return"-webkit-"+a
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 68 2d 31 30 2c 75 3d 28 73 3d 28 33 33 3d 3d 3d 61 2e 63 68 61 72 43 6f 64 65 41 74 28 74 29 3f 61 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 74 29 3a 61 29 2e 73 75 62 73 74 72 69 6e 67 28 65 2e 69 6e 64 65 78 4f 66 28 22 3a 22 2c 37 29 2b 31 29 2e 74 72 69 6d 28 29 29 2e 63 68 61 72 43 6f 64 65 41 74 28 30 29 2b 28 30 7c 73 2e 63 68 61 72 43 6f 64 65 41 74 28 37 29 29 29 7b 63 61 73 65 20 32 30 33 3a 69 66 28 31 31 31 3e 73 2e 63 68 61 72 43 6f 64 65 41 74 28 38 29 29 62 72 65 61 6b 3b 63 61 73 65 20 31 31 35 3a 61 3d 61 2e 72 65 70 6c 61 63 65 28 73 2c 22 2d 77 65 62 6b 69 74 2d 22 2b 73 29 2b 22 3b 22 2b 61 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 30 37 3a 63 61 73 65 20 31 30 32 3a 61 3d 61 2e 72 65 70 6c 61 63 65 28 73 2c 22 2d 77 65 62 6b 69 74 2d 22 2b Data Ascii: h-10,u=(s=(33===a.charCodeAt(t)?a.substring(0,t):a).substring(e.indexOf(":",7)+1).trim()).charCodeAt(0)+(0\|s.charCodeAt(7))){case 203:if(111>s.charCodeAt(8))break;case 115:a=a.replace(s,"-webkit-"+s)+";"+a;break;case 207:case 102:a=a.replace(s,"-webkit-"+
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 76 61 72 20 6e 3d 6f 28 74 2c 74 2e 63 68 61 72 43 6f 64 65 41 74 28 30 29 2c 74 2e 63 68 61 72 43 6f 64 65 41 74 28 31 29 2c 74 2e 63 68 61 72 43 6f 64 65 41 74 28 32 29 29 3b 72 65 74 75 72 6e 20 6e 21 3d 3d 74 2b 22 3b 22 3f 6e 2e 72 65 70 6c 61 63 65 28 43 2c 22 20 6f 72 20 28 24 31 29 22 29 2e 73 75 62 73 74 72 69 6e 67 28 34 29 3a 22 28 22 2b 74 2b 22 29 22 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 2c 6e 2c 6f 2c 72 2c 69 2c 61 2c 75 2c 6c 2c 63 29 7b 66 6f 72 28 76 61 72 20 70 2c 64 3d 30 2c 66 3d 74 3b 64 3c 50 3b 2b 2b 64 29 73 77 69 74 63 68 28 70 3d 49 5b 64 5d 2e 63 61 6c 6c 28 73 2c 65 2c 66 2c 6e 2c 6f 2c 72 2c 69 2c 61 2c 75 2c 6c 2c 63 29 29 7b 63 61 73 65 20 76 6f 69 64 20 30 3a 63 61 73 65 21 31 3a 63 61 73 65 21 30 3a 63 61 73 65 20 Data Ascii: var n=o(t,t.charCodeAt(0),t.charCodeAt(1),t.charCodeAt(2));return n!==t+";"?n.replace(C," or ($1)").substring(4):"("+t+")"}function a(e,t,n,o,r,i,a,u,l,c){for(var p,d=0,f=t;d<P;++d)switch(p=I[d].call(s,e,f,n,o,r,i,a,u,l,c)){case void 0:case!1:case!0:case
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 3d 3d 66 26 26 28 66 3d 28 48 3d 48 2e 72 65 70 6c 61 63 65 28 6c 2c 22 22 29 2e 74 72 69 6d 28 29 29 2e 63 68 61 72 43 6f 64 65 41 74 28 30 29 29 2c 36 34 3d 3d 3d 66 29 7b 73 77 69 74 63 68 28 30 3c 52 26 26 28 48 3d 48 2e 72 65 70 6c 61 63 65 28 63 2c 22 22 29 29 2c 68 3d 48 2e 63 68 61 72 43 6f 64 65 41 74 28 31 29 29 7b 63 61 73 65 20 31 30 30 3a 63 61 73 65 20 31 30 39 3a 63 61 73 65 20 31 31 35 3a 63 61 73 65 20 34 35 3a 52 3d 75 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 52 3d 4d 7d 69 66 28 5f 3d 28 6d 3d 65 28 75 2c 52 2c 6d 2c 68 2c 64 2b 31 29 29 2e 6c 65 6e 67 74 68 2c 30 3c 50 26 26 28 43 3d 61 28 33 2c 6d 2c 52 3d 74 28 4d 2c 48 2c 42 29 2c 75 2c 6b 2c 77 2c 5f 2c 68 2c 64 2c 70 29 2c 48 3d 52 2e 6a 6f 69 6e 28 22 22 29 2c 76 6f 69 64 20 Data Ascii: ==f&&(f=(H=H.replace(l,"").trim()).charCodeAt(0)),64===f){switch(0<R&&(H=H.replace(c,"")),h=H.charCodeAt(1)){case 100:case 109:case 115:case 45:R=u;break;default:R=M}if(_=(m=e(u,R,m,h,d+1)).length,0<P&&(C=a(3,m,R=t(M,H,B),u,k,w,_,h,d,p),H=R.join(""),void
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 26 28 62 3d 22 20 22 29 7d 62 72 65 61 6b 3b 63 61 73 65 20 30 3a 62 3d 22 5c 5c 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 32 3a 62 3d 22 5c 5c 66 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 31 3a 62 3d 22 5c 5c 76 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 33 38 3a 30 3d 3d 3d 53 2b 78 2b 4f 26 26 28 52 3d 42 3d 31 2c 62 3d 22 5c 66 22 2b 62 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 30 38 3a 69 66 28 30 3d 3d 3d 53 2b 78 2b 4f 2b 46 26 26 30 3c 54 29 73 77 69 74 63 68 28 4e 2d 54 29 7b 63 61 73 65 20 32 3a 31 31 32 3d 3d 3d 49 26 26 35 38 3d 3d 3d 73 2e 63 68 61 72 43 6f 64 65 41 74 28 4e 2d 33 29 26 26 28 46 3d 49 29 3b 63 61 73 65 20 38 3a 31 31 31 3d 3d 3d 4c 26 26 28 46 3d 4c 29 7d 62 72 65 61 6b 3b 63 61 73 65 20 35 38 3a 30 3d 3d 3d 53 2b 78 2b 4f 26 Data Ascii: &(b=" ")}break;case 0:b="\\0";break;case 12:b="\\f";break;case 11:b="\\v";break;case 38:0===S+x+O&&(R=B=1,b="\f"+b);break;case 108:if(0===S+x+O+F&&0<T)switch(N-T){case 2:112===I&&58===s.charCodeAt(N-3)&&(F=I);case 8:111===L&&(F=L)}break;case 58:0===S+x+O&
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 79 29 2f 67 2c 62 3d 2f 5b 73 76 68 5d 5c 77 2b 2d 5b 74 62 6c 72 5d 7b 32 7d 2f 2c 79 3d 2f 5c 28 5c 73 2a 28 2e 2a 29 5c 73 2a 5c 29 2f 67 2c 43 3d 2f 28 5b 5c 73 5c 53 5d 2a 3f 29 3b 2f 67 2c 4f 3d 2f 2d 73 65 6c 66 7c 66 6c 65 78 2d 2f 67 2c 78 3d 2f 5b 5e 5d 2a 3f 28 3a 5b 72 70 5d 5b 65 6c 5d 61 5b 5c 77 2d 5d 2b 29 5b 5e 5d 2a 2f 2c 41 3d 2f 73 74 72 65 74 63 68 7c 3a 5c 73 2a 5c 77 2b 5c 2d 28 3f 3a 63 6f 6e 74 65 7c 61 76 61 69 6c 29 2f 2c 53 3d 2f 28 5b 5e 2d 5d 29 28 69 6d 61 67 65 2d 73 65 74 5c 28 29 2f 2c 77 3d 31 2c 6b 3d 31 2c 46 3d 30 2c 44 3d 31 2c 4d 3d 5b 5d 2c 49 3d 5b 5d 2c 50 3d 30 2c 4c 3d 6e 75 6c 6c 2c 56 3d 30 2c 54 3d 22 22 3b 72 65 74 75 72 6e 20 73 2e 75 73 65 3d 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 73 77 69 74 63 68 28 Data Ascii: y)/g,b=/[svh]\w+-[tblr]{2}/,y=/$\s(.)\s$/g,C=/([\s\S]?);/g,O=/-self\|flex-/g,x=/[^]?(:[rp][el]a[\w-]+)[^]/,A=/stretch\|:\s*\w+\-(?:conte\|avail)/,S=/([^-])(image-set\()/,w=1,k=1,F=0,D=1,M=[],I=[],P=0,L=null,V=0,T="";return s.use=function e(t){switch(
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 69 73 4e 61 4e 28 74 29 7c 7c 30 3d 3d 3d 74 3f 74 3a 74 2b 22 70 78 22 7d 2c 64 3d 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 74 2e 6c 65 6e 67 74 68 2c 6f 3d 30 2c 72 3d 22 22 3b 6f 3c 6e 3b 6f 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 6f 5d 3b 69 66 28 6e 75 6c 6c 21 3d 69 29 7b 76 61 72 20 61 3d 76 6f 69 64 20 30 3b 73 77 69 74 63 68 28 74 79 70 65 6f 66 20 69 29 7b 63 61 73 65 22 62 6f 6f 6c 65 61 6e 22 3a 62 72 65 61 6b 3b 63 61 73 65 22 66 75 6e 63 74 69 6f 6e 22 3a 61 3d 65 28 5b 69 28 29 5d 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 6f 62 6a 65 63 74 22 3a 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 69 29 29 61 3d 65 28 69 29 3b 65 6c 73 65 20 66 6f 72 28 76 61 72 20 75 20 69 6e 20 61 3d 22 22 2c 69 29 69 5b 75 5d 26 26 Data Ascii: isNaN(t)\|\|0===t?t:t+"px"},d=function e(t){for(var n=t.length,o=0,r="";o<n;o++){var i=t[o];if(null!=i){var a=void 0;switch(typeof i){case"boolean":break;case"function":a=e([i()]);break;case"object":if(Array.isArray(i))a=e(i);else for(var u in a="",i)i[u]&&
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 29 7d 2c 74 2e 66 6c 75 73 68 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 74 61 67 73 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 65 29 7d 29 2c 74 68 69 73 2e 74 61 67 73 3d 5b 5d 2c 74 68 69 73 2e 63 74 72 3d 30 2c 74 68 69 73 2e 69 6e 6a 65 63 74 65 64 3d 21 31 7d 2c 65 7d 28 29 3b 74 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 76 6f 69 64 20 30 21 3d 3d 65 2e 5f 5f 53 45 43 52 45 54 5f 45 4d 4f 54 49 4f 4e 5f 5f 29 72 65 74 75 72 6e 20 65 2e 5f 5f 53 45 43 52 45 54 5f 45 4d 4f 54 49 4f 4e 5f 5f 3b 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 74 3d 7b 7d 29 3b 76 61 72 20 6e 2c 6f 2c 72 2c 75 2c 6c 3d 74 2e 6b 65 79 7c 7c Data Ascii: )},t.flush=function(){this.tags.forEach(function(e){return e.parentNode.removeChild(e)}),this.tags=[],this.ctr=0,this.injected=!1},e}();t.Z=function(e,t){if(void 0!==e.__SECRET_EMOTION__)return e.__SECRET_EMOTION__;void 0===t&&(t={});var n,o,r,u,l=t.key\|\|

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.9	49838	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:22 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:22 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:22 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: d2e4573f-901e-0067-4de3-20b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071622Z-r1755647c66xkk8sn093pbsnz800000000kg000000000t95 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:16:22 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.9	49839	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:22 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:22 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:22 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 33f58e49-701e-0053-6bb3-203a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071622Z-r1755647c668mbb8rg8s8fbge4000000066g0000000066m6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:22 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.9	49841	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	745	OUT	GET /assets/5067a2ec1b24a6de868c.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/assets/ac625b77a0bab0ee72df.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:23 UTC	973	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:23 GMT Content-Type: application/javascript Content-Length: 13374 Connection: close CF-Ray: 8d782e5ca91e8d26-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "d0c788b157ff96a2dd902c97bfc889f6" Last-Modified: Fri, 28 Jun 2024 00:43:12 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1gmzoZhkCk62%2F0SYAN5Z%2BobvVarGJwrIL1zZR9mhpjvoMm6g1HPaMi6L1Xa%2BHPC%2BRFzupPrbG9aSGa9qgpniOu5AN6rPLY34pXAPaWFtPcftAqDNqB2iGV%2FNeJCa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:23 UTC	396	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 37 38 31 38 37 22 5d 2c 7b 35 32 36 39 38 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 33 35 34 38 34 38 29 2c 6f 3d 72 28 39 33 38 35 30 37 29 2c 69 3d 54 79 70 65 45 72 72 6f 72 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 65 28 74 29 29 72 65 74 75 72 6e 20 74 3b 74 68 72 6f 77 20 69 28 6f 28 74 29 2b 22 20 69 73 20 6e 6f 74 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 7d 7d 2c 32 34 30 33 33 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["78187"],{526988:function(t,n,r){var e=r(354848),o=r(938507),i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not a function")}},24033:function(t,n,r){
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 72 28 32 39 39 36 32 33 29 2c 6f 3d 72 28 39 38 30 38 35 35 29 2c 69 3d 72 28 34 39 36 39 33 29 2c 75 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 2c 72 2c 75 29 7b 76 61 72 20 63 2c 66 3d 65 28 6e 29 2c 61 3d 69 28 66 29 2c 73 3d 6f 28 75 2c 61 29 3b 69 66 28 74 26 26 72 21 3d 72 29 7b 66 6f 72 28 3b 61 3e 73 3b 29 69 66 28 28 63 3d 66 5b 73 2b 2b 5d 29 21 3d 63 29 72 65 74 75 72 6e 21 30 7d 65 6c 73 65 20 66 6f 72 28 3b 61 3e 73 3b 73 2b 2b 29 69 66 28 28 74 7c 7c 73 20 69 6e 20 66 29 26 26 66 5b 73 5d 3d 3d 3d 72 29 72 65 74 75 72 6e 20 74 7c 7c 73 7c 7c 30 3b 72 65 74 75 72 6e 21 74 26 26 2d 31 7d 7d 3b 74 2e 65 78 70 6f 72 74 73 3d 7b 69 6e 63 6c 75 64 65 73 3a 75 28 21 30 29 2c 69 6e 64 65 78 4f 66 3a 75 Data Ascii: r(299623),o=r(980855),i=r(49693),u=function(t){return function(n,r,u){var c,f=e(n),a=i(f),s=o(u,a);if(t&&r!=r){for(;a>s;)if((c=f[s++])!=c)return!0}else for(;a>s;s++)if((t\|\|s in f)&&f[s]===r)return t\|\|s\|\|0;return!t&&-1}};t.exports={includes:u(!0),indexOf:u
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 72 29 7b 76 61 72 20 65 3d 72 28 31 36 31 35 38 31 29 2c 6f 3d 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 74 72 79 7b 6f 28 65 2c 74 2c 7b 76 61 6c 75 65 3a 6e 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 7d 63 61 74 63 68 28 72 29 7b 65 5b 74 5d 3d 6e 7d 72 65 74 75 72 6e 20 6e 7d 7d 2c 33 32 35 30 30 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 39 33 36 39 34 30 29 3b 74 2e 65 78 70 6f 72 74 73 3d 21 65 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 37 21 3d 3d 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 7b 7d 2c 31 2c 7b 67 65 74 3a 66 75 6e 63 74 69 Data Ascii: r){var e=r(161581),o=Object.defineProperty;t.exports=function(t,n){try{o(e,t,{value:n,configurable:!0,writable:!0})}catch(r){e[t]=n}return n}},325008:function(t,n,r){var e=r(936940);t.exports=!e(function(){return 7!==Object.defineProperty({},1,{get:functi
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 29 26 26 76 6f 69 64 20 30 21 3d 3d 70 29 7b 69 66 28 74 79 70 65 6f 66 20 6c 3d 3d 74 79 70 65 6f 66 20 70 29 63 6f 6e 74 69 6e 75 65 3b 66 28 6c 2c 70 29 7d 28 74 2e 73 68 61 6d 7c 7c 70 26 26 70 2e 73 68 61 6d 29 26 26 69 28 6c 2c 22 73 68 61 6d 22 2c 21 30 29 2c 75 28 72 2c 73 2c 6c 2c 74 29 7d 7d 7d 2c 39 33 36 39 34 30 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 72 79 7b 72 65 74 75 72 6e 21 21 74 28 29 7d 63 61 74 63 68 28 74 29 7b 72 65 74 75 72 6e 21 30 7d 7d 7d 2c 39 36 32 35 35 37 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 39 33 36 39 34 30 29 3b 74 2e 65 78 70 6f 72 74 73 3d 21 65 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 28 66 75 6e 63 Data Ascii: )&&void 0!==p){if(typeof l==typeof p)continue;f(l,p)}(t.sham\|\|p&&p.sham)&&i(l,"sham",!0),u(r,s,l,t)}}},936940:function(t){t.exports=function(t){try{return!!t()}catch(t){return!0}}},962557:function(t,n,r){var e=r(936940);t.exports=!e(function(){var t=(func
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 7c 7c 74 68 69 73 7c 7c 46 75 6e 63 74 69 6f 6e 28 22 72 65 74 75 72 6e 20 74 68 69 73 22 29 28 29 7d 2c 37 34 30 33 36 32 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 35 38 31 30 33 31 29 2c 6f 3d 72 28 33 33 39 37 31 38 29 2c 69 3d 65 28 7b 7d 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 29 3b 74 2e 65 78 70 6f 72 74 73 3d 4f 62 6a 65 63 74 2e 68 61 73 4f 77 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 72 65 74 75 72 6e 20 69 28 6f 28 74 29 2c 6e 29 7d 7d 2c 36 32 34 39 30 36 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 7b 7d 7d 2c 33 34 39 32 34 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 33 32 35 30 30 38 29 2c 6f 3d 72 28 39 33 36 39 34 30 29 2c 69 3d 72 28 37 Data Ascii: \|\|this\|\|Function("return this")()},740362:function(t,n,r){var e=r(581031),o=r(339718),i=e({}.hasOwnProperty);t.exports=Object.hasOwn\|\|function(t,n){return i(o(t),n)}},624906:function(t){t.exports={}},34924:function(t,n,r){var e=r(325008),o=r(936940),i=r(7
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 20 69 28 74 29 3f 6f 28 74 29 3a 65 28 74 2c 7b 7d 29 7d 2c 67 65 74 74 65 72 46 6f 72 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 72 3b 69 66 28 21 66 28 6e 29 7c 7c 28 72 3d 6f 28 6e 29 29 2e 74 79 70 65 21 3d 3d 74 29 74 68 72 6f 77 20 79 28 22 49 6e 63 6f 6d 70 61 74 69 62 6c 65 20 72 65 63 65 69 76 65 72 2c 20 22 2b 74 2b 22 20 72 65 71 75 69 72 65 64 22 29 3b 72 65 74 75 72 6e 20 72 7d 7d 7d 7d 2c 33 35 34 38 34 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 31 37 34 31 32 34 29 2c 6f 3d 65 2e 61 6c 6c 3b 74 2e 65 78 70 6f 72 74 73 3d 65 2e 49 53 5f 48 54 4d 4c 44 44 41 3f 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 Data Ascii: i(t)?o(t):e(t,{})},getterFor:function(t){return function(n){var r;if(!f(n)\|\|(r=o(n)).type!==t)throw y("Incompatible receiver, "+t+" required");return r}}}},354848:function(t,n,r){var e=r(174124),o=e.all;t.exports=e.IS_HTMLDDA?function(t){return"function"
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 65 28 5b 5d 2e 6a 6f 69 6e 29 2c 6d 3d 63 26 26 21 6f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 38 21 3d 3d 62 28 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 22 6c 65 6e 67 74 68 22 2c 7b 76 61 6c 75 65 3a 38 7d 29 2e 6c 65 6e 67 74 68 7d 29 2c 78 3d 53 74 72 69 6e 67 28 53 74 72 69 6e 67 29 2e 73 70 6c 69 74 28 22 53 74 72 69 6e 67 22 29 2c 64 3d 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 22 53 79 6d 62 6f 6c 28 22 3d 3d 3d 79 28 76 28 6e 29 2c 30 2c 37 29 26 26 28 6e 3d 22 5b 22 2b 67 28 76 28 6e 29 2c 2f 5e 53 79 6d 62 6f 6c 5c 28 28 5b 5e 29 5d 2a 29 5c 29 2f 2c 22 24 31 22 29 2b 22 5d 22 29 2c 72 26 26 72 2e 67 65 74 74 65 72 26 26 28 6e 3d 22 67 65 74 20 22 2b 6e 29 2c 72 26 26 72 2e 73 65 74 74 65 72 26 Data Ascii: e([].join),m=c&&!o(function(){return 8!==b(function(){},"length",{value:8}).length}),x=String(String).split("String"),d=t.exports=function(t,n,r){"Symbol("===y(v(n),0,7)&&(n="["+g(v(n),/^Symbol$([^)]*)$/,"$1")+"]"),r&&r.getter&&(n="get "+n),r&&r.setter&
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 73 6f 72 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 22 29 3b 72 65 74 75 72 6e 22 76 61 6c 75 65 22 69 6e 20 72 26 26 28 74 5b 6e 5d 3d 72 2e 76 61 6c 75 65 29 2c 74 7d 7d 2c 33 34 37 37 32 32 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 33 32 35 30 30 38 29 2c 6f 3d 72 28 39 32 36 35 31 35 29 2c 69 3d 72 28 36 31 30 30 36 37 29 2c 75 3d 72 28 38 37 39 29 2c 63 3d 72 28 32 39 39 36 32 33 29 2c 66 3d 72 28 39 36 36 36 30 36 29 2c 61 3d 72 28 37 34 30 33 36 32 29 2c 73 3d 72 28 33 34 39 32 34 29 2c 70 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 3b 6e 2e 66 3d 65 3f 70 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 69 66 28 74 3d 63 28 74 29 2c 6e 3d 66 28 6e 29 2c 73 29 74 72 Data Ascii: sors not supported");return"value"in r&&(t[n]=r.value),t}},347722:function(t,n,r){var e=r(325008),o=r(926515),i=r(610067),u=r(879),c=r(299623),f=r(966606),a=r(740362),s=r(34924),p=Object.getOwnPropertyDescriptor;n.f=e?p:function(t,n){if(t=c(t),n=f(n),s)tr
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 2c 63 3d 72 28 32 34 30 33 33 29 2c 66 3d 6f 28 5b 5d 2e 63 6f 6e 63 61 74 29 3b 74 2e 65 78 70 6f 72 74 73 3d 65 28 22 52 65 66 6c 65 63 74 22 2c 22 6f 77 6e 4b 65 79 73 22 29 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 69 2e 66 28 63 28 74 29 29 2c 72 3d 75 2e 66 3b 72 65 74 75 72 6e 20 72 3f 66 28 6e 2c 72 28 74 29 29 3a 6e 7d 7d 2c 36 37 36 31 32 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 33 35 31 37 39 29 2c 6f 3d 54 79 70 65 45 72 72 6f 72 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 65 28 74 29 29 74 68 72 6f 77 20 6f 28 22 43 61 6e 27 74 20 63 61 6c 6c 20 6d 65 74 68 6f 64 20 6f 6e 20 22 2b 74 29 3b 72 65 74 75 72 6e 20 74 7d 7d 2c 38 38 33 35 33 39 3a 66 75 6e 63 Data Ascii: ,c=r(24033),f=o([].concat);t.exports=e("Reflect","ownKeys")\|\|function(t){var n=i.f(c(t)),r=u.f;return r?f(n,r(t)):n}},676125:function(t,n,r){var e=r(35179),o=TypeError;t.exports=function(t){if(e(t))throw o("Can't call method on "+t);return t}},883539:func
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 29 7b 76 61 72 20 65 3d 72 28 39 35 39 33 31 38 29 2c 6f 3d 4d 61 74 68 2e 6d 69 6e 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 3e 30 3f 6f 28 65 28 74 29 2c 39 30 30 37 31 39 39 32 35 34 37 34 30 39 39 31 29 3a 30 7d 7d 2c 33 33 39 37 31 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 36 37 36 31 32 35 29 2c 6f 3d 4f 62 6a 65 63 74 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6f 28 65 28 74 29 29 7d 7d 2c 36 39 31 35 35 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 39 32 36 35 31 35 29 2c 6f 3d 72 28 36 32 32 32 38 31 29 2c 69 3d 72 28 33 32 33 39 37 39 29 2c 75 3d 72 28 39 39 35 37 33 39 29 2c 63 3d Data Ascii: ){var e=r(959318),o=Math.min;t.exports=function(t){return t>0?o(e(t),9007199254740991):0}},339718:function(t,n,r){var e=r(676125),o=Object;t.exports=function(t){return o(e(t))}},691558:function(t,n,r){var e=r(926515),o=r(622281),i=r(323979),u=r(995739),c=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.9	49843	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	745	OUT	GET /assets/a6f6204cd40c3c5f5c14.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/assets/ac625b77a0bab0ee72df.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:23 UTC	967	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:23 GMT Content-Type: application/javascript Content-Length: 21811 Connection: close CF-Ray: 8d782e5eb8c26c7c-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "0fbb77d1b69f18df0fdcf836de1c4106" Last-Modified: Fri, 28 Jun 2024 00:43:11 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zahyCSEE72DiG3kzI3JnewWO6jv%2FynNSXk4DvVvdXAiHqgEkFS75Ss3GFI07AKcjefUZ14VkRXkWuroLaa8MKaB762Y0vEN4bNt%2FIdBuhII9X0eEMgoWFgD3feRA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 37 31 39 38 34 22 5d 2c 7b 37 37 32 34 32 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 39 33 33 36 37 36 29 2c 6f 3d 6e 28 39 33 38 35 30 37 29 2c 69 3d 54 79 70 65 45 72 72 6f 72 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 65 28 74 29 29 72 65 74 75 72 6e 20 74 3b 74 68 72 6f 77 20 69 28 6f 28 74 29 2b 22 20 69 73 20 6e 6f 74 20 61 20 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 7d 7d 2c 36 30 33 35 32 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["71984"],{772425:function(t,r,n){var e=n(933676),o=n(938507),i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not a constructor")}},603528:function(t,r
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 29 26 26 28 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 4c 28 22 49 6e 63 6f 72 72 65 63 74 20 69 6e 76 6f 63 61 74 69 6f 6e 22 29 7d 2c 50 29 29 66 6f 72 28 65 20 69 6e 20 4e 29 61 5b 65 5d 26 26 77 28 61 5b 65 5d 2c 46 29 3b 69 66 28 28 21 50 7c 7c 21 55 7c 7c 55 3d 3d 3d 5f 29 26 26 28 55 3d 46 2e 70 72 6f 74 6f 74 79 70 65 2c 50 29 29 66 6f 72 28 65 20 69 6e 20 4e 29 61 5b 65 5d 26 26 77 28 61 5b 65 5d 2e 70 72 6f 74 6f 74 79 70 65 2c 55 29 3b 69 66 28 50 26 26 41 28 4d 29 21 3d 3d 55 26 26 77 28 4d 2c 55 29 2c 66 26 26 21 79 28 55 2c 42 29 29 66 6f 72 28 65 20 69 6e 20 56 3d 21 30 2c 67 28 55 2c 42 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 66 75 6e 63 74 69 6f Data Ascii: Function.prototype)&&(F=function(){throw L("Incorrect invocation")},P))for(e in N)a[e]&&w(a[e],F);if((!P\|\|!U\|\|U===_)&&(U=F.prototype,P))for(e in N)a[e]&&w(a[e].prototype,U);if(P&&A(M)!==U&&w(M,U),f&&!y(U,B))for(e in V=!0,g(U,B,{configurable:!0,get:functio
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 29 2c 6c 3d 6e 28 31 34 34 37 34 38 29 2c 41 3d 6e 28 32 37 36 33 32 31 29 2c 77 3d 6e 28 35 33 37 34 34 33 29 2e 66 2c 78 3d 6e 28 36 39 32 39 39 34 29 2c 62 3d 6e 28 31 37 35 34 34 30 29 2c 54 3d 6e 28 38 36 35 33 31 32 29 2c 45 3d 6e 28 36 34 34 36 35 39 29 2c 49 3d 66 2e 50 52 4f 50 45 52 2c 52 3d 66 2e 43 4f 4e 46 49 47 55 52 41 42 4c 45 2c 6d 3d 22 41 72 72 61 79 42 75 66 66 65 72 22 2c 4f 3d 22 44 61 74 61 56 69 65 77 22 2c 4d 3d 22 70 72 6f 74 6f 74 79 70 65 22 2c 46 3d 22 57 72 6f 6e 67 20 69 6e 64 65 78 22 2c 55 3d 45 2e 67 65 74 74 65 72 46 6f 72 28 6d 29 2c 5f 3d 45 2e 67 65 74 74 65 72 46 6f 72 28 4f 29 2c 4c 3d 45 2e 73 65 74 2c 42 3d 65 5b 6d 5d 2c 43 3d 42 2c 53 3d 43 26 26 43 5b 4d 5d 2c 50 3d 65 5b 4f 5d 2c 56 3d 50 26 26 50 5b 4d 5d 2c Data Ascii: ),l=n(144748),A=n(276321),w=n(537443).f,x=n(692994),b=n(175440),T=n(865312),E=n(644659),I=f.PROPER,R=f.CONFIGURABLE,m="ArrayBuffer",O="DataView",M="prototype",F="Wrong index",U=E.getterFor(m),_=E.getterFor(O),L=E.set,B=e[m],C=B,S=C&&C[M],P=e[O],V=P&&P[M],
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 34 38 33 36 34 39 29 2c 28 74 6f 2e 67 65 74 49 6e 74 38 28 30 29 7c 7c 21 74 6f 2e 67 65 74 49 6e 74 38 28 31 29 29 26 26 73 28 56 2c 7b 73 65 74 49 6e 74 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 74 69 28 74 68 69 73 2c 74 2c 72 3c 3c 32 34 3e 3e 32 34 29 7d 2c 73 65 74 55 69 6e 74 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 74 69 28 74 68 69 73 2c 74 2c 72 3c 3c 32 34 3e 3e 32 34 29 7d 7d 2c 7b 75 6e 73 61 66 65 3a 21 30 7d 29 7d 65 6c 73 65 20 53 3d 28 43 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 70 28 74 68 69 73 2c 53 29 3b 76 61 72 20 72 3d 64 28 74 29 3b 4c 28 74 68 69 73 2c 7b 74 79 70 65 3a 6d 2c 62 79 74 65 73 3a 59 28 57 28 72 29 2c 30 29 2c 62 79 74 65 4c 65 6e 67 74 68 3a 72 7d 29 2c 21 69 26 26 28 74 68 69 73 2e 62 79 74 65 4c 65 6e Data Ascii: 483649),(to.getInt8(0)\|\|!to.getInt8(1))&&s(V,{setInt8:function(t,r){ti(this,t,r<<24>>24)},setUint8:function(t,r){ti(this,t,r<<24>>24)}},{unsafe:!0})}else S=(C=function(t){p(this,S);var r=d(t);L(this,{type:m,bytes:Y(W(r),0),byteLength:r}),!i&&(this.byteLen
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 28 74 2c 72 29 7b 24 28 74 68 69 73 2c 32 2c 74 2c 4b 2c 72 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 32 26 26 61 72 67 75 6d 65 6e 74 73 5b 32 5d 29 7d 2c 73 65 74 55 69 6e 74 31 36 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 24 28 74 68 69 73 2c 32 2c 74 2c 4b 2c 72 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 32 26 26 61 72 67 75 6d 65 6e 74 73 5b 32 5d 29 7d 2c 73 65 74 49 6e 74 33 32 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 24 28 74 68 69 73 2c 34 2c 74 2c 71 2c 72 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 32 26 26 61 72 67 75 6d 65 6e 74 73 5b 32 5d 29 7d 2c 73 65 74 55 69 6e 74 33 32 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 24 28 74 68 69 73 2c 34 2c 74 2c 71 2c 72 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e Data Ascii: (t,r){$(this,2,t,K,r,arguments.length>2&&arguments[2])},setUint16:function(t,r){$(this,2,t,K,r,arguments.length>2&&arguments[2])},setInt32:function(t,r){$(this,4,t,q,r,arguments.length>2&&arguments[2])},setUint32:function(t,r){$(this,4,t,q,r,arguments.len
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 65 28 64 2c 67 29 2c 45 3d 66 28 62 29 2c 49 3d 30 2c 52 3d 6c 7c 7c 61 2c 6d 3d 72 3f 52 28 76 2c 45 29 3a 6e 7c 7c 70 3f 52 28 76 2c 30 29 3a 76 6f 69 64 20 30 3b 45 3e 49 3b 49 2b 2b 29 69 66 28 28 68 7c 7c 49 20 69 6e 20 62 29 26 26 28 77 3d 54 28 41 3d 62 5b 49 5d 2c 49 2c 78 29 2c 74 29 29 7b 69 66 28 72 29 6d 5b 49 5d 3d 77 3b 65 6c 73 65 20 69 66 28 77 29 73 77 69 74 63 68 28 74 29 7b 63 61 73 65 20 33 3a 72 65 74 75 72 6e 21 30 3b 63 61 73 65 20 35 3a 72 65 74 75 72 6e 20 41 3b 63 61 73 65 20 36 3a 72 65 74 75 72 6e 20 49 3b 63 61 73 65 20 32 3a 63 28 6d 2c 41 29 7d 65 6c 73 65 20 73 77 69 74 63 68 28 74 29 7b 63 61 73 65 20 34 3a 72 65 74 75 72 6e 21 31 3b 63 61 73 65 20 37 3a 63 28 6d 2c 41 29 7d 7d 72 65 74 75 72 6e 20 79 3f 2d 31 3a 6f 7c 7c Data Ascii: e(d,g),E=f(b),I=0,R=l\|\|a,m=r?R(v,E):n\|\|p?R(v,0):void 0;E>I;I++)if((h\|\|I in b)&&(w=T(A=b[I],I,x),t)){if(r)m[I]=w;else if(w)switch(t){case 3:return!0;case 5:return A;case 6:return I;case 2:c(m,A)}else switch(t){case 4:return!1;case 7:c(m,A)}}return y?-1:o\|\|
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 3c 6f 3f 72 5b 75 2b 2b 5d 3a 6e 5b 66 2b 2b 5d 3b 72 65 74 75 72 6e 20 74 7d 3b 74 2e 65 78 70 6f 72 74 73 3d 69 7d 2c 33 30 38 30 32 30 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 34 39 38 35 37 36 29 2c 6f 3d 6e 28 39 33 33 36 37 36 29 2c 69 3d 6e 28 36 32 32 32 38 31 29 2c 75 3d 6e 28 36 34 31 32 33 36 29 28 22 73 70 65 63 69 65 73 22 29 2c 66 3d 41 72 72 61 79 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 72 3b 72 65 74 75 72 6e 20 65 28 74 29 26 26 28 6f 28 72 3d 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 28 72 3d 3d 3d 66 7c 7c 65 28 72 2e 70 72 6f 74 6f 74 79 70 65 29 29 3f 72 3d 76 6f 69 64 20 30 3a 69 28 72 29 26 26 6e 75 6c 6c 3d 3d 3d 28 72 3d 72 5b 75 5d 29 26 26 28 72 3d Data Ascii: <o?r[u++]:n[f++];return t};t.exports=i},308020:function(t,r,n){var e=n(498576),o=n(933676),i=n(622281),u=n(641236)("species"),f=Array;t.exports=function(t){var r;return e(t)&&(o(r=t.constructor)&&(r===f\|\|e(r.prototype))?r=void 0:i(r)&&null===(r=r[u])&&(r=
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 22 3a 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 63 28 72 3d 66 28 74 29 2c 75 29 29 3f 6e 3a 61 3f 69 28 72 29 3a 22 4f 62 6a 65 63 74 22 3d 3d 3d 28 65 3d 69 28 72 29 29 26 26 6f 28 72 2e 63 61 6c 6c 65 65 29 3f 22 41 72 67 75 6d 65 6e 74 73 22 3a 65 7d 7d 2c 31 38 32 38 36 37 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 39 36 36 36 30 36 29 2c 6f 3d 6e 28 39 37 31 33 31 29 2c 69 3d 6e 28 38 37 39 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 75 3d 65 28 72 29 3b 75 20 69 6e 20 74 3f 6f 2e 66 28 74 2c 75 2c 69 28 30 2c 6e 29 29 3a 74 5b 75 5d 3d 6e 7d 7d 2c 39 30 33 33 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 38 35 39 32 30 Data Ascii: ":"string"==typeof(n=c(r=f(t),u))?n:a?i(r):"Object"===(e=i(r))&&o(r.callee)?"Arguments":e}},182867:function(t,r,n){var e=n(966606),o=n(97131),i=n(879);t.exports=function(t,r,n){var u=e(r);u in t?o.f(t,u,i(0,n)):t[u]=n}},90338:function(t,r,n){var e=n(85920
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 40 40 69 74 65 72 61 74 6f 72 22 29 7c 7c 75 5b 65 28 74 29 5d 7d 7d 2c 39 38 31 39 37 31 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 39 32 36 35 31 35 29 2c 6f 3d 6e 28 35 32 36 39 38 38 29 2c 69 3d 6e 28 32 34 30 33 33 29 2c 75 3d 6e 28 39 33 38 35 30 37 29 2c 66 3d 6e 28 31 31 36 39 37 29 2c 61 3d 54 79 70 65 45 72 72 6f 72 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 76 61 72 20 6e 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3c 32 3f 66 28 74 29 3a 72 3b 69 66 28 6f 28 6e 29 29 72 65 74 75 72 6e 20 69 28 65 28 6e 2c 74 29 29 3b 74 68 72 6f 77 20 61 28 75 28 74 29 2b 22 20 69 73 20 6e 6f 74 20 69 74 65 72 61 62 6c 65 22 29 7d 7d 2c 33 33 39 33 39 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c Data Ascii: @@iterator")\|\|u[e(t)]}},981971:function(t,r,n){var e=n(926515),o=n(526988),i=n(24033),u=n(938507),f=n(11697),a=TypeError;t.exports=function(t,r){var n=arguments.length<2?f(t):r;if(o(n))return i(e(n,t));throw a(u(t)+" is not iterable")}},339399:function(t,
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 33 36 29 2c 6f 3d 6e 28 38 37 34 36 35 32 29 2c 69 3d 65 28 22 69 74 65 72 61 74 6f 72 22 29 2c 75 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 21 3d 3d 74 26 26 28 6f 2e 41 72 72 61 79 3d 3d 3d 74 7c 7c 75 5b 69 5d 3d 3d 3d 74 29 7d 7d 2c 34 39 38 35 37 36 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 33 33 32 39 31 36 29 3b 74 2e 65 78 70 6f 72 74 73 3d 41 72 72 61 79 2e 69 73 41 72 72 61 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 22 41 72 72 61 79 22 3d 3d 3d 65 28 74 29 7d 7d 2c 35 33 36 35 32 34 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 39 37 34 39 37 31 29 3b Data Ascii: 36),o=n(874652),i=e("iterator"),u=Array.prototype;t.exports=function(t){return void 0!==t&&(o.Array===t\|\|u[i]===t)}},498576:function(t,r,n){var e=n(332916);t.exports=Array.isArray\|\|function(t){return"Array"===e(t)}},536524:function(t,r,n){var e=n(974971);

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.9	49845	162.159.136.232	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	673	OUT	GET /assets/ac625b77a0bab0ee72df.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:23 UTC	974	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:23 GMT Content-Type: application/javascript Content-Length: 3530 Connection: close CF-Ray: 8d782e5eb9603ac1-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "be6064ff8c1d480afb80fe48762a06c1" Last-Modified: Fri, 28 Jun 2024 00:43:11 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z33%2BbWMxF%2ByEo%2BuNtfpNZjn4nvorjYgFFDZSgzLyH%2Fm%2BZICy07jcFkTYXMg1QEVvYGcJasTStyvfaVqgq6WIUfgEBoKZjXbjM%2FrQJ51zQa2GEhZHGcqGLrvN4d8H"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:23 UTC	395	IN	Data Raw: 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 7b 35 30 34 30 35 33 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 65 29 7b 65 2e 64 28 74 2c 7b 46 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 65 28 35 31 38 32 36 33 29 2c 65 28 39 37 30 31 37 33 29 2c 65 28 35 32 30 37 31 32 29 2c 65 28 32 36 38 31 31 31 29 2c 65 28 39 34 31 34 39 37 29 2c 65 28 33 32 30 32 36 29 2c 65 28 34 38 30 38 33 39 29 2c 65 28 37 34 34 32 38 35 29 2c 65 28 34 39 32 32 35 37 29 2c 65 28 38 37 33 38 31 37 29 2c 65 28 38 36 33 39 34 32 29 2c 65 28 36 34 32 35 34 39 29 2c 65 28 36 35 33 30 34 31 29 3b 76 61 72 20 6e 3d 65 28 37 38 38 39 30 30 29 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 72 29 7b 6c 65 74 20 74 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: (()=>{"use strict";var r={504053:function(r,t,e){e.d(t,{F:function(){return o}}),e(518263),e(970173),e(520712),e(268111),e(941497),e(32026),e(480839),e(744285),e(492257),e(873817),e(863942),e(642549),e(653041);var n=e(788900);function o(r){let t=function(
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 32 5d 3c 3c 31 36 2c 6c 3d 72 5b 33 5d 7c 72 5b 34 5d 3c 3c 38 2c 73 3d 28 36 33 26 63 29 2f 36 33 2c 70 3d 28 63 3e 3e 36 26 36 33 29 2f 33 31 2e 35 2d 31 2c 64 3d 28 63 3e 3e 31 32 26 36 33 29 2f 33 31 2e 35 2d 31 2c 76 3d 63 3e 3e 32 33 2c 68 3d 6c 3e 3e 31 35 2c 62 3d 69 28 33 2c 68 3f 76 3f 35 3a 37 3a 37 26 6c 29 2c 67 3d 69 28 33 2c 68 3f 37 26 6c 3a 76 3f 35 3a 37 29 2c 79 3d 76 3f 28 31 35 26 72 5b 35 5d 29 2f 31 35 3a 31 2c 4f 3d 28 72 5b 35 5d 3e 3e 34 29 2f 31 35 2c 6d 3d 76 3f 36 3a 35 2c 77 3d 30 2c 78 3d 28 74 2c 65 2c 6e 29 3d 3e 7b 6c 65 74 20 6f 3d 5b 5d 3b 66 6f 72 28 6c 65 74 20 66 3d 30 3b 66 3c 65 3b 66 2b 2b 29 66 6f 72 28 6c 65 74 20 69 3d 66 3f 30 3a 31 3b 69 2a 65 3c 74 2a 28 65 2d 66 29 3b 69 2b 2b 29 6f 2e 70 75 73 68 28 28 28 Data Ascii: 2]<<16,l=r[3]\|r[4]<<8,s=(63&c)/63,p=(c>>6&63)/31.5-1,d=(c>>12&63)/31.5-1,v=c>>23,h=l>>15,b=i(3,h?v?5:7:7&l),g=i(3,h?7&l:v?5:7),y=v?(15&r[5])/15:1,O=(r[5]>>4)/15,m=v?6:5,w=0,x=(t,e,n)=>{let o=[];for(let f=0;f<e;f++)for(let i=f?0:1;ie<t(e-f);i++)o.push(((
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 29 7b 76 61 72 20 6f 3d 74 5b 6e 5d 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 6f 29 72 65 74 75 72 6e 20 6f 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 66 3d 74 5b 6e 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 72 5b 6e 5d 2e 63 61 6c 6c 28 66 2e 65 78 70 6f 72 74 73 2c 66 2c 66 2e 65 78 70 6f 72 74 73 2c 65 29 2c 66 2e 65 78 70 6f 72 74 73 7d 65 2e 6d 3d 72 2c 65 2e 78 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 65 2e 4f 28 76 6f 69 64 20 30 2c 5b 22 37 38 31 38 37 22 2c 22 37 31 39 38 34 22 2c 22 34 33 32 32 32 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 28 22 31 37 31 37 31 36 22 29 7d 29 3b 72 65 74 75 72 6e 20 72 3d 65 2e 4f 28 72 29 7d 2c 65 2e 6e 3d 66 75 6e 63 74 69 6f 6e 28 72 29 7b 76 61 72 20 74 3d Data Ascii: ){var o=t[n];if(void 0!==o)return o.exports;var f=t[n]={exports:{}};return r[n].call(f.exports,f,f.exports,e),f.exports}e.m=r,e.x=function(){var r=e.O(void 0,["78187","71984","43222"],function(){return e("171716")});return r=e.O(r)},e.n=function(r){var t=
2024-10-24 07:16:23 UTC	397	IN	Data Raw: 37 38 31 38 37 22 2c 22 37 31 39 38 34 22 2c 22 34 33 32 32 32 22 5d 2e 6d 61 70 28 65 2e 65 2c 65 29 29 2e 74 68 65 6e 28 72 29 7d 7d 29 28 29 2c 28 28 29 3d 3e 7b 76 61 72 20 72 3d 7b 37 37 34 35 39 3a 31 7d 3b 65 2e 66 2e 69 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 21 72 5b 74 5d 26 26 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 65 2e 70 2b 65 2e 75 28 74 29 29 7d 3b 76 61 72 20 74 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 2c 6e 3d 74 2e 70 75 73 68 2e 62 69 6e 64 28 74 29 3b 74 2e 70 75 73 68 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6f 3d 74 5b 30 5d 2c 66 3d 74 5b 31 5d 2c 69 3d 74 5b 32 5d 3b 66 Data Ascii: 78187","71984","43222"].map(e.e,e)).then(r)}})(),(()=>{var r={77459:1};e.f.i=function(t,n){!r[t]&&importScripts(e.p+e.u(t))};var t=this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[],n=t.push.bind(t);t.push=function(t){var o=t[0],f=t[1],i=t[2];f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.9	49842	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	1686	OUT	POST /api/v9/science HTTP/1.1 Host: discord.com Connection: keep-alive Content-Length: 1122 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Super-Properties: eyJvcyI6IldpbmRvd3MiLCJicm93c2VyIjoiQ2hyb21lIiwiZGV2aWNlIjoiIiwic3lzdGVtX2xvY2FsZSI6ImVuLVVTIiwiYnJvd3Nlcl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2IiwiYnJvd3Nlcl92ZXJzaW9uIjoiMTE3LjAuMC4wIiwib3NfdmVyc2lvbiI6IjEwIiwicmVmZXJyZXIiOiIiLCJyZWZlcnJpbmdfZG9tYWluIjoiIiwicmVmZXJyZXJfY3VycmVudCI6IiIsInJlZmVycmluZ19kb21haW5fY3VycmVudCI6IiIsInJlbGVhc2VfY2hhbm5lbCI6InN0YWJsZSIsImNsaWVudF9idWlsZF9udW1iZXIiOjMzODU0MCwiY2xpZW50X2V2ZW50X3NvdXJjZSI6bnVsbH0= X-Fingerprint: 1298907928115281940.cAYkMt3Px22XYBub5q1myFVn9es X-Debug-Options: bugReporterEnabled sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Discord-Timezone: America/New_York Content-Type: application/json X-Discord-Locale: en-US sec-ch-ua-platform: "Windows" Accept: / Origin: https://discord.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:23 UTC	1122	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 74 79 70 65 22 3a 22 75 73 65 72 5f 66 69 6e 67 65 72 70 72 69 6e 74 5f 63 68 61 6e 67 65 64 22 2c 22 70 72 6f 70 65 72 74 69 65 73 22 3a 7b 22 63 6c 69 65 6e 74 5f 74 72 61 63 6b 5f 74 69 6d 65 73 74 61 6d 70 22 3a 31 37 32 39 37 35 34 31 38 31 34 38 34 2c 22 6f 6c 64 5f 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 6e 75 6c 6c 2c 22 6e 65 77 5f 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 31 32 39 38 39 30 37 39 32 38 31 31 35 32 38 31 39 34 30 22 2c 22 63 6c 69 65 6e 74 5f 70 65 72 66 6f 72 6d 61 6e 63 65 5f 6d 65 6d 6f 72 79 22 3a 30 2c 22 61 63 63 65 73 73 69 62 69 6c 69 74 79 5f 66 65 61 74 75 72 65 73 22 3a 31 32 38 2c 22 72 65 6e 64 65 72 65 64 5f 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 55 53 22 2c 22 75 70 74 69 6d 65 5f Data Ascii: {"events":[{"type":"user_fingerprint_changed","properties":{"client_track_timestamp":1729754181484,"old_fingerprint":null,"new_fingerprint":"1298907928115281940","client_performance_memory":0,"accessibility_features":128,"rendered_locale":"en-US","uptime_
2024-10-24 07:16:23 UTC	827	IN	HTTP/1.1 204 No Content Date: Thu, 24 Oct 2024 07:16:23 GMT Connection: close vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers access-control-allow-origin: https://discord.com via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5TE5Eb2GURaXzG1X6X7i6%2Bh4FTkmMCTmM6yIdHzhTVPBpAs4a%2Bmnj9hnmJCO8W104U1uwkzT4lUxxBm6WUZjkVDlZA%2BgH5%2BIeM0vqIF2W59g1zhXCDUu4WN%2F8TzY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Server: cloudflare CF-RAY: 8d782e5eb9c03593-DFW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.9	49846	162.159.136.232	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	673	OUT	GET /assets/29a63f12209c956d9204.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:23 UTC	964	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:23 GMT Content-Type: application/javascript Content-Length: 2750 Connection: close CF-Ray: 8d782e5eba1be7f7-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "390a7ab1f964aa8cb1b87dd13732c3bc" Last-Modified: Tue, 30 Jul 2024 22:07:30 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dn%2FOZRmqObNRzayvUbmwom23lT73VuCRGdMWUnxb5kHZBa2dUz2gpiCORtFRpAUvtlGgk2ZNqUtwZlU2pbKLuAit3MNtMAOZVOLpkDzRhchMziSCYou0fNHbqZt2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:23 UTC	405	IN	Data Raw: 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 7b 31 33 37 39 32 30 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 2c 69 3b 6e 2e 64 28 72 2c 7b 4a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 7d 2c 7a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 7d 7d 29 2c 28 69 3d 65 7c 7c 28 65 3d 7b 7d 29 29 5b 69 2e 4e 4f 4e 45 3d 30 5d 3d 22 4e 4f 4e 45 22 2c 69 5b 69 2e 53 4f 43 49 41 4c 3d 31 5d 3d 22 53 4f 43 49 41 4c 22 2c 69 5b 69 2e 43 41 53 55 41 4c 3d 32 5d 3d 22 43 41 53 55 41 4c 22 2c 69 5b 69 2e 43 4f 4d 50 45 54 49 54 49 56 45 3d 33 5d 3d 22 43 4f 4d 50 45 54 49 54 49 56 45 22 2c 69 5b 69 2e 43 52 45 41 54 49 56 45 3d 34 5d 3d 22 43 52 45 41 54 49 56 45 22 2c 69 5b 69 2e 56 45 Data Ascii: (()=>{"use strict";var t={137920:function(t,r,n){var e,i;n.d(r,{J:function(){return u},z:function(){return e}}),(i=e\|\|(e={}))[i.NONE=0]="NONE",i[i.SOCIAL=1]="SOCIAL",i[i.CASUAL=2]="CASUAL",i[i.COMPETITIVE=3]="COMPETITIVE",i[i.CREATIVE=4]="CREATIVE",i[i.VE
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 3b 76 61 72 20 65 3d 6e 28 31 33 37 39 32 30 29 3b 66 75 6e 63 74 69 6f 6e 20 69 28 74 2c 72 29 7b 6c 65 74 20 6e 3d 30 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 72 2e 67 61 6d 65 73 26 26 28 6e 2b 3d 32 2a 72 2e 67 61 6d 65 73 2e 66 69 6c 74 65 72 28 72 3d 3e 74 2e 67 61 6d 65 73 2e 69 6e 63 6c 75 64 65 73 28 72 29 29 2e 6c 65 6e 67 74 68 29 2c 6e 75 6c 6c 21 3d 72 2e 70 6c 61 79 73 74 79 6c 65 26 26 28 72 2e 70 6c 61 79 73 74 79 6c 65 3d 3d 3d 74 2e 70 6c 61 79 73 74 79 6c 65 3f 6e 2b 3d 32 3a 65 2e 4a 5b 74 2e 70 6c 61 79 73 74 79 6c 65 5d 3d 3d 3d 65 2e 4a 5b 72 2e 70 6c 61 79 73 74 79 6c 65 5d 26 26 28 6e 2b 3d 31 29 29 2c 6e 75 6c 6c 21 3d 72 2e 74 72 61 69 74 73 26 26 28 6e 2b 3d 32 2a 41 72 72 61 79 Data Ascii: on(){return i}});var e=n(137920);function i(t,r){let n=0;return null!=r.games&&(n+=2r.games.filter(r=>t.games.includes(r)).length),null!=r.playstyle&&(r.playstyle===t.playstyle?n+=2:e.J[t.playstyle]===e.J[r.playstyle]&&(n+=1)),null!=r.traits&&(n+=2Array
2024-10-24 07:16:23 UTC	976	IN	Data Raw: 72 65 74 75 72 6e 20 74 68 69 73 7c 7c 46 75 6e 63 74 69 6f 6e 28 22 72 65 74 75 72 6e 20 74 68 69 73 22 29 28 29 7d 63 61 74 63 68 28 74 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 29 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 7d 7d 28 29 2c 6e 2e 6f 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 72 29 7d 2c 28 28 29 3d 3e 7b 76 61 72 20 74 3d 5b 5d 3b 6e 2e 4f 3d 66 75 6e 63 74 69 6f 6e 28 72 2c 65 2c 69 2c 75 29 7b 69 66 28 65 29 7b 75 3d 75 7c 7c 30 3b 66 6f 72 28 76 61 72 20 6f 3d 74 2e 6c 65 6e 67 74 68 3b 6f 3e 30 26 26 74 5b 6f 2d 31 5d 5b 32 5d 3e 75 3b 6f 2d 2d 29 74 5b 6f 5d Data Ascii: return this\|\|Function("return this")()}catch(t){if("object"==typeof window)return window}}(),n.o=function(t,r){return Object.prototype.hasOwnProperty.call(t,r)},(()=>{var t=[];n.O=function(r,e,i,u){if(e){u=u\|\|0;for(var o=t.length;o>0&&t[o-1][2]>u;o--)t[o]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.9	49844	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	1685	OUT	POST /api/v9/science HTTP/1.1 Host: discord.com Connection: keep-alive Content-Length: 720 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Super-Properties: eyJvcyI6IldpbmRvd3MiLCJicm93c2VyIjoiQ2hyb21lIiwiZGV2aWNlIjoiIiwic3lzdGVtX2xvY2FsZSI6ImVuLVVTIiwiYnJvd3Nlcl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2IiwiYnJvd3Nlcl92ZXJzaW9uIjoiMTE3LjAuMC4wIiwib3NfdmVyc2lvbiI6IjEwIiwicmVmZXJyZXIiOiIiLCJyZWZlcnJpbmdfZG9tYWluIjoiIiwicmVmZXJyZXJfY3VycmVudCI6IiIsInJlZmVycmluZ19kb21haW5fY3VycmVudCI6IiIsInJlbGVhc2VfY2hhbm5lbCI6InN0YWJsZSIsImNsaWVudF9idWlsZF9udW1iZXIiOjMzODU0MCwiY2xpZW50X2V2ZW50X3NvdXJjZSI6bnVsbH0= X-Fingerprint: 1298907928115281940.cAYkMt3Px22XYBub5q1myFVn9es X-Debug-Options: bugReporterEnabled sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Discord-Timezone: America/New_York Content-Type: application/json X-Discord-Locale: en-US sec-ch-ua-platform: "Windows" Accept: / Origin: https://discord.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:23 UTC	720	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 74 79 70 65 22 3a 22 65 78 70 65 72 69 6d 65 6e 74 5f 75 73 65 72 5f 74 72 69 67 67 65 72 65 64 22 2c 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 31 32 39 38 39 30 37 39 32 38 31 31 35 32 38 31 39 34 30 2e 63 41 59 6b 4d 74 33 50 78 32 32 58 59 42 75 62 35 71 31 6d 79 46 56 6e 39 65 73 22 2c 22 70 72 6f 70 65 72 74 69 65 73 22 3a 7b 22 63 6c 69 65 6e 74 5f 74 72 61 63 6b 5f 74 69 6d 65 73 74 61 6d 70 22 3a 31 37 32 39 37 35 34 31 38 31 34 38 37 2c 22 6e 61 6d 65 22 3a 22 32 30 32 33 2d 30 39 5f 72 65 64 65 73 69 67 6e 65 64 5f 69 63 6f 6e 73 5f 65 78 70 65 72 69 6d 65 6e 74 22 2c 22 72 65 76 69 73 69 6f 6e 22 3a 31 2c 22 70 6f 70 75 6c 61 74 69 6f 6e 22 3a 30 2c 22 62 75 63 6b 65 74 22 3a 31 2c 22 6c 6f 63 61 74 69 Data Ascii: {"events":[{"type":"experiment_user_triggered","fingerprint":"1298907928115281940.cAYkMt3Px22XYBub5q1myFVn9es","properties":{"client_track_timestamp":1729754181487,"name":"2023-09_redesigned_icons_experiment","revision":1,"population":0,"bucket":1,"locati
2024-10-24 07:16:23 UTC	821	IN	HTTP/1.1 204 No Content Date: Thu, 24 Oct 2024 07:16:23 GMT Connection: close vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers access-control-allow-origin: https://discord.com via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8qXw%2BioKnZbexFqlxst48HYn3TOv4ivGpfZ5IYndFzxSoUZVsR6uAQ2h2vhNGIO6ZGuNQ69Ut2zlQGvDe6AtugtvW%2F2pxcWYbwqQjHkPRvyuVi1JS8TO1jiSYEWX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Server: cloudflare CF-RAY: 8d782e5ec8962c8f-DFW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.9	49850	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	868	OUT	GET /assets/1f7f046253c197b5a419.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:23 UTC	962	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:23 GMT Content-Type: text/javascript Content-Length: 17462 Connection: close CF-Ray: 8d782e5f5d196be0-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "3b98c1ef9293d482a5099fdb6984946f" Last-Modified: Tue, 15 Oct 2024 21:50:02 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eAID2dShMDPA05Tur7x9DZf8Ph%2BYyE2M1Zs0rj%2Fwzy%2FhKGXEZthzBicQVlw43B4Uqkz24bVd2PgNk8xHjhK1FTML28FNZN5ShZaWCVZbOeVNVBsbwHhV5CPZGYHC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 31 35 38 31 32 22 5d 2c 7b 38 38 34 38 33 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6f 3d 72 28 33 31 31 35 39 36 29 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 7d 69 2e 72 65 73 65 74 57 61 72 6e 69 6e 67 43 61 63 68 65 3d 6e 2c 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 74 2c 65 2c 72 2c 6e 2c 69 2c 61 29 7b 69 66 28 61 21 3d 3d 6f 29 7b 76 61 72 20 75 3d 45 72 72 6f 72 28 22 43 61 6c 6c Data Ascii: (this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["15812"],{884835:function(t,e,r){"use strict";var o=r(311596);function n(){}function i(){}i.resetWarningCache=n,t.exports=function(){function t(t,e,r,n,i,a){if(a!==o){var u=Error("Call
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6c 65 6e 67 74 68 7d 2c 70 75 74 42 69 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 74 68 69 73 2e 6c 65 6e 67 74 68 2f 38 29 3b 74 68 69 73 2e 62 75 66 66 65 72 2e 6c 65 6e 67 74 68 3c 3d 65 26 26 74 68 69 73 2e 62 75 66 66 65 72 2e 70 75 73 68 28 30 29 2c 74 26 26 28 74 68 69 73 2e 62 75 66 66 65 72 5b 65 5d 7c 3d 31 32 38 3e 3e 3e 74 68 69 73 2e 6c 65 6e 67 74 68 25 38 29 2c 74 68 69 73 2e 6c 65 6e 67 74 68 2b 2b 7d 7d 2c 74 2e 65 78 70 6f 72 74 73 3d 65 7d 2c 39 33 33 39 38 32 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 7b 4c 3a 31 2c 4d 3a 30 2c 51 3a 33 2c 48 3a 32 7d 7d 2c 36 36 39 30 31 33 3a 66 75 6e 63 Data Ascii: :function(){return this.length},putBit:function(t){var e=Math.floor(this.length/8);this.buffer.length<=e&&this.buffer.push(0),t&&(this.buffer[e]\|=128>>>this.length%8),this.length++}},t.exports=e},933982:function(t){t.exports={L:1,M:0,Q:3,H:2}},669013:func
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 74 3c 30 7c 7c 74 68 69 73 2e 6d 6f 64 75 6c 65 43 6f 75 6e 74 3c 3d 74 7c 7c 65 3c 30 7c 7c 74 68 69 73 2e 6d 6f 64 75 6c 65 43 6f 75 6e 74 3c 3d 65 29 74 68 72 6f 77 20 45 72 72 6f 72 28 74 2b 22 2c 22 2b 65 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 74 5d 5b 65 5d 7d 2c 6c 2e 67 65 74 4d 6f 64 75 6c 65 43 6f 75 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6d 6f 64 75 6c 65 43 6f 75 6e 74 7d 2c 6c 2e 6d 61 6b 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 74 79 70 65 4e 75 6d 62 65 72 3c 31 29 7b 76 61 72 20 74 3d 31 3b 66 6f 72 28 74 3d 31 3b 74 3c 34 30 3b 74 2b 2b 29 7b 66 6f 72 28 76 61 72 20 65 3d 6e 2e 67 65 74 52 53 42 6c 6f Data Ascii: function(t,e){if(t<0\|\|this.moduleCount<=t\|\|e<0\|\|this.moduleCount<=e)throw Error(t+","+e);return this.modules[t][e]},l.getModuleCount=function(){return this.moduleCount},l.make=function(){if(this.typeNumber<1){var t=1;for(t=1;t<40;t++){for(var e=n.getRSBlo
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 3c 3d 65 2b 6f 29 26 26 28 30 3c 3d 72 26 26 72 3c 3d 36 26 26 28 30 3d 3d 6f 7c 7c 36 3d 3d 6f 29 7c 7c 30 3c 3d 6f 26 26 6f 3c 3d 36 26 26 28 30 3d 3d 72 7c 7c 36 3d 3d 72 29 7c 7c 32 3c 3d 72 26 26 72 3c 3d 34 26 26 32 3c 3d 6f 26 26 6f 3c 3d 34 3f 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 74 2b 72 5d 5b 65 2b 6f 5d 3d 21 30 3a 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 74 2b 72 5d 5b 65 2b 6f 5d 3d 21 31 29 7d 2c 6c 2e 67 65 74 42 65 73 74 4d 61 73 6b 50 61 74 74 65 72 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 30 2c 65 3d 30 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 74 68 69 73 2e 6d 61 6b 65 49 6d 70 6c 28 21 30 2c 72 29 3b 76 61 72 20 6f 3d 61 2e 67 65 74 4c 6f 73 74 50 6f 69 6e 74 28 74 68 69 73 29 3b 28 30 3d 3d 72 7c 7c 74 3e Data Ascii: <=e+o)&&(0<=r&&r<=6&&(0==o\|\|6==o)\|\|0<=o&&o<=6&&(0==r\|\|6==r)\|\|2<=r&&r<=4&&2<=o&&o<=4?this.modules[t+r][e+o]=!0:this.modules[t+r][e+o]=!1)},l.getBestMaskPattern=function(){for(var t=0,e=0,r=0;r<8;r++){this.makeImpl(!0,r);var o=a.getLostPoint(this);(0==r\|\|t>
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 5d 5b 4d 61 74 68 2e 66 6c 6f 6f 72 28 72 2f 33 29 5d 3d 6f 7d 7d 2c 6c 2e 73 65 74 75 70 54 79 70 65 49 6e 66 6f 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 74 68 69 73 2e 65 72 72 6f 72 43 6f 72 72 65 63 74 4c 65 76 65 6c 3c 3c 33 7c 65 2c 6f 3d 61 2e 67 65 74 42 43 48 54 79 70 65 49 6e 66 6f 28 72 29 2c 6e 3d 30 3b 6e 3c 31 35 3b 6e 2b 2b 29 7b 76 61 72 20 69 3d 21 74 26 26 28 6f 3e 3e 6e 26 31 29 3d 3d 31 3b 6e 3c 36 3f 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 6e 5d 5b 38 5d 3d 69 3a 6e 3c 38 3f 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 6e 2b 31 5d 5b 38 5d 3d 69 3a 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 74 68 69 73 2e 6d 6f 64 75 6c 65 43 6f 75 6e 74 2d 31 35 2b 6e 5d 5b 38 5d 3d 69 7d 66 6f 72 28 76 61 72 20 6e 3d 30 3b 6e Data Ascii: ][Math.floor(r/3)]=o}},l.setupTypeInfo=function(t,e){for(var r=this.errorCorrectLevel<<3\|e,o=a.getBCHTypeInfo(r),n=0;n<15;n++){var i=!t&&(o>>n&1)==1;n<6?this.modules[n][8]=i:n<8?this.modules[n+1][8]=i:this.modules[this.moduleCount-15+n][8]=i}for(var n=0;n
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 74 68 29 2c 73 3d 41 72 72 61 79 28 65 2e 6c 65 6e 67 74 68 29 2c 6c 3d 30 3b 6c 3c 65 2e 6c 65 6e 67 74 68 3b 6c 2b 2b 29 7b 76 61 72 20 66 3d 65 5b 6c 5d 2e 64 61 74 61 43 6f 75 6e 74 2c 68 3d 65 5b 6c 5d 2e 74 6f 74 61 6c 43 6f 75 6e 74 2d 66 3b 6f 3d 4d 61 74 68 2e 6d 61 78 28 6f 2c 66 29 2c 6e 3d 4d 61 74 68 2e 6d 61 78 28 6e 2c 68 29 2c 69 5b 6c 5d 3d 41 72 72 61 79 28 66 29 3b 66 6f 72 28 76 61 72 20 67 3d 30 3b 67 3c 69 5b 6c 5d 2e 6c 65 6e 67 74 68 3b 67 2b 2b 29 69 5b 6c 5d 5b 67 5d 3d 32 35 35 26 74 2e 62 75 66 66 65 72 5b 67 2b 72 5d 3b 72 2b 3d 66 3b 76 61 72 20 63 3d 61 2e 67 65 74 45 72 72 6f 72 43 6f 72 72 65 63 74 50 6f 6c 79 6e 6f 6d 69 61 6c 28 68 29 2c 64 3d 6e 65 77 20 75 28 69 5b 6c 5d 2c 63 2e 67 65 74 4c 65 6e 67 74 68 28 29 2d 31 Data Ascii: th),s=Array(e.length),l=0;l<e.length;l++){var f=e[l].dataCount,h=e[l].totalCount-f;o=Math.max(o,f),n=Math.max(n,h),i[l]=Array(f);for(var g=0;g<i[l].length;g++)i[l][g]=255&t.buffer[g+r];r+=f;var c=a.getErrorCorrectPolynomial(h),d=new u(i[l],c.getLength()-1
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 32 31 5d 2c 5b 37 2c 34 32 2c 31 34 2c 34 2c 34 33 2c 31 35 5d 2c 5b 34 2c 31 33 33 2c 31 30 37 5d 2c 5b 38 2c 35 39 2c 33 37 2c 31 2c 36 30 2c 33 38 5d 2c 5b 38 2c 34 34 2c 32 30 2c 34 2c 34 35 2c 32 31 5d 2c 5b 31 32 2c 33 33 2c 31 31 2c 34 2c 33 34 2c 31 32 5d 2c 5b 33 2c 31 34 35 2c 31 31 35 2c 31 2c 31 34 36 2c 31 31 36 5d 2c 5b 34 2c 36 34 2c 34 30 2c 35 2c 36 35 2c 34 31 5d 2c 5b 31 31 2c 33 36 2c 31 36 2c 35 2c 33 37 2c 31 37 5d 2c 5b 31 31 2c 33 36 2c 31 32 2c 35 2c 33 37 2c 31 33 5d 2c 5b 35 2c 31 30 39 2c 38 37 2c 31 2c 31 31 30 2c 38 38 5d 2c 5b 35 2c 36 35 2c 34 31 2c 35 2c 36 36 2c 34 32 5d 2c 5b 35 2c 35 34 2c 32 34 2c 37 2c 35 35 2c 32 35 5d 2c 5b 31 31 2c 33 36 2c 31 32 5d 2c 5b 35 2c 31 32 32 2c 39 38 2c 31 2c 31 32 33 2c 39 39 5d 2c 5b Data Ascii: 21],[7,42,14,4,43,15],[4,133,107],[8,59,37,1,60,38],[8,44,20,4,45,21],[12,33,11,4,34,12],[3,145,115,1,146,116],[4,64,40,5,65,41],[11,36,16,5,37,17],[11,36,12,5,37,13],[5,109,87,1,110,88],[5,65,41,5,66,42],[5,54,24,7,55,25],[11,36,12],[5,122,98,1,123,99],[
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 35 34 2c 32 34 2c 32 35 2c 35 35 2c 32 35 5d 2c 5b 32 33 2c 34 35 2c 31 35 2c 32 35 2c 34 36 2c 31 36 5d 2c 5b 31 33 2c 31 34 35 2c 31 31 35 2c 33 2c 31 34 36 2c 31 31 36 5d 2c 5b 32 2c 37 34 2c 34 36 2c 32 39 2c 37 35 2c 34 37 5d 2c 5b 34 32 2c 35 34 2c 32 34 2c 31 2c 35 35 2c 32 35 5d 2c 5b 32 33 2c 34 35 2c 31 35 2c 32 38 2c 34 36 2c 31 36 5d 2c 5b 31 37 2c 31 34 35 2c 31 31 35 5d 2c 5b 31 30 2c 37 34 2c 34 36 2c 32 33 2c 37 35 2c 34 37 5d 2c 5b 31 30 2c 35 34 2c 32 34 2c 33 35 2c 35 35 2c 32 35 5d 2c 5b 31 39 2c 34 35 2c 31 35 2c 33 35 2c 34 36 2c 31 36 5d 2c 5b 31 37 2c 31 34 35 2c 31 31 35 2c 31 2c 31 34 36 2c 31 31 36 5d 2c 5b 31 34 2c 37 34 2c 34 36 2c 32 31 2c 37 35 2c 34 37 5d 2c 5b 32 39 2c 35 34 2c 32 34 2c 31 39 2c 35 35 2c 32 35 5d 2c 5b 31 Data Ascii: 54,24,25,55,25],[23,45,15,25,46,16],[13,145,115,3,146,116],[2,74,46,29,75,47],[42,54,24,1,55,25],[23,45,15,28,46,16],[17,145,115],[10,74,46,23,75,47],[10,54,24,35,55,25],[19,45,15,35,46,16],[17,145,115,1,146,116],[14,74,46,21,75,47],[29,54,24,19,55,25],[1
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 7b 67 6c 6f 67 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 74 3c 31 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 67 6c 6f 67 28 22 2b 74 2b 22 29 22 29 3b 72 65 74 75 72 6e 20 65 2e 4c 4f 47 5f 54 41 42 4c 45 5b 74 5d 7d 2c 67 65 78 70 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 3b 74 3c 30 3b 29 74 2b 3d 32 35 35 3b 66 6f 72 28 3b 74 3e 3d 32 35 36 3b 29 74 2d 3d 32 35 35 3b 72 65 74 75 72 6e 20 65 2e 45 58 50 5f 54 41 42 4c 45 5b 74 5d 7d 2c 45 58 50 5f 54 41 42 4c 45 3a 41 72 72 61 79 28 32 35 36 29 2c 4c 4f 47 5f 54 41 42 4c 45 3a 41 72 72 61 79 28 32 35 36 29 7d 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 65 2e 45 58 50 5f 54 41 42 4c 45 5b 72 5d 3d 31 3c 3c 72 3b 66 6f 72 28 76 61 72 20 72 3d 38 Data Ascii: ion(t){for(var e={glog:function(t){if(t<1)throw Error("glog("+t+")");return e.LOG_TABLE[t]},gexp:function(t){for(;t<0;)t+=255;for(;t>=256;)t-=255;return e.EXP_TABLE[t]},EXP_TABLE:Array(256),LOG_TABLE:Array(256)},r=0;r<8;r++)e.EXP_TABLE[r]=1<<r;for(var r=8
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 3c 3c 31 30 3b 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 65 29 2d 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 75 2e 47 31 35 29 3e 3d 30 3b 29 65 5e 3d 75 2e 47 31 35 3c 3c 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 65 29 2d 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 75 2e 47 31 35 29 3b 72 65 74 75 72 6e 28 74 3c 3c 31 30 7c 65 29 5e 75 2e 47 31 35 5f 4d 41 53 4b 7d 2c 67 65 74 42 43 48 54 79 70 65 4e 75 6d 62 65 72 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 3c 3c 31 32 3b 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 65 29 2d 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 75 2e 47 31 38 29 3e 3d 30 3b 29 65 5e 3d 75 2e 47 31 38 3c 3c 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 65 Data Ascii: ction(t){for(var e=t<<10;u.getBCHDigit(e)-u.getBCHDigit(u.G15)>=0;)e^=u.G15<<u.getBCHDigit(e)-u.getBCHDigit(u.G15);return(t<<10\|e)^u.G15_MASK},getBCHTypeNumber:function(t){for(var e=t<<12;u.getBCHDigit(e)-u.getBCHDigit(u.G18)>=0;)e^=u.G18<<u.getBCHDigit(e

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.9	49847	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:23 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:23 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 2ea30268-a01e-006f-2759-2313cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071623Z-17fbfdc98bbn5xh71qanksxprn00000006zg000000005nda x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:23 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.9	49848	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:23 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:23 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: a2099384-101e-008d-760b-2292e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071623Z-r1755647c66s2pfjx11r8ys39000000000pg0000000046mv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:16:23 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.9	49849	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:23 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:23 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 106adab5-b01e-0001-11da-2046e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071623Z-r1755647c669hnl7dkxy835cqc000000074g000000004rrs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:23 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.9	49851	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:23 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:23 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 0efe6ec1-b01e-0053-7d56-23cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071623Z-17fbfdc98bbczcjda6v8hpct4c00000000rg000000000pk6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:23 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.9	49852	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:23 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:23 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 2ac8c7c7-d01e-0014-4a18-24ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071623Z-r1755647c66prnf6k99z0m3kzc00000009cg000000005f2a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:23 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.9	49853	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	745	OUT	GET /assets/1bab9b095996b8d024ce.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/assets/ac625b77a0bab0ee72df.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:23 UTC	964	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:23 GMT Content-Type: application/javascript Content-Length: 7078 Connection: close CF-Ray: 8d782e611aa66b9d-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "45a3ee5ff96bdb2dd7fbb2846b5ea494" Last-Modified: Tue, 18 Jun 2024 19:13:27 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1t62PzYgcpF1GySwwE3T5IOO8aMc1XezJ0aag%2BlNt11O98wWRdmvvC8pZ1MkcJmA5QqluBn0Olk55O2dAQbD4jem2csCgmBuqc4q73jPoI7aPwtVAH4dMeuxWU3c"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:23 UTC	405	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 34 33 32 32 32 22 5d 2c 7b 33 34 30 36 31 38 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 6f 29 7b 76 61 72 20 65 3d 6f 28 33 35 34 38 34 38 29 2c 6e 3d 53 74 72 69 6e 67 2c 63 3d 54 79 70 65 45 72 72 6f 72 3b 72 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 72 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 72 7c 7c 65 28 72 29 29 72 65 74 75 72 6e 20 72 3b 74 68 72 6f 77 20 63 28 22 43 61 6e 27 74 20 73 65 74 20 22 2b 6e 28 72 29 2b 22 20 61 73 20 61 20 70 72 6f 74 6f 74 79 70 65 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["43222"],{340618:function(r,t,o){var e=o(354848),n=String,c=TypeError;r.exports=function(r){if("object"==typeof r\|\|e(r))return r;throw c("Can't set "+n(r)+" as a prototype
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 2e 70 72 6f 74 6f 74 79 70 65 7d 29 7d 2c 33 33 39 39 35 3a 66 75 6e 63 74 69 6f 6e 28 72 29 7b 72 2e 65 78 70 6f 72 74 73 3d 7b 49 6e 64 65 78 53 69 7a 65 45 72 72 6f 72 3a 7b 73 3a 22 49 4e 44 45 58 5f 53 49 5a 45 5f 45 52 52 22 2c 63 3a 31 2c 6d 3a 31 7d 2c 44 4f 4d 53 74 72 69 6e 67 53 69 7a 65 45 72 72 6f 72 3a 7b 73 3a 22 44 4f 4d 53 54 52 49 4e 47 5f 53 49 5a 45 5f 45 52 52 22 2c 63 3a 32 2c 6d 3a 30 7d 2c 48 69 65 72 61 72 63 68 79 52 65 71 75 65 73 74 45 72 72 6f 72 3a 7b 73 3a 22 48 49 45 52 41 52 43 48 59 5f 52 45 51 55 45 53 54 5f 45 52 52 22 2c 63 3a 33 2c 6d 3a 31 7d 2c 57 72 6f 6e 67 44 6f 63 75 6d 65 6e 74 45 72 72 6f 72 3a 7b 73 3a 22 57 52 4f 4e 47 5f 44 4f 43 55 4d 45 4e 54 5f 45 52 52 22 2c 63 3a 34 2c 6d 3a 31 7d 2c 49 6e 76 61 6c 69 Data Ascii: .prototype})},33995:function(r){r.exports={IndexSizeError:{s:"INDEX_SIZE_ERR",c:1,m:1},DOMStringSizeError:{s:"DOMSTRING_SIZE_ERR",c:2,m:0},HierarchyRequestError:{s:"HIERARCHY_REQUEST_ERR",c:3,m:1},WrongDocumentError:{s:"WRONG_DOCUMENT_ERR",c:4,m:1},Invali
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 7b 72 65 74 75 72 6e 20 65 28 6e 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 72 2c 74 29 5b 6f 5d 29 29 7d 63 61 74 63 68 28 72 29 7b 7d 7d 7d 2c 36 32 30 36 32 33 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 6f 29 7b 76 61 72 20 65 3d 6f 28 35 34 35 35 37 36 29 3b 72 2e 65 78 70 6f 72 74 73 3d 65 28 22 64 6f 63 75 6d 65 6e 74 22 2c 22 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 22 29 7d 2c 38 37 34 36 35 32 3a 66 75 6e 63 74 69 6f 6e 28 72 29 7b 72 2e 65 78 70 6f 72 74 73 3d 7b 7d 7d 2c 38 30 33 39 33 38 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 6f 29 7b 76 61 72 20 65 2c 6e 3d 6f 28 32 34 30 33 33 29 2c 63 3d 6f 28 39 34 35 36 37 29 2c 69 3d 6f 28 32 30 32 32 33 34 29 2c 75 3d 6f 28 36 32 34 39 30 36 Data Ascii: {return e(n(Object.getOwnPropertyDescriptor(r,t)[o]))}catch(r){}}},620623:function(r,t,o){var e=o(545576);r.exports=e("document","documentElement")},874652:function(r){r.exports={}},803938:function(r,t,o){var e,n=o(24033),c=o(94567),i=o(202234),u=o(624906
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 72 29 7b 76 61 72 20 74 3d 63 28 72 29 3b 69 66 28 65 28 74 2c 61 29 29 72 65 74 75 72 6e 20 74 5b 61 5d 3b 76 61 72 20 6f 3d 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 72 65 74 75 72 6e 20 6e 28 6f 29 26 26 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 6f 3f 6f 2e 70 72 6f 74 6f 74 79 70 65 3a 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 66 3f 45 3a 6e 75 6c 6c 7d 7d 2c 38 33 35 38 38 34 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 6f 29 7b 76 61 72 20 65 3d 6f 28 32 32 32 35 33 31 29 2c 6e 3d 6f 28 32 30 32 32 33 34 29 3b 72 2e 65 78 70 6f 72 74 73 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 7c 7c 66 75 6e 63 74 69 6f 6e 28 72 29 7b 72 65 74 75 72 6e 20 65 28 72 2c 6e 29 7d 7d 2c 32 37 36 33 32 31 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 6f 29 7b 76 61 72 20 65 3d 6f 28 36 38 Data Ascii: r){var t=c(r);if(e(t,a))return t[a];var o=t.constructor;return n(o)&&t instanceof o?o.prototype:t instanceof f?E:null}},835884:function(r,t,o){var e=o(222531),n=o(202234);r.exports=Object.keys\|\|function(r){return e(r,n)}},276321:function(r,t,o){var e=o(68
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 2c 32 29 2c 79 3d 6d 26 26 6c 26 26 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 6e 2c 64 29 2c 4e 3d 21 21 79 26 26 21 28 79 2e 77 72 69 74 61 62 6c 65 26 26 79 2e 63 6f 6e 66 69 67 75 72 61 62 6c 65 29 2c 68 3d 76 26 26 21 4e 26 26 21 54 3b 65 28 7b 67 6c 6f 62 61 6c 3a 21 30 2c 63 6f 6e 73 74 72 75 63 74 6f 72 3a 21 30 2c 66 6f 72 63 65 64 3a 5f 7c 7c 68 7d 2c 7b 44 4f 4d 45 78 63 65 70 74 69 6f 6e 3a 68 3f 49 3a 6d 7d 29 3b 76 61 72 20 44 3d 63 28 64 29 2c 53 3d 44 2e 70 72 6f 74 6f 74 79 70 65 3b 69 66 28 53 2e 63 6f 6e 73 74 72 75 63 74 6f 72 21 3d 3d 44 29 7b 66 6f 72 28 76 61 72 20 62 20 69 6e 21 5f 26 26 75 28 53 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 2c 69 28 31 2c 44 29 29 2c 70 29 69 66 28 Data Ascii: ,2),y=m&&l&&Object.getOwnPropertyDescriptor(n,d),N=!!y&&!(y.writable&&y.configurable),h=v&&!N&&!T;e({global:!0,constructor:!0,forced:_\|\|h},{DOMException:h?I:m});var D=c(d),S=D.prototype;if(S.constructor!==D){for(var b in!_&&u(S,"constructor",i(1,D)),p)if(
2024-10-24 07:16:23 UTC	1197	IN	Data Raw: 50 49 3a 74 2c 6d 69 6e 3a 6f 2c 6d 61 78 3a 6e 2c 63 6f 73 3a 63 2c 72 6f 75 6e 64 3a 69 7d 3d 4d 61 74 68 2c 75 3d 72 5b 30 5d 7c 72 5b 31 5d 3c 3c 38 7c 72 5b 32 5d 3c 3c 31 36 2c 61 3d 72 5b 33 5d 7c 72 5b 34 5d 3c 3c 38 2c 66 3d 28 36 33 26 75 29 2f 36 33 2c 45 3d 28 75 3e 3e 36 26 36 33 29 2f 33 31 2e 35 2d 31 2c 73 3d 28 75 3e 3e 31 32 26 36 33 29 2f 33 31 2e 35 2d 31 2c 70 3d 75 3e 3e 32 33 2c 52 3d 61 3e 3e 31 35 2c 6c 3d 6e 28 33 2c 52 3f 70 3f 35 3a 37 3a 37 26 61 29 2c 5f 3d 6e 28 33 2c 52 3f 37 26 61 3a 70 3f 35 3a 37 29 2c 64 3d 70 3f 28 31 35 26 72 5b 35 5d 29 2f 31 35 3a 31 2c 4f 3d 28 72 5b 35 5d 3e 3e 34 29 2f 31 35 2c 6d 3d 70 3f 36 3a 35 2c 49 3d 30 2c 41 3d 28 74 2c 6f 2c 65 29 3d 3e 7b 6c 65 74 20 6e 3d 5b 5d 3b 66 6f 72 28 6c 65 74 Data Ascii: PI:t,min:o,max:n,cos:c,round:i}=Math,u=r[0]\|r[1]<<8\|r[2]<<16,a=r[3]\|r[4]<<8,f=(63&u)/63,E=(u>>6&63)/31.5-1,s=(u>>12&63)/31.5-1,p=u>>23,R=a>>15,l=n(3,R?p?5:7:7&a),_=n(3,R?7&a:p?5:7),d=p?(15&r[5])/15:1,O=(r[5]>>4)/15,m=p?6:5,I=0,A=(t,o,e)=>{let n=[];for(let

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.9	49854	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	868	OUT	GET /assets/d67c5e680608266a1f63.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:24 UTC	974	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:24 GMT Content-Type: application/javascript Content-Length: 7728 Connection: close CF-Ray: 8d782e622a9e465f-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "1c6b9d0ad743762986197ae0e81874c1" Last-Modified: Fri, 28 Jun 2024 00:43:11 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1%2BQmZDSk7w7fI0mmLRzQEr57bKAd%2B5r4bS4%2Bbmm8zeI5nWsn%2FQdSjKqqOXfGsl5WAkXJwv0tIUvzeSgmqh6VR%2Bd7hHfpXLpTIDH%2BdWAtbH0WjHONx1opdVypG04F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:24 UTC	395	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 37 35 34 39 32 22 5d 2c 7b 38 34 39 31 34 36 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 4d 61 70 29 72 65 74 75 72 6e 20 4d 61 70 3b 66 75 6e 63 74 69 6f 6e 20 74 28 74 2c 65 29 7b 76 61 72 20 6e 3d 2d 31 3b 72 65 74 75 72 6e 20 74 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 72 65 74 75 72 6e 20 74 5b 30 5d 3d 3d 3d 65 26 26 28 6e 3d 72 2c 21 30 29 7d 29 2c 6e 7d Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["75492"],{849146:function(t,e,n){var r=function(){if("undefined"!=typeof Map)return Map;function t(t,e){var n=-1;return t.some(function(t,r){return t[0]===e&&(n=r,!0)}),n}
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 65 6e 67 74 68 7d 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 74 28 74 68 69 73 2e 5f 5f 65 6e 74 72 69 65 73 5f 5f 2c 65 29 2c 72 3d 74 68 69 73 2e 5f 5f 65 6e 74 72 69 65 73 5f 5f 5b 6e 5d 3b 72 65 74 75 72 6e 20 72 26 26 72 5b 31 5d 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 76 61 72 20 72 3d 74 28 74 68 69 73 2e 5f 5f 65 6e 74 72 69 65 73 5f 5f 2c 65 29 3b 7e 72 3f 74 68 69 73 2e 5f 5f 65 6e 74 72 69 65 73 5f 5f 5b 72 5d 5b 31 5d 3d 6e 3a 74 68 69 73 2e 5f 5f 65 6e 74 72 69 65 73 5f 5f 2e 70 75 73 68 28 5b 65 2c 6e 5d 29 7d 2c 65 2e 70 72 6f 74 Data Ascii: ength},enumerable:!0,configurable:!0}),e.prototype.get=function(e){var n=t(this.__entries__,e),r=this.__entries__[n];return r&&r[1]},e.prototype.set=function(e,n){var r=t(this.__entries__,e);~r?this.__entries__[r][1]=n:this.__entries__.push([e,n])},e.prot
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 6e 63 74 69 6f 6e 20 61 28 29 7b 76 61 72 20 74 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 69 66 28 6e 29 7b 69 66 28 74 2d 69 3c 32 29 72 65 74 75 72 6e 3b 72 3d 21 30 7d 65 6c 73 65 20 6e 3d 21 30 2c 72 3d 21 31 2c 73 65 74 54 69 6d 65 6f 75 74 28 63 2c 32 30 29 3b 69 3d 74 7d 72 65 74 75 72 6e 20 61 7d 28 74 68 69 73 2e 72 65 66 72 65 73 68 2e 62 69 6e 64 28 74 68 69 73 29 2c 32 30 29 7d 72 65 74 75 72 6e 20 74 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 4f 62 73 65 72 76 65 72 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 21 7e 74 68 69 73 2e 6f 62 73 65 72 76 65 72 73 5f 2e 69 6e 64 65 78 4f 66 28 74 29 26 26 74 68 69 73 2e 6f 62 73 65 72 76 65 72 73 5f 2e 70 75 73 68 28 74 29 2c 21 74 68 69 73 2e 63 6f 6e 6e 65 63 74 65 64 5f 26 26 74 68 69 73 2e 63 6f 6e 6e 65 63 Data Ascii: nction a(){var t=Date.now();if(n){if(t-i<2)return;r=!0}else n=!0,r=!1,setTimeout(c,20);i=t}return a}(this.refresh.bind(this),20)}return t.prototype.addObserver=function(t){!~this.observers_.indexOf(t)&&this.observers_.push(t),!this.connected_&&this.connec
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 41 64 64 65 64 5f 26 26 64 6f 63 75 6d 65 6e 74 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 53 75 62 74 72 65 65 4d 6f 64 69 66 69 65 64 22 2c 74 68 69 73 2e 72 65 66 72 65 73 68 29 2c 74 68 69 73 2e 6d 75 74 61 74 69 6f 6e 73 4f 62 73 65 72 76 65 72 5f 3d 6e 75 6c 6c 2c 74 68 69 73 2e 6d 75 74 61 74 69 6f 6e 45 76 65 6e 74 73 41 64 64 65 64 5f 3d 21 31 2c 74 68 69 73 2e 63 6f 6e 6e 65 63 74 65 64 5f 3d 21 31 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 6f 6e 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 5f 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2e 70 72 6f 70 65 72 74 79 4e 61 6d 65 2c 6e 3d 76 6f 69 64 20 30 3d 3d 3d 65 3f 22 22 3a 65 3b 63 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e Data Ascii: Added_&&document.removeEventListener("DOMSubtreeModified",this.refresh),this.mutationsObserver_=null,this.mutationEventsAdded_=!1,this.connected_=!1},t.prototype.onTransitionEnd_=function(t){var e=t.propertyName,n=void 0===e?"":e;c.some(function(t){return
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 68 74 3b 69 66 28 21 65 26 26 21 6e 29 72 65 74 75 72 6e 20 64 3b 76 61 72 20 72 3d 66 28 74 29 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 74 29 2c 69 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 7b 7d 2c 6e 3d 30 2c 72 3d 5b 22 74 6f 70 22 2c 22 72 69 67 68 74 22 2c 22 62 6f 74 74 6f 6d 22 2c 22 6c 65 66 74 22 5d 3b 6e 3c 72 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 7b 76 61 72 20 69 3d 72 5b 6e 5d 2c 6f 3d 74 5b 22 70 61 64 64 69 6e 67 2d 22 2b 69 5d 3b 65 5b 69 5d 3d 70 28 6f 29 7d 72 65 74 75 72 6e 20 65 7d 28 72 29 2c 6f 3d 69 2e 6c 65 66 74 2b 69 2e 72 69 67 68 74 2c 73 3d 69 2e 74 6f 70 2b 69 2e 62 6f 74 74 6f 6d 2c 63 3d 70 28 72 2e 77 69 64 74 68 29 2c 61 3d 70 28 72 2e 68 65 69 67 68 74 29 3b 69 66 28 22 62 6f 72 64 Data Ascii: ht;if(!e&&!n)return d;var r=f(t).getComputedStyle(t),i=function(t){for(var e={},n=0,r=["top","right","bottom","left"];n<r.length;n++){var i=r[n],o=t["padding-"+i];e[i]=p(o)}return e}(r),o=i.left+i.right,s=i.top+i.bottom,c=p(r.width),a=p(r.height);if("bord
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 72 6f 72 28 22 31 20 61 72 67 75 6d 65 6e 74 20 72 65 71 75 69 72 65 64 2c 20 62 75 74 20 6f 6e 6c 79 20 30 20 70 72 65 73 65 6e 74 2e 22 29 3b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 45 6c 65 6d 65 6e 74 7c 7c 21 28 45 6c 65 6d 65 6e 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 4f 62 6a 65 63 74 29 29 72 65 74 75 72 6e 3b 69 66 28 21 28 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 66 28 74 29 2e 45 6c 65 6d 65 6e 74 29 29 74 68 72 6f 77 20 54 79 70 65 45 72 72 6f 72 28 27 70 61 72 61 6d 65 74 65 72 20 31 20 69 73 20 6e 6f 74 20 6f 66 20 74 79 70 65 20 22 45 6c 65 6d 65 6e 74 22 2e 27 29 3b 76 61 72 20 65 3d 74 68 69 73 2e 6f 62 73 65 72 76 61 74 69 6f 6e 73 5f 3b 69 66 28 21 65 2e 68 61 73 28 74 29 29 65 2e 73 65 74 28 74 2c 6e 65 77 20 Data Ascii: ror("1 argument required, but only 0 present.");if("undefined"==typeof Element\|\|!(Element instanceof Object))return;if(!(t instanceof f(t).Element))throw TypeError('parameter 1 is not of type "Element".');var e=this.observations_;if(!e.has(t))e.set(t,new
2024-10-24 07:16:24 UTC	488	IN	Data Raw: 77 20 57 65 61 6b 4d 61 70 3a 6e 65 77 20 72 2c 77 3d 66 75 6e 63 74 69 6f 6e 20 74 28 65 29 7b 69 66 28 21 28 74 68 69 73 20 69 6e 73 74 61 6e 63 65 6f 66 20 74 29 29 74 68 72 6f 77 20 54 79 70 65 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 63 61 6c 6c 20 61 20 63 6c 61 73 73 20 61 73 20 61 20 66 75 6e 63 74 69 6f 6e 2e 22 29 3b 69 66 28 21 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 74 68 72 6f 77 20 54 79 70 65 45 72 72 6f 72 28 22 31 20 61 72 67 75 6d 65 6e 74 20 72 65 71 75 69 72 65 64 2c 20 62 75 74 20 6f 6e 6c 79 20 30 20 70 72 65 73 65 6e 74 2e 22 29 3b 76 61 72 20 6e 3d 6e 65 77 20 79 28 65 2c 68 2e 67 65 74 49 6e 73 74 61 6e 63 65 28 29 2c 74 68 69 73 29 3b 67 2e 73 65 74 28 74 68 69 73 2c 6e 29 7d 3b 5b 22 6f 62 73 65 72 76 65 22 2c 22 75 Data Ascii: w WeakMap:new r,w=function t(e){if(!(this instanceof t))throw TypeError("Cannot call a class as a function.");if(!arguments.length)throw TypeError("1 argument required, but only 0 present.");var n=new y(e,h.getInstance(),this);g.set(this,n)};["observe","u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.9	49855	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	868	OUT	GET /assets/d86788be99e870993214.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:24 UTC	965	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:24 GMT Content-Type: text/javascript Content-Length: 8761 Connection: close CF-Ray: 8d782e62389fe79e-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "102fe4fdec4447c9891c9f3faeae0474" Last-Modified: Tue, 15 Oct 2024 21:50:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=edMP0tDWz%2Bb5HjHNy8fLMciakkoGZy3vDUocs8rHzuAgS5yF1gbVqUxE%2BD7FRJqQPfyQVP%2FUKG1NR%2BiFy4tVhpxMgUuUkg%2BwEoXk8lkT2D0ikmpB6bs5bLu5HcrN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 31 38 35 34 33 22 5d 2c 7b 37 32 35 34 33 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 6d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 7d 7d 29 3b 76 61 72 20 73 3d 6e 28 34 35 34 35 38 35 29 2c 61 3d 6e 28 35 35 31 34 35 32 29 2c 6c 3d 6e 28 35 33 32 39 30 31 29 3b 6c 65 74 20 72 3d 7b 2e 2e 2e 73 2e 5a 2e 67 75 69 6c 64 45 76 65 6e 74 52 75 6c 65 73 2e 6c 69 6e 6b 2c 72 65 61 63 74 3a 28 30 2c 6c 2e 5a 29 28 7b 65 6e 61 62 6c 65 42 75 69 6c 64 4f 76 65 72 72 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["18543"],{725436:function(e,t,n){n.d(t,{m:function(){return u}});var s=n(454585),a=n(551452),l=n(532901);let r={...s.Z.guildEventRules.link,react:(0,l.Z)({enableBuildOverr
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 28 6c 29 2c 69 3d 6e 28 37 32 35 34 33 36 29 2c 75 3d 6e 28 37 33 37 36 30 32 29 2c 63 3d 6e 28 35 35 34 30 33 34 29 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 6c 65 74 7b 64 65 73 63 72 69 70 74 69 6f 6e 3a 74 2c 63 6c 61 73 73 4e 61 6d 65 3a 6e 2c 67 75 69 6c 64 49 64 3a 6c 2c 74 72 75 6e 63 61 74 65 3a 6f 3d 21 30 7d 3d 65 2c 45 3d 61 2e 75 73 65 4d 65 6d 6f 28 28 29 3d 3e 28 30 2c 69 2e 6d 29 28 74 2c 21 30 2c 7b 67 75 69 6c 64 49 64 3a 6c 2c 61 6c 6c 6f 77 4c 69 6e 6b 73 3a 21 30 2c 61 6c 6c 6f 77 48 65 61 64 69 6e 67 3a 21 30 2c 61 6c 6c 6f 77 4c 69 73 74 3a 21 30 7d 29 2c 5b 74 2c 6c 5d 29 3b 72 65 74 75 72 6e 28 30 2c 73 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 72 28 29 28 75 2e 64 65 73 63 72 69 70 74 69 6f 6e 54 65 Data Ascii: (l),i=n(725436),u=n(737602),c=n(554034);function o(e){let{description:t,className:n,guildId:l,truncate:o=!0}=e,E=a.useMemo(()=>(0,i.m)(t,!0,{guildId:l,allowLinks:!0,allowHeading:!0,allowList:!0}),[t,l]);return(0,s.jsx)("div",{className:r()(u.descriptionTe
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 7d 3d 53 3b 72 65 74 75 72 6e 28 30 2c 73 2e 6a 73 78 73 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 6c 28 29 28 78 2e 73 74 61 74 75 73 43 6f 6e 74 61 69 6e 65 72 2c 74 29 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 73 2e 6a 73 78 29 28 44 2e 7a 2c 7b 73 74 61 72 74 54 69 6d 65 3a 49 2e 74 6f 49 53 4f 53 74 72 69 6e 67 28 29 2c 73 74 61 74 75 73 3a 6e 75 6c 6c 21 3d 43 3f 43 3a 70 2c 65 76 65 6e 74 54 79 70 65 3a 52 2c 69 73 4e 65 77 3a 54 2c 72 65 63 75 72 72 65 6e 63 65 52 75 6c 65 3a 28 30 2c 4e 2e 4b 56 29 28 6a 29 2c 67 75 69 6c 64 45 76 65 6e 74 49 64 3a 68 2e 69 64 2c 72 65 63 75 72 72 65 6e 63 65 49 64 3a 66 7d 29 2c 28 30 2c 73 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 78 2e 73 70 61 63 65 72 7d 29 2c 21 6d Data Ascii: }=S;return(0,s.jsxs)("div",{className:l()(x.statusContainer,t),children:[(0,s.jsx)(D.z,{startTime:I.toISOString(),status:null!=C?C:p,eventType:R,isNew:T,recurrenceRule:(0,N.KV)(j),guildEventId:h.id,recurrenceId:f}),(0,s.jsx)("div",{className:x.spacer}),!m
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 69 6c 64 72 65 6e 3a 28 30 2c 73 2e 6a 73 78 29 28 6d 2e 5a 2c 7b 73 6f 75 72 63 65 3a 6f 2c 63 6c 61 73 73 4e 61 6d 65 3a 78 2e 74 68 75 6d 62 6e 61 69 6c 7d 29 7d 29 5d 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 66 28 65 29 7b 6c 65 74 7b 68 65 61 64 65 72 56 61 72 69 61 6e 74 3a 74 2c 64 65 73 63 72 69 70 74 69 6f 6e 43 6c 61 73 73 4e 61 6d 65 3a 6e 2c 63 72 65 61 74 6f 72 3a 61 2c 6e 61 6d 65 3a 6c 2c 64 65 73 63 72 69 70 74 69 6f 6e 3a 72 2c 69 6d 61 67 65 53 6f 75 72 63 65 3a 69 2c 69 73 48 75 62 3a 75 3d 21 31 2c 74 72 75 6e 63 61 74 65 3a 63 2c 67 75 69 6c 64 49 64 3a 6f 2c 69 73 4e 65 77 3a 45 2c 67 75 69 6c 64 45 76 65 6e 74 3a 64 2c 65 76 65 6e 74 50 72 65 76 69 65 77 3a 4e 2c 72 65 63 75 72 72 65 6e 63 65 49 64 3a 5f 7d 3d 65 3b 72 65 74 75 72 6e 28 Data Ascii: ildren:(0,s.jsx)(m.Z,{source:o,className:x.thumbnail})})]})}function f(e){let{headerVariant:t,descriptionClassName:n,creator:a,name:l,description:r,imageSource:i,isHub:u=!1,truncate:c,guildId:o,isNew:E,guildEvent:d,eventPreview:N,recurrenceId:_}=e;return(
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 3a 6e 75 6c 6c 21 3d 73 2c 63 68 69 6c 64 72 65 6e 3a 65 3d 3e 28 30 2c 6c 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 2e 2e 2e 65 2c 63 6c 61 73 73 4e 61 6d 65 3a 75 28 29 28 68 2e 65 76 65 6e 74 53 74 61 74 75 73 43 6f 6e 74 61 69 6e 65 72 2c 6e 29 2c 63 68 69 6c 64 72 65 6e 3a 74 7d 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 4c 28 65 29 7b 6c 65 74 7b 73 74 61 72 74 54 69 6d 65 3a 74 2c 73 74 61 74 75 73 3a 6e 2c 65 76 65 6e 74 54 79 70 65 3a 73 2c 63 6c 61 73 73 4e 61 6d 65 3a 61 2c 65 6e 64 54 69 6d 65 3a 69 2c 6c 69 76 65 54 65 78 74 3a 63 2c 74 65 78 74 56 61 72 69 61 6e 74 3a 45 3d 22 74 65 78 74 2d 73 6d 2f 73 65 6d 69 62 6f 6c 64 22 2c 69 73 4e 65 77 3a 4c 2c 72 65 63 75 72 72 65 6e 63 65 52 75 6c 65 3a 53 2c 67 75 69 6c 64 45 76 65 6e 74 49 64 3a Data Ascii: :null!=s,children:e=>(0,l.jsx)("div",{...e,className:u()(h.eventStatusContainer,n),children:t})})})}function L(e){let{startTime:t,status:n,eventType:s,className:a,endTime:i,liveText:c,textVariant:E="text-sm/semibold",isNew:L,recurrenceRule:S,guildEventId:
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 21 3d 6e 3f 6e 3a 22 22 3b 64 65 66 61 75 6c 74 3a 72 65 74 75 72 6e 20 74 7d 7d 28 62 2c 50 2c 63 2c 4f 2c 77 29 2c 7b 49 63 6f 6e 3a 56 2c 69 63 6f 6e 43 6f 6c 6f 72 3a 59 2c 74 65 78 74 43 6f 6c 6f 72 3a 6b 2c 74 6f 6f 6c 74 69 70 54 65 78 74 3a 7a 7d 3d 72 2e 75 73 65 4d 65 6d 6f 28 28 29 3d 3e 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6c 65 74 20 74 2c 7b 74 69 6d 65 53 74 61 74 75 73 3a 6e 2c 74 65 78 74 42 72 61 6e 64 3a 73 2c 74 65 78 74 50 6f 73 69 74 69 76 65 3a 61 2c 74 65 78 74 44 61 6e 67 65 72 3a 6c 2c 65 6e 64 44 61 74 65 54 69 6d 65 53 74 72 69 6e 67 3a 72 2c 73 74 61 72 74 44 61 74 65 54 69 6d 65 53 74 72 69 6e 67 3a 69 7d 3d 65 2c 75 3d 64 2e 43 61 6c 65 6e 64 61 72 49 63 6f 6e 2c 63 3d 73 2c 6f 3d 22 68 65 61 64 65 72 2d 73 65 63 6f 6e 64 Data Ascii: !=n?n:"";default:return t}}(b,P,c,O,w),{Icon:V,iconColor:Y,textColor:k,tooltipText:z}=r.useMemo(()=>(function(e){let t,{timeStatus:n,textBrand:s,textPositive:a,textDanger:l,endDateTimeString:r,startDateTimeString:i}=e,u=d.CalendarIcon,c=s,o="header-second
2024-10-24 07:16:24 UTC	547	IN	Data Raw: 45 45 4b 45 4e 44 5f 4f 4e 4c 59 3a 72 65 74 75 72 6e 20 78 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 53 43 48 45 44 55 4c 45 44 5f 45 56 45 4e 54 5f 52 45 50 45 41 54 53 5f 57 45 45 4b 45 4e 44 53 3b 64 65 66 61 75 6c 74 3a 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 7d 28 28 30 2c 54 2e 7a 69 29 28 6e 2c 53 29 2c 6e 29 7d 72 65 74 75 72 6e 28 30 2c 6c 2e 6a 73 78 73 29 28 66 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 75 28 29 28 61 2c 7b 5b 68 2e 69 73 52 65 63 75 72 72 69 6e 67 5d 3a 6e 75 6c 6c 21 3d 57 7d 29 2c 74 6f 6f 6c 74 69 70 54 65 78 74 3a 7a 2c 63 68 69 6c 64 72 65 6e 3a 5b 4c 26 26 6e 3d 3d 3d 44 2e 70 31 2e 53 43 48 45 44 55 4c 45 44 3f 28 30 2c 6c 2e 6a 73 78 29 28 67 2c 7b 7d 29 3a 28 30 2c 6c 2e 6a 73 78 29 28 56 2c 7b 63 6f 6c 6f 72 3a 59 Data Ascii: EEKEND_ONLY:return x.Z.Messages.GUILD_SCHEDULED_EVENT_REPEATS_WEEKENDS;default:return null}}((0,T.zi)(n,S),n)}return(0,l.jsxs)(f,{className:u()(a,{[h.isRecurring]:null!=W}),tooltipText:z,children:[L&&n===D.p1.SCHEDULED?(0,l.jsx)(g,{}):(0,l.jsx)(V,{color:Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.9	49857	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:24 UTC	868	OUT	GET /assets/a14c32460cf87caa605c.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:24 UTC	962	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:24 GMT Content-Type: text/javascript Content-Length: 12443 Connection: close CF-Ray: 8d782e64dcc72fec-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "1fb8462302f6fbb9323f187505f5393f" Last-Modified: Tue, 15 Oct 2024 21:50:01 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IlZjNye12NjVZ15x1k9XmoJHkDM%2F5VX5oG7y19bNhcqoptah0dwzfWWIngA1jMERBgltcaEWy49Y5xfzRuB0Gc%2FXTy1dzbJBdnXj0tvonOwcU31c4%2BdLZYKJvgE7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 39 35 33 39 33 22 5d 2c 7b 33 39 32 34 35 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 2c 25 33 43 73 76 67 20 78 6d 6c 6e 73 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 27 20 76 69 65 77 42 6f 78 3d 27 30 20 30 20 36 36 20 33 38 27 20 77 69 64 74 68 3d 27 36 36 27 20 68 65 69 67 68 74 3d 27 33 38 27 25 33 45 25 33 43 72 65 63 74 20 78 3d 27 30 27 20 79 3d 27 30 27 20 77 69 64 74 68 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["95393"],{392459:function(e){e.exports="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 66 38' width='66' height='38'%3E%3Crect x='0' y='0' width
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 20 35 35 2e 38 36 34 20 4c 20 32 35 2e 33 35 32 20 35 35 2e 38 36 34 20 43 20 31 38 2e 36 36 35 20 35 35 2e 38 36 34 20 31 36 2e 32 34 20 35 35 2e 31 36 38 20 31 33 2e 37 39 36 20 35 33 2e 38 36 31 20 43 20 31 31 2e 33 35 31 20 35 32 2e 35 35 33 20 39 2e 34 33 33 20 35 30 2e 36 33 35 20 38 2e 31 32 36 20 34 38 2e 31 39 31 20 43 20 36 2e 38 31 36 20 34 35 2e 37 34 34 20 36 2e 31 32 32 20 34 33 2e 33 32 31 20 36 2e 31 32 32 20 33 36 2e 36 33 34 20 4c 20 36 2e 31 32 32 20 32 35 2e 30 39 34 20 43 20 36 2e 31 32 32 20 31 38 2e 34 30 37 20 36 2e 38 31 38 20 31 35 2e 39 38 32 20 38 2e 31 32 35 20 31 33 2e 35 33 38 20 43 20 39 2e 34 33 32 20 31 31 2e 30 39 34 20 31 31 2e 33 35 32 20 39 2e 31 37 34 20 31 33 2e 37 39 35 20 37 2e 38 36 38 20 43 20 31 36 2e 32 34 32 Data Ascii: 55.864 L 25.352 55.864 C 18.665 55.864 16.24 55.168 13.796 53.861 C 11.351 52.553 9.433 50.635 8.126 48.191 C 6.816 45.744 6.122 43.321 6.122 36.634 L 6.122 25.094 C 6.122 18.407 6.818 15.982 8.125 13.538 C 9.432 11.094 11.352 9.174 13.795 7.868 C 16.242
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 3d 3e 7b 7d 7d 2c 41 3d 28 65 2c 6e 29 3d 3e 6e 26 26 5b 42 2e 57 58 2e 53 54 41 47 45 5f 49 4e 53 54 41 4e 43 45 2c 42 2e 57 58 2e 56 4f 49 43 45 5d 2e 69 6e 63 6c 75 64 65 73 28 6e 75 6c 6c 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 65 6e 74 69 74 79 5f 74 79 70 65 29 2c 4d 3d 74 2e 6d 65 6d 6f 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3b 6c 65 74 7b 67 75 69 6c 64 3a 6c 2c 67 75 69 6c 64 53 63 68 65 64 75 6c 65 64 45 76 65 6e 74 3a 61 2c 63 68 61 6e 6e 65 6c 3a 69 2c 69 73 4d 65 6d 62 65 72 3a 63 7d 3d 65 2c 4e 3d 28 30 2c 6f 2e 65 37 29 28 5b 70 2e 5a 5d 2c 28 29 3d 3e 7b 76 61 72 20 65 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 6c 3f 6e 75 6c 6c 3a 6e 75 6c 6c 21 3d 3d 28 65 3d 70 2e 5a 2e 67 65 74 47 75 69 6c 64 28 6c 2e 69 64 29 29 26 26 76 Data Ascii: =>{}},A=(e,n)=>n&&[B.WX.STAGE_INSTANCE,B.WX.VOICE].includes(null==e?void 0:e.entity_type),M=t.memo(function(e){var n;let{guild:l,guildScheduledEvent:a,channel:i,isMember:c}=e,N=(0,o.e7)([p.Z],()=>{var e;return null==l?null:null!==(e=p.Z.getGuild(l.id))&&v
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 61 6d 65 3a 6b 2e 63 68 61 6e 6e 65 6c 4c 6f 63 61 74 69 6f 6e 4c 69 6e 6b 2c 6f 6e 43 6c 69 63 6b 3a 45 2c 63 68 69 6c 64 72 65 6e 3a 78 7d 29 3a 78 7d 29 5d 7d 29 5d 7d 29 7d 29 2c 50 3d 74 2e 6d 65 6d 6f 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6c 65 74 7b 67 75 69 6c 64 49 64 3a 6e 2c 67 75 69 6c 64 53 63 68 65 64 75 6c 65 64 45 76 65 6e 74 49 64 3a 6c 2c 72 65 63 75 72 72 65 6e 63 65 49 64 3a 74 2c 69 73 41 63 74 69 76 65 3a 61 2c 69 73 45 6e 64 65 64 3a 69 2c 69 73 4d 65 6d 62 65 72 3a 75 2c 69 73 45 78 74 65 72 6e 61 6c 3a 63 2c 6f 6e 41 63 63 65 70 74 49 6e 73 74 61 6e 74 49 6e 76 69 74 65 3a 64 2c 6f 6e 54 72 61 6e 73 69 74 69 6f 6e 54 6f 49 6e 76 69 74 65 43 68 61 6e 6e 65 6c 3a 6d 7d 3d 65 2c 4e 3d 28 30 2c 6f 2e 65 37 29 28 5b 45 2e 5a 50 5d 2c Data Ascii: ame:k.channelLocationLink,onClick:E,children:x}):x})]})]})}),P=t.memo(function(e){let{guildId:n,guildScheduledEventId:l,recurrenceId:t,isActive:a,isEnded:i,isMember:u,isExternal:c,onAcceptInstantInvite:d,onTransitionToInviteChannel:m}=e,N=(0,o.e7)([E.ZP],
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 65 29 7b 76 61 72 20 6e 3b 6c 65 74 7b 67 75 69 6c 64 53 63 68 65 64 75 6c 65 64 45 76 65 6e 74 3a 6c 2c 67 75 69 6c 64 3a 61 2c 63 68 61 6e 6e 65 6c 3a 6f 2c 69 73 4d 65 6d 62 65 72 3a 75 2c 72 65 63 75 72 72 65 6e 63 65 49 64 3a 63 2c 6f 6e 41 63 63 65 70 74 49 6e 73 74 61 6e 74 49 6e 76 69 74 65 3a 64 2c 6f 6e 54 72 61 6e 73 69 74 69 6f 6e 54 6f 49 6e 76 69 74 65 43 68 61 6e 6e 65 6c 3a 4e 7d 3d 65 2c 76 3d 6e 75 6c 6c 21 3d 63 3f 63 3a 6e 75 6c 6c 21 3d 6c 3f 28 30 2c 6a 2e 44 4b 29 28 6c 29 3a 6e 75 6c 6c 2c 43 3d 28 6e 75 6c 6c 3d 3d 6c 3f 76 6f 69 64 20 30 3a 6c 2e 72 65 63 75 72 72 65 6e 63 65 5f 72 75 6c 65 29 3d 3d 6e 75 6c 6c 7c 7c 6e 75 6c 6c 3d 3d 76 7c 7c 28 30 2c 6a 2e 52 70 29 28 28 30 2c 78 2e 4b 56 29 28 6e 75 6c 6c 3d 3d 6c 3f 76 6f 69 Data Ascii: e){var n;let{guildScheduledEvent:l,guild:a,channel:o,isMember:u,recurrenceId:c,onAcceptInstantInvite:d,onTransitionToInviteChannel:N}=e,v=null!=c?c:null!=l?(0,j.DK)(l):null,C=(null==l?void 0:l.recurrence_rule)==null\|\|null==v\|\|(0,j.Rp)((0,x.KV)(null==l?voi
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 74 75 72 6e 20 6e 75 6c 6c 3b 6c 3d 28 30 2c 74 2e 54 68 29 28 6e 2e 74 79 70 65 29 2c 69 3d 6e 2e 6e 61 6d 65 7d 72 65 74 75 72 6e 7b 49 63 6f 6e 43 6f 6d 70 6f 6e 65 6e 74 3a 6c 2c 6c 6f 63 61 74 69 6f 6e 4e 61 6d 65 3a 69 7d 7d 7d 2c 31 33 39 37 31 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 6c 29 7b 6c 2e 64 28 6e 2c 7b 5a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6d 7d 7d 29 2c 6c 28 34 37 31 32 30 29 3b 76 61 72 20 73 3d 6c 28 32 30 30 36 35 31 29 2c 74 3d 6c 28 31 39 32 33 37 39 29 2c 61 3d 6c 28 34 38 31 30 36 30 29 2c 69 3d 6c 28 34 38 32 32 34 31 29 2c 6f 3d 6c 28 31 32 34 31 36 35 29 2c 72 3d 6c 28 37 36 35 33 30 35 29 2c 75 3d 6c 28 36 38 39 39 33 38 29 2c 63 3d 6c 28 31 39 36 32 33 38 29 3b 66 75 6e 63 74 69 6f 6e 20 64 28 65 Data Ascii: turn null;l=(0,t.Th)(n.type),i=n.name}return{IconComponent:l,locationName:i}}},139712:function(e,n,l){l.d(n,{Z:function(){return m}}),l(47120);var s=l(200651),t=l(192379),a=l(481060),i=l(482241),o=l(124165),r=l(765305),u=l(689938),c=l(196238);function d(e
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 6c 28 36 30 30 31 36 34 29 2c 6d 3d 6c 28 39 32 35 33 32 39 29 2c 4e 3d 6c 28 35 36 35 31 33 38 29 2c 76 3d 6c 28 31 33 34 34 33 32 29 2c 43 3d 6c 28 36 39 35 33 34 36 29 2c 70 3d 6c 28 37 36 38 35 38 31 29 2c 68 3d 6c 28 31 35 33 30 36 36 29 2c 45 3d 6c 28 36 38 39 39 33 38 29 2c 67 3d 6c 28 38 35 30 33 39 33 29 3b 6c 65 74 20 49 3d 65 3d 3e 7b 6c 65 74 7b 74 65 78 74 3a 6e 2c 65 78 74 72 61 3a 6c 7d 3d 65 3b 72 65 74 75 72 6e 28 30 2c 73 2e 6a 73 78 73 29 28 6f 2e 46 6f 72 6d 54 69 74 6c 65 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 67 2e 68 65 61 64 65 72 2c 63 68 69 6c 64 72 65 6e 3a 5b 6e 2c 6c 5d 7d 29 7d 2c 78 3d 65 3d 3e 7b 6c 65 74 7b 72 65 73 6f 6c 76 69 6e 67 3a 6e 2c 63 68 69 6c 64 72 65 6e 3a 6c 7d 3d 65 3b 72 65 74 75 72 6e 28 30 2c 73 2e 6a 73 78 Data Ascii: l(600164),m=l(925329),N=l(565138),v=l(134432),C=l(695346),p=l(768581),h=l(153066),E=l(689938),g=l(850393);let I=e=>{let{text:n,extra:l}=e;return(0,s.jsxs)(o.FormTitle,{className:g.header,children:[n,l]})},x=e=>{let{resolving:n,children:l}=e;return(0,s.jsx
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 3d 28 30 2c 73 2e 6a 73 78 29 28 6f 2e 48 65 61 64 69 6e 67 2c 7b 76 61 72 69 61 6e 74 3a 22 68 65 61 64 69 6e 67 2d 6d 64 2f 73 65 6d 69 62 6f 6c 64 22 2c 63 6c 61 73 73 4e 61 6d 65 3a 28 30 2c 68 2e 6c 29 28 67 2c 22 69 6e 76 69 74 65 44 65 73 74 69 6e 61 74 69 6f 6e 22 2c 74 3f 22 45 78 70 69 72 65 64 22 3a 6e 75 6c 6c 21 3d 6c 3f 22 4a 6f 69 6e 65 64 22 3a 22 22 29 2c 63 68 69 6c 64 72 65 6e 3a 6e 7d 29 3b 72 65 74 75 72 6e 28 30 2c 73 2e 6a 73 78 73 29 28 64 2e 5a 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 67 2e 67 75 69 6c 64 49 6e 66 6f 2c 64 69 72 65 63 74 69 6f 6e 3a 64 2e 5a 2e 44 69 72 65 63 74 69 6f 6e 2e 56 45 52 54 49 43 41 4c 2c 6a 75 73 74 69 66 79 3a 64 2e 5a 2e 4a 75 73 74 69 66 79 2e 43 45 4e 54 45 52 2c 63 68 69 6c 64 72 65 6e 3a 5b 6e 75 6c Data Ascii: =(0,s.jsx)(o.Heading,{variant:"heading-md/semibold",className:(0,h.l)(g,"inviteDesusertion",t?"Expired":null!=l?"Joined":""),children:n});return(0,s.jsxs)(d.Z,{className:g.guildInfo,direction:d.Z.Direction.VERTICAL,justify:d.Z.Justify.CENTER,children:[nul
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 6a 73 78 29 28 6f 2e 42 75 74 74 6f 6e 2c 7b 2e 2e 2e 72 2c 64 69 73 61 62 6c 65 64 3a 61 2c 6f 6e 43 6c 69 63 6b 3a 6c 2c 73 69 7a 65 3a 67 2e 62 75 74 74 6f 6e 53 69 7a 65 2c 63 6c 61 73 73 4e 61 6d 65 3a 69 28 29 28 67 2e 62 75 74 74 6f 6e 2c 74 29 2c 63 68 69 6c 64 72 65 6e 3a 6e 7d 29 7d 3b 54 2e 43 6f 6c 6f 72 73 3d 6f 2e 42 75 74 74 6f 6e 2e 43 6f 6c 6f 72 73 2c 54 2e 4c 6f 6f 6b 73 3d 6f 2e 42 75 74 74 6f 6e 2e 4c 6f 6f 6b 73 2c 54 2e 64 65 66 61 75 6c 74 50 72 6f 70 73 3d 7b 63 6c 61 73 73 4e 61 6d 65 3a 6e 75 6c 6c 2c 69 73 44 69 73 61 62 6c 65 64 3a 21 31 7d 3b 6c 65 74 20 5f 3d 65 3d 3e 7b 6c 65 74 7b 63 68 69 6c 64 72 65 6e 3a 6e 2c 63 6c 61 73 73 4e 61 6d 65 3a 6c 2c 63 6f 6e 74 61 69 6e 65 72 52 65 66 3a 74 7d 3d 65 3b 72 65 74 75 72 6e 28 Data Ascii: jsx)(o.Button,{...r,disabled:a,onClick:l,size:g.buttonSize,className:i()(g.button,t),children:n})};T.Colors=o.Button.Colors,T.Looks=o.Button.Looks,T.defaultProps={className:null,isDisabled:!1};let _=e=>{let{children:n,className:l,containerRef:t}=e;return(
2024-10-24 07:16:24 UTC	122	IN	Data Raw: 74 74 6f 6e 2e 47 75 69 6c 64 4e 61 6d 65 22 2c 6b 2e 64 69 73 70 6c 61 79 4e 61 6d 65 3d 22 49 6e 76 69 74 65 42 75 74 74 6f 6e 2e 47 75 69 6c 64 54 65 6d 70 6c 61 74 65 4e 61 6d 65 22 2c 6e 2e 5a 3d 5f 7d 7d 5d 29 3b 0a 2f 2f 23 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 3d 61 31 34 63 33 32 34 36 30 63 66 38 37 63 61 61 36 30 35 63 2e 6a 73 2e 6d 61 70 Data Ascii: tton.GuildName",k.displayName="InviteButton.GuildTemplateName",n.Z=_}}]);//# sourceMappingURL=a14c32460cf87caa605c.js.map

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.9	49858	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:24 UTC	868	OUT	GET /assets/94ec0c2b39908933eed3.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:24 UTC	966	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:24 GMT Content-Type: text/javascript Content-Length: 20718 Connection: close CF-Ray: 8d782e64df094636-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "a2754accda171158f8f581ad49dfbb9c" Last-Modified: Fri, 18 Oct 2024 01:03:30 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ONmS%2FQGVRrmAvdo%2BQSikXrk61vR8xnbmH88Vxzpw%2BBhDfBVzjBdwVDWVSLebC71IHCqy6ZPC5nUM%2BuwynbBYemCZ8vQerjzVhkQ3ziFwaaWsANXHNZYioJ58%2FQmy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 32 35 37 38 38 22 5d 2c 7b 35 33 33 33 30 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6c 65 74 20 69 3b 76 61 72 20 73 3d 6e 28 35 34 34 38 39 31 29 2c 72 3d 6e 28 35 37 30 31 34 30 29 2c 6c 3d 6e 28 37 32 38 33 34 35 29 2c 6f 3d 6e 28 38 31 32 32 30 36 29 2c 61 3d 6e 28 36 32 35 31 32 38 29 2c 64 3d 6e 28 33 33 35 31 33 31 29 2c 75 3d 6e 28 36 36 39 30 37 39 29 2c 63 3d 6e 28 39 38 31 36 33 31 29 2c 5f 3d 6e 28 34 37 34 39 33 36 29 3b 61 73 79 6e 63 20 66 75 6e 63 74 69 6f 6e 20 45 28 65 29 7b Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["25788"],{533307:function(e,t,n){let i;var s=n(544891),r=n(570140),l=n(728345),o=n(812206),a=n(625128),d=n(335131),u=n(669079),c=n(981631),_=n(474936);async function E(e){
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 65 28 65 29 7b 6c 65 74 20 74 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 31 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3a 6e 75 6c 6c 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 32 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 32 5d 3a 6e 75 6c 6c 3b 72 2e 5a 2e 64 69 73 70 61 74 63 68 28 7b 74 79 70 65 3a 22 47 49 46 54 5f 43 4f 44 45 5f 43 52 45 41 54 45 5f 53 54 41 52 54 22 2c 73 6b 75 49 64 3a 65 2c 73 75 62 73 63 72 69 70 74 69 6f 6e 50 6c 61 6e 49 64 3a 74 7d 29 3b 74 72 79 7b 6c 65 74 20 69 3d 61 77 61 69 74 20 73 2e 74 6e 2e 70 6f 73 74 28 7b 75 72 6c 3a 63 2e 41 4e 4d 2e 55 53 45 52 5f 47 49 46 54 5f Data Ascii: e(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:null,n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:null;r.Z.dispatch({type:"GIFT_CODE_CREATE_START",skuId:e,subscriptionPlanId:t});try{let i=await s.tn.post({url:c.ANM.USER_GIFT_
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 65 6e 74 3a 65 2e 62 6f 64 79 7d 29 2c 6e 75 6c 6c 3d 3d 64 7c 7c 64 28 29 2c 7b 63 6f 64 65 3a 74 2c 65 6e 74 69 74 6c 65 6d 65 6e 74 3a 65 7d 7d 63 61 74 63 68 28 6e 29 7b 6c 65 74 20 65 3d 6e 65 77 20 72 2e 48 46 28 6e 29 3b 74 68 72 6f 77 20 73 2e 5a 2e 64 69 73 70 61 74 63 68 28 7b 74 79 70 65 3a 22 47 49 46 54 5f 43 4f 44 45 5f 52 45 44 45 45 4d 5f 46 41 49 4c 55 52 45 22 2c 63 6f 64 65 3a 74 2c 65 72 72 6f 72 3a 65 7d 29 2c 6e 75 6c 6c 3d 3d 75 7c 7c 75 28 65 29 2c 65 7d 7d 74 2e 5a 3d 7b 72 65 64 65 65 6d 47 69 66 74 43 6f 64 65 3a 64 7d 7d 2c 37 39 32 37 36 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 7d 7d 29 3b 76 61 72 20 69 3d 6e 28 32 30 30 36 35 31 Data Ascii: ent:e.body}),null==d\|\|d(),{code:t,entitlement:e}}catch(n){let e=new r.HF(n);throw s.Z.dispatch({type:"GIFT_CODE_REDEEM_FAILURE",code:t,error:e}),null==u\|\|u(e),e}}t.Z={redeemGiftCode:d}},792766:function(e,t,n){n.d(t,{y:function(){return f}});var i=n(200651
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 67 2d 73 6d 2f 73 65 6d 69 62 6f 6c 64 22 2c 63 68 69 6c 64 72 65 6e 3a 72 7d 29 2c 28 30 2c 69 2e 6a 73 78 73 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 68 2e 73 70 65 61 6b 65 72 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 69 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 68 2e 64 6f 74 7d 29 2c 6e 75 6c 6c 21 3d 6e 26 26 6e 3e 30 3f 28 30 2c 69 2e 6a 73 78 29 28 6f 2e 54 65 78 74 2c 7b 76 61 72 69 61 6e 74 3a 22 74 65 78 74 2d 73 6d 2f 6e 6f 72 6d 61 6c 22 2c 63 68 69 6c 64 72 65 6e 3a 70 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 49 4e 53 54 41 4e 54 5f 49 4e 56 49 54 45 5f 47 55 49 4c 44 5f 4d 45 4d 42 45 52 53 5f 4f 4e 4c 49 4e 45 2e 66 6f 72 6d 61 74 28 7b 6d 65 6d 62 65 72 73 4f 6e 6c 69 6e 65 3a 6e 7d 29 7d 29 3a 6e 75 Data Ascii: g-sm/semibold",children:r}),(0,i.jsxs)("div",{className:h.speaker,children:[(0,i.jsx)("div",{className:h.dot}),null!=n&&n>0?(0,i.jsx)(o.Text,{variant:"text-sm/normal",children:p.Z.Messages.INSTANT_INVITE_GUILD_MEMBERS_ONLINE.format({membersOnline:n})}):nu
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 6d 65 3a 6c 28 29 28 68 2e 67 75 69 6c 64 2c 7b 5b 68 2e 65 6d 62 65 64 5d 3a 66 7d 29 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 69 2e 6a 73 78 29 28 75 2e 5a 50 2c 7b 6d 61 73 6b 3a 75 2e 5a 50 2e 4d 61 73 6b 73 2e 53 51 55 49 52 43 4c 45 2c 77 69 64 74 68 3a 32 30 2c 68 65 69 67 68 74 3a 32 30 2c 63 68 69 6c 64 72 65 6e 3a 28 30 2c 69 2e 6a 73 78 29 28 63 2e 5a 2c 7b 67 75 69 6c 64 3a 49 2c 73 69 7a 65 3a 63 2e 5a 2e 53 69 7a 65 73 2e 4d 49 4e 49 2c 61 63 74 69 76 65 3a 21 30 7d 29 7d 29 2c 28 30 2c 69 2e 6a 73 78 29 28 6f 2e 54 65 78 74 2c 7b 63 6f 6c 6f 72 3a 22 68 65 61 64 65 72 2d 73 65 63 6f 6e 64 61 72 79 22 2c 63 6c 61 73 73 4e 61 6d 65 3a 68 2e 5f 5f 69 6e 76 61 6c 69 64 5f 6c 61 62 65 6c 2c 76 61 72 69 61 6e 74 3a 22 74 65 78 74 2d 73 6d 2f 6e Data Ascii: me:l()(h.guild,{[h.embed]:f}),children:[(0,i.jsx)(u.ZP,{mask:u.ZP.Masks.SQUIRCLE,width:20,height:20,children:(0,i.jsx)(c.Z,{guild:I,size:c.Z.Sizes.MINI,active:!0})}),(0,i.jsx)(o.Text,{color:"header-secondary",className:h.__invalid_label,variant:"text-sm/n
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 28 74 3d 73 28 29 2e 6f 73 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 66 61 6d 69 6c 79 3b 69 66 28 22 41 6e 64 72 6f 69 64 22 3d 3d 3d 69 7c 7c 22 69 4f 53 22 3d 3d 3d 69 29 7b 6c 65 74 20 74 3d 6e 75 6c 6c 21 3d 3d 28 6e 3d 75 2e 64 65 66 61 75 6c 74 2e 67 65 74 46 69 6e 67 65 72 70 72 69 6e 74 28 29 29 26 26 76 6f 69 64 20 30 21 3d 3d 6e 3f 6e 3a 75 2e 64 65 66 61 75 6c 74 2e 67 65 74 49 64 28 29 2c 69 3d 28 30 2c 6c 2e 57 53 29 28 29 3b 69 66 28 6e 75 6c 6c 3d 3d 74 26 26 75 2e 64 65 66 61 75 6c 74 2e 69 73 41 75 74 68 65 6e 74 69 63 61 74 65 64 28 29 29 74 72 79 7b 61 77 61 69 74 20 28 30 2c 61 2e 6b 29 28 29 2c 74 3d 75 2e 64 65 66 61 75 6c 74 2e 67 65 74 49 64 28 29 7d 63 61 74 63 68 7b 7d 72 65 74 75 72 6e 28 30 2c 6c 2e Data Ascii: (t=s().os)\|\|void 0===t?void 0:t.family;if("Android"===i\|\|"iOS"===i){let t=null!==(n=u.default.getFingerprint())&&void 0!==n?n:u.default.getId(),i=(0,l.WS)();if(null==t&&u.default.isAuthenticated())try{await (0,a.k)(),t=u.default.getId()}catch{}return(0,l.
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 6f 6e 65 3a 28 65 2c 74 2c 6e 29 3d 3e 6c 2e 74 6e 2e 70 6f 73 74 28 7b 75 72 6c 3a 63 2e 41 4e 4d 2e 50 48 4f 4e 45 2c 62 6f 64 79 3a 7b 70 68 6f 6e 65 5f 74 6f 6b 65 6e 3a 65 2c 70 61 73 73 77 6f 72 64 3a 74 2c 63 68 61 6e 67 65 5f 70 68 6f 6e 65 5f 72 65 61 73 6f 6e 3a 6e 7d 2c 6f 6c 64 46 6f 72 6d 45 72 72 6f 72 73 3a 21 30 7d 29 2c 61 64 64 50 68 6f 6e 65 57 69 74 68 6f 75 74 50 61 73 73 77 6f 72 64 3a 65 3d 3e 6c 2e 74 6e 2e 70 6f 73 74 28 7b 75 72 6c 3a 63 2e 41 4e 4d 2e 50 48 4f 4e 45 5f 56 45 52 49 46 59 5f 4e 4f 5f 50 41 53 53 57 4f 52 44 2c 62 6f 64 79 3a 7b 63 6f 64 65 3a 65 7d 7d 29 2c 62 65 67 69 6e 52 65 76 65 72 69 66 79 50 68 6f 6e 65 3a 28 65 2c 74 29 3d 3e 6c 2e 74 6e 2e 70 6f 73 74 28 7b 75 72 6c 3a 63 2e 41 4e 4d 2e 50 48 4f 4e 45 5f Data Ascii: one:(e,t,n)=>l.tn.post({url:c.ANM.PHONE,body:{phone_token:e,password:t,change_phone_reason:n},oldFormErrors:!0}),addPhoneWithoutPassword:e=>l.tn.post({url:c.ANM.PHONE_VERIFY_NO_PASSWORD,body:{code:e}}),beginReverifyPhone:(e,t)=>l.tn.post({url:c.ANM.PHONE_
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 49 7d 2c 4e 58 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 7d 2c 52 5f 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 53 7d 2c 65 24 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 45 7d 2c 74 69 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 67 7d 2c 7a 56 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 7d 7d 29 2c 6e 28 37 35 37 31 34 33 29 2c 6e 28 34 37 31 32 30 29 2c 6e 28 36 32 37 33 34 31 29 3b 76 61 72 20 69 3d 6e 28 39 31 33 35 32 37 29 2c 73 3d 6e 2e 6e 28 69 29 2c 72 3d 6e 28 32 37 38 30 37 34 29 2c 6c 3d 6e 28 37 36 38 35 38 31 29 2c 6f 3d 6e 28 37 30 39 30 35 34 29 2c 61 3d 6e 28 36 32 34 31 33 38 29 2c 64 3d 6e 28 32 31 39 34 39 36 29 2c 75 3d 6e 28 38 30 31 Data Ascii: ){return I},NX:function(){return f},R_:function(){return S},e$:function(){return E},ti:function(){return g},zV:function(){return _}}),n(757143),n(47120),n(627341);var i=n(913527),s=n.n(i),r=n(278074),l=n(768581),o=n(709054),a=n(624138),d=n(219496),u=n(801
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 73 73 61 67 65 3a 63 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 41 50 50 4c 49 43 41 54 49 4f 4e 5f 53 54 4f 52 45 5f 4c 49 53 54 49 4e 47 5f 50 55 52 43 48 41 53 45 5f 52 41 54 45 5f 4c 49 4d 49 54 5f 45 52 52 4f 52 5f 53 48 4f 52 54 7d 29 29 2e 77 69 74 68 28 7b 65 72 72 6f 72 3a 72 2e 50 2e 6e 6f 74 28 72 2e 50 2e 6e 75 6c 6c 69 73 68 29 7d 2c 65 3d 3e 7b 6c 65 74 7b 65 72 72 6f 72 3a 74 7d 3d 65 3b 72 65 74 75 72 6e 7b 74 79 70 65 3a 64 2e 4b 2e 45 52 52 4f 52 2c 6d 65 73 73 61 67 65 3a 74 7d 7d 29 2e 77 69 74 68 28 7b 74 61 6b 65 6e 3a 21 31 7d 2c 28 29 3d 3e 28 7b 74 79 70 65 3a 64 2e 4b 2e 41 56 41 49 4c 41 42 4c 45 2c 6d 65 73 73 61 67 65 3a 63 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 50 4f 4d 45 4c 4f 5f 45 58 49 53 54 49 4e 47 5f 46 4c 4f 57 5f 41 56 41 49 Data Ascii: ssage:c.Z.Messages.APPLICATION_STORE_LISTING_PURCHASE_RATE_LIMIT_ERROR_SHORT})).with({error:r.P.not(r.P.nullish)},e=>{let{error:t}=e;return{type:d.K.ERROR,message:t}}).with({taken:!1},()=>({type:d.K.AVAILABLE,message:c.Z.Messages.POMELO_EXISTING_FLOW_AVAI
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 5f 73 69 7a 65 3a 30 2c 63 73 73 5f 63 6f 6d 70 72 65 73 73 65 64 5f 62 79 74 65 5f 73 69 7a 65 3a 30 2c 63 73 73 5f 75 6e 63 6f 6d 70 72 65 73 73 65 64 5f 62 79 74 65 5f 73 69 7a 65 3a 30 2c 63 73 73 5f 74 72 61 6e 73 66 65 72 5f 62 79 74 65 5f 73 69 7a 65 3a 30 7d 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 26 26 6e 75 6c 6c 21 3d 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 67 65 74 45 6e 74 72 69 65 73 26 26 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 67 65 74 45 6e 74 72 69 65 73 28 29 2e 66 6f 72 45 61 63 68 28 6e 3d 3e 7b 6c 65 74 20 69 3d 6e 75 6c 6c 21 3d 6e 2e 65 6e 63 6f 64 65 64 42 6f 64 79 53 69 7a 65 3f 6e 2e 65 6e 63 6f 64 65 64 42 6f 64 79 53 69 7a 65 3a 6e 2e 64 Data Ascii: _size:0,css_compressed_byte_size:0,css_uncompressed_byte_size:0,css_transfer_byte_size:0};return null!=window.performance&&null!=window.performance.getEntries&&window.performance.getEntries().forEach(n=>{let i=null!=n.encodedBodySize?n.encodedBodySize:n.d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.9	49856	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:24 UTC	868	OUT	GET /assets/36e086bbcea2eace814d.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:24 UTC	966	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:24 GMT Content-Type: text/javascript Content-Length: 18183 Connection: close CF-Ray: 8d782e64df8a3464-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "cb2e31554ec3ce69856dd70c281a6db7" Last-Modified: Tue, 15 Oct 2024 21:50:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sRWoLH821cvT469NqzazjOChmrOLsXTXCVgVyjBy%2FTsm%2FSdvBjIposs0HVqnacOh5Xzz2mfzA5q98%2BfkFkzrY3GLqLrWa%2Blt7%2BwogRTsb36xpPD5UGMKK4evRXKk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:24 UTC	403	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 31 30 37 37 38 22 5d 2c 7b 34 31 38 37 35 37 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 62 37 64 31 64 63 36 62 30 37 34 36 31 30 31 37 31 39 63 35 2e 70 6e 67 22 7d 2c 34 39 34 32 30 37 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 38 35 31 35 33 66 65 37 31 38 37 33 64 61 30 66 35 38 30 32 2e 73 76 67 22 7d 2c 33 32 30 34 34 30 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["10778"],{418757:function(e){e.exports="/assets/b7d1dc6b0746101719c5.png"},494207:function(e){e.exports="/assets/85153fe71873da0f5802.svg"},320440:function(e){e.exports="/
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 65 31 38 35 61 64 61 62 36 2e 73 76 67 22 7d 2c 38 32 36 38 30 36 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 66 62 34 31 38 30 35 39 66 34 31 62 35 36 39 61 62 63 61 34 2e 73 76 67 22 7d 2c 31 32 33 30 31 33 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 39 38 63 61 63 63 34 39 32 64 39 38 35 35 36 35 65 64 34 66 2e 70 6e 67 22 7d 2c 35 34 30 39 30 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 32 61 35 31 37 36 63 66 32 62 64 30 63 63 64 66 30 65 37 62 2e 73 76 67 22 7d 2c 32 33 32 34 35 34 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 61 64 32 30 32 37 Data Ascii: e185adab6.svg"},826806:function(e){e.exports="/assets/fb418059f41b569abca4.svg"},123013:function(e){e.exports="/assets/98cacc492d985565ed4f.png"},540909:function(e){e.exports="/assets/2a5176cf2bd0ccdf0e7b.svg"},232454:function(e){e.exports="/assets/ad2027
2024-10-24 07:16:24 UTC	1272	IN	Data Raw: 39 2e 38 31 30 32 20 33 36 2e 30 37 37 38 4c 37 38 2e 38 31 34 38 20 33 36 2e 31 37 34 37 4c 37 37 2e 38 31 39 35 20 33 36 2e 32 37 31 35 43 37 37 2e 39 33 38 39 20 33 37 2e 34 39 37 37 20 37 38 20 33 38 2e 37 34 31 34 20 37 38 20 34 30 43 37 38 20 34 31 2e 32 35 38 36 20 37 37 2e 39 33 38 39 20 34 32 2e 35 30 32 33 20 37 37 2e 38 31 39 35 20 34 33 2e 37 32 38 35 4c 37 38 2e 38 31 34 38 20 34 33 2e 38 32 35 33 5a 4d 34 33 2e 38 32 35 33 20 31 2e 31 38 35 31 35 4c 34 33 2e 39 32 32 32 20 30 2e 31 38 39 38 35 33 43 34 32 2e 36 33 31 38 20 30 2e 30 36 34 32 36 37 39 20 34 31 2e 33 32 33 34 20 30 20 34 30 20 30 43 33 38 2e 36 37 36 36 20 30 20 33 37 2e 33 36 38 32 20 30 2e 30 36 34 32 36 38 20 33 36 2e 30 37 37 38 20 30 2e 31 38 39 38 35 33 4c 33 36 2e 31 37 Data Ascii: 9.8102 36.0778L78.8148 36.1747L77.8195 36.2715C77.9389 37.4977 78 38.7414 78 40C78 41.2586 77.9389 42.5023 77.8195 43.7285L78.8148 43.8253ZM43.8253 1.18515L43.9222 0.189853C42.6318 0.0642679 41.3234 0 40 0C38.6766 0 37.3682 0.064268 36.0778 0.189853L36.17
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 31 2e 30 33 35 34 4c 32 2e 36 36 39 35 37 20 35 31 2e 33 32 35 34 5a 4d 39 2e 38 35 31 30 35 20 36 34 2e 37 34 31 33 4c 39 2e 30 37 38 34 20 36 35 2e 33 37 36 31 43 31 30 2e 37 34 31 36 20 36 37 2e 34 30 30 34 20 31 32 2e 35 39 39 36 20 36 39 2e 32 35 38 34 20 31 34 2e 36 32 33 39 20 37 30 2e 39 32 31 36 4c 31 35 2e 32 35 38 37 20 37 30 2e 31 34 38 39 4c 31 35 2e 38 39 33 35 20 36 39 2e 33 37 36 33 43 31 33 2e 39 36 39 39 20 36 37 2e 37 39 35 38 20 31 32 2e 32 30 34 32 20 36 36 2e 30 33 30 31 20 31 30 2e 36 32 33 37 20 36 34 2e 31 30 36 35 4c 39 2e 38 35 31 30 35 20 36 34 2e 37 34 31 33 5a 4d 32 31 2e 36 31 32 39 20 37 34 2e 34 30 32 34 4c 32 31 2e 31 34 30 38 20 37 35 2e 32 38 34 43 32 33 2e 34 33 31 32 20 37 36 2e 35 31 30 37 20 32 35 2e 38 35 34 39 20 Data Ascii: 1.0354L2.66957 51.3254ZM9.85105 64.7413L9.0784 65.3761C10.7416 67.4004 12.5996 69.2584 14.6239 70.9216L15.2587 70.1489L15.8935 69.3763C13.9699 67.7958 12.2042 66.0301 10.6237 64.1065L9.85105 64.7413ZM21.6129 74.4024L21.1408 75.284C23.4312 76.5107 25.8549
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 28 30 2c 45 2e 6a 73 78 29 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 34 30 20 32 39 43 33 37 2e 37 39 34 20 32 39 20 33 36 20 33 30 2e 37 39 34 20 33 36 20 33 33 43 33 36 20 33 35 2e 32 30 37 20 33 37 2e 37 39 34 20 33 37 20 34 30 20 33 37 43 34 32 2e 32 30 36 20 33 37 20 34 34 20 33 35 2e 32 30 37 20 34 34 20 33 33 43 34 34 20 33 30 2e 37 39 35 20 34 32 2e 32 30 36 20 32 39 20 34 30 20 32 39 5a 22 2c 66 69 6c 6c 3a 22 63 75 72 72 65 6e 74 43 6f 6c 6f 72 22 7d 29 2c 28 30 2c 45 2e 6a 73 78 29 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 34 38 20 32 36 2e 30 30 31 48 34 36 2e 30 37 43 34 35 2e 34 30 32 20 32 36 2e 30 30 31 20 34 34 2e 37 37 37 20 32 35 2e 36 36 37 20 34 34 2e 34 30 36 20 32 35 2e 31 31 31 4c 34 33 2e 35 39 34 20 32 33 2e 38 39 31 43 34 33 2e 32 32 Data Ascii: (0,E.jsx)("path",{d:"M40 29C37.794 29 36 30.794 36 33C36 35.207 37.794 37 40 37C42.206 37 44 35.207 44 33C44 30.795 42.206 29 40 29Z",fill:"currentColor"}),(0,E.jsx)("path",{d:"M48 26.001H46.07C45.402 26.001 44.777 25.667 44.406 25.111L43.594 23.891C43.22
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 2e 31 35 36 20 34 35 2e 39 35 35 38 20 35 34 2e 34 30 34 20 34 35 2e 39 35 35 38 20 35 31 2e 38 34 38 5a 4d 34 33 2e 38 39 31 38 20 35 31 2e 38 36 43 34 33 2e 38 39 31 38 20 35 33 2e 35 30 34 20 34 33 2e 31 39 35 38 20 35 34 2e 35 34 38 20 34 31 2e 39 39 35 38 20 35 34 2e 35 34 38 43 34 30 2e 38 30 37 38 20 35 34 2e 35 34 38 20 34 30 2e 30 39 39 38 20 35 33 2e 35 30 34 20 34 30 2e 30 39 39 38 20 35 31 2e 38 36 43 34 30 2e 30 39 39 38 20 35 30 2e 32 31 36 20 34 30 2e 38 30 37 38 20 34 39 2e 31 37 32 20 34 31 2e 39 39 35 38 20 34 39 2e 31 37 32 43 34 33 2e 31 39 35 38 20 34 39 2e 31 37 32 20 34 33 2e 38 39 31 38 20 35 30 2e 32 31 36 20 34 33 2e 38 39 31 38 20 35 31 2e 38 36 5a 4d 35 32 2e 32 39 31 36 20 35 36 2e 30 38 34 4c 35 34 2e 33 36 37 36 20 35 35 2e Data Ascii: .156 45.9558 54.404 45.9558 51.848ZM43.8918 51.86C43.8918 53.504 43.1958 54.548 41.9958 54.548C40.8078 54.548 40.0998 53.504 40.0998 51.86C40.0998 50.216 40.8078 49.172 41.9958 49.172C43.1958 49.172 43.8918 50.216 43.8918 51.86ZM52.2916 56.084L54.3676 55.
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 7d 29 2c 69 28 73 2e 62 6f 64 79 29 7d 29 7d 29 29 7d 7d 2c 38 37 35 33 30 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 73 2c 61 29 7b 61 2e 64 28 73 2c 7b 52 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 7d 7d 29 3b 76 61 72 20 45 3d 61 28 38 33 37 37 34 38 29 3b 66 75 6e 63 74 69 6f 6e 20 5f 28 65 29 7b 72 65 74 75 72 6e 28 30 2c 45 2e 5a 29 28 65 29 2e 61 75 74 68 6f 72 7d 7d 2c 38 33 37 37 34 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 73 2c 61 29 7b 61 2e 64 28 73 2c 7b 5a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 7d 7d 29 3b 76 61 72 20 45 3d 61 28 35 38 33 34 36 29 2c 5f 3d 61 28 36 38 39 39 33 38 29 3b 66 75 6e 63 74 69 6f 6e 20 74 28 65 29 7b 73 77 69 74 63 68 28 65 29 7b 63 61 73 65 20 45 2e 48 51 2e 43 4c 41 53 53 52 4f 4f Data Ascii: }),i(s.body)})}))}},875307:function(e,s,a){a.d(s,{R:function(){return _}});var E=a(837748);function _(e){return(0,E.Z)(e).author}},837748:function(e,s,a){a.d(s,{Z:function(){return t}});var E=a(58346),_=a(689938);function t(e){switch(e){case E.HQ.CLASSROO
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 45 52 5f 4e 41 4d 45 5f 43 52 45 41 54 4f 52 53 5f 48 4f 42 42 49 45 53 2c 61 75 74 68 6f 72 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 44 49 53 43 4f 52 44 5f 4e 41 4d 45 7d 3b 63 61 73 65 20 45 2e 48 51 2e 47 4c 4f 42 41 4c 5f 43 4f 4d 4d 55 4e 49 54 49 45 53 3a 72 65 74 75 72 6e 7b 68 65 61 64 65 72 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 5f 4d 4f 44 41 4c 5f 54 49 54 4c 45 5f 47 4c 4f 42 41 4c 5f 43 4f 4d 4d 55 4e 49 54 49 45 53 2c 64 65 73 63 72 69 70 74 69 6f 6e 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 5f 4d 4f 44 41 4c 5f 44 45 53 43 52 49 50 54 49 4f 4e 5f 47 4c 4f 42 41 4c 5f 43 4f 4d 4d 55 4e 49 54 49 45 53 2c 6e 61 6d 65 4c 61 62 65 6c 3a 5f 2e 5a 2e 4d 65 73 Data Ascii: ER_NAME_CREATORS_HOBBIES,author:_.Z.Messages.DISCORD_NAME};case E.HQ.GLOBAL_COMMUNITIES:return{header:_.Z.Messages.GUILD_TEMPLATE_MODAL_TITLE_GLOBAL_COMMUNITIES,description:_.Z.Messages.GUILD_TEMPLATE_MODAL_DESCRIPTION_GLOBAL_COMMUNITIES,nameLabel:_.Z.Mes
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 69 70 74 69 6f 6e 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 5f 4d 4f 44 41 4c 5f 44 45 53 43 52 49 50 54 49 4f 4e 5f 43 52 45 41 54 45 5f 46 52 4f 4d 5f 53 43 52 41 54 43 48 2c 6e 61 6d 65 4c 61 62 65 6c 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 53 5f 46 4f 52 4d 5f 4c 41 42 45 4c 5f 53 45 52 56 45 52 5f 4e 41 4d 45 5f 43 52 45 41 54 45 5f 46 52 4f 4d 5f 53 43 52 41 54 43 48 2c 74 65 72 6d 73 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 43 52 45 41 54 45 5f 53 45 52 56 45 52 5f 47 55 49 44 45 4c 49 4e 45 53 2c 64 65 66 61 75 6c 74 4e 61 6d 65 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 5f 44 45 46 41 55 4c 54 5f 53 45 52 56 45 52 5f 4e Data Ascii: iption:_.Z.Messages.GUILD_TEMPLATE_MODAL_DESCRIPTION_CREATE_FROM_SCRATCH,nameLabel:_.Z.Messages.GUILD_TEMPLATES_FORM_LABEL_SERVER_NAME_CREATE_FROM_SCRATCH,terms:_.Z.Messages.CREATE_SERVER_GUIDELINES,defaultName:_.Z.Messages.GUILD_TEMPLATE_DEFAULT_SERVER_N
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 63 61 74 69 6f 6e 22 7d 3b 64 65 66 61 75 6c 74 3a 72 65 74 75 72 6e 7b 68 65 61 64 65 72 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 5f 43 52 45 41 54 45 5f 44 49 53 43 4f 52 44 2c 6e 61 6d 65 4c 61 62 65 6c 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 46 4f 52 4d 5f 4c 41 42 45 4c 5f 53 45 52 56 45 52 5f 4e 41 4d 45 2c 74 65 72 6d 73 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 43 52 45 41 54 45 5f 53 45 52 56 45 52 5f 47 55 49 44 45 4c 49 4e 45 53 2c 64 65 66 61 75 6c 74 4e 61 6d 65 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 43 52 45 41 54 45 5f 53 45 52 56 45 52 5f 44 45 46 41 55 4c 54 5f 53 45 52 56 45 52 5f 4e 41 4d 45 5f 46 4f 52 4d 41 54 7d 7d 7d 7d 2c 39 37 31 34 30 31 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 73 2c 61 Data Ascii: cation"};default:return{header:_.Z.Messages.GUILD_TEMPLATE_CREATE_DISCORD,nameLabel:_.Z.Messages.FORM_LABEL_SERVER_NAME,terms:_.Z.Messages.CREATE_SERVER_GUIDELINES,defaultName:_.Z.Messages.CREATE_SERVER_DEFAULT_SERVER_NAME_FORMAT}}}},971401:function(e,s,a

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.9	49860	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:24 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:24 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:24 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 3ed3a1a2-201e-0085-145a-2334e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071624Z-17fbfdc98bbnpjstwqrbe0re7n00000006y0000000002x29 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:24 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.9	49859	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:24 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:24 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:24 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 654233af-a01e-001e-0b27-2149ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071624Z-r1755647c66prnf6k99z0m3kzc00000009eg000000003504 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:24 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.9	49861	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:24 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:24 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:24 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: fca683ae-601e-0070-466b-23a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071624Z-17fbfdc98bbkw9phumvsc7yy8w00000006xg000000003p3u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:24 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.9	49865	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:24 UTC	868	OUT	GET /assets/6df906184440a6461f5c.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:24 UTC	962	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:24 GMT Content-Type: text/javascript Content-Length: 11167 Connection: close CF-Ray: 8d782e660daee736-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "8aaa605c48dc545f185ca77c921139d3" Last-Modified: Tue, 15 Oct 2024 21:50:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tGdVlY9mLrsnwvCIIuEdp9xXc4W7fT9ryrgoxpnRF5OvzG9DkgLRTmHCg8P1Imec51%2FiiQKjo37LA4X8f%2FqpuzAV3aMBuFJJciEB283LvqzRoldK2aSr%2FDtEsKiR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:24 UTC	407	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 35 32 30 33 30 22 5d 2c 7b 34 38 35 35 30 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 73 29 7b 73 2e 64 28 74 2c 7b 50 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 7d 7d 29 3b 76 61 72 20 6e 3d 73 28 36 38 39 39 33 38 29 3b 6c 65 74 20 6c 3d 7b 67 65 74 20 77 65 62 61 75 74 68 6e 28 29 7b 72 65 74 75 72 6e 20 6e 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 4d 46 41 5f 56 32 5f 57 45 42 41 55 54 48 4e 5f 4e 41 4d 45 7d 2c 67 65 74 20 74 6f 74 70 28 29 7b 72 65 74 75 72 6e 20 6e 2e 5a 2e 4d 65 73 73 61 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["52030"],{48550:function(e,t,s){s.d(t,{P:function(){return l}});var n=s(689938);let l={get webauthn(){return n.Z.Messages.MFA_V2_WEBAUTHN_NAME},get totp(){return n.Z.Messa
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 73 73 61 67 65 73 2e 4d 46 41 5f 56 32 5f 42 41 43 4b 55 50 5f 4e 41 4d 45 7d 7d 7d 2c 31 32 34 38 36 30 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 73 29 7b 73 2e 64 28 74 2c 7b 43 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 7d 2c 59 52 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 53 7d 7d 29 2c 73 28 34 37 31 32 30 29 2c 73 28 34 31 31 31 30 34 29 3b 76 61 72 20 6e 3d 73 28 32 30 30 36 35 31 29 2c 6c 3d 73 28 31 39 32 33 37 39 29 2c 69 3d 73 28 34 38 31 30 36 30 29 2c 72 3d 73 28 34 34 37 30 39 37 29 2c 6f 3d 73 28 38 37 33 31 32 34 29 2c 61 3d 73 28 32 34 38 39 30 32 29 2c 64 3d 73 28 31 36 30 35 31 31 29 2c 75 3d 73 28 35 31 36 39 33 29 2c 63 3d 73 28 39 37 33 38 31 30 29 2c 68 3d 73 28 36 38 39 39 33 38 29 3b 66 75 6e 63 Data Ascii: ssages.MFA_V2_BACKUP_NAME}}},124860:function(e,t,s){s.d(t,{Cd:function(){return f},YR:function(){return S}}),s(47120),s(411104);var n=s(200651),l=s(192379),i=s(481060),r=s(447097),o=s(873124),a=s(248902),d=s(160511),u=s(51693),c=s(973810),h=s(689938);func
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 78 29 28 66 2c 7b 6d 66 61 43 68 61 6c 6c 65 6e 67 65 3a 74 2c 6d 66 61 46 69 6e 69 73 68 3a 73 2c 6f 6e 43 6c 6f 73 65 3a 72 2c 6f 6e 45 61 72 6c 79 43 6c 6f 73 65 3a 72 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 53 28 65 2c 74 2c 73 29 7b 28 30 2c 69 2e 6f 70 65 6e 4d 6f 64 61 6c 29 28 73 3d 3e 28 30 2c 6e 2e 6a 73 78 29 28 6d 2c 7b 66 69 6e 69 73 68 3a 74 2c 6d 66 61 43 68 61 6c 6c 65 6e 67 65 3a 65 2c 2e 2e 2e 73 7d 29 2c 7b 6f 6e 43 6c 6f 73 65 43 61 6c 6c 62 61 63 6b 3a 28 29 3d 3e 7b 73 28 45 72 72 6f 72 28 68 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 4d 46 41 5f 56 32 5f 43 41 4e 43 45 4c 45 44 29 29 7d 7d 29 7d 7d 2c 35 30 37 34 35 33 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 73 29 7b 76 61 72 20 6e 3d 73 28 32 30 30 36 35 31 29 3b 73 28 31 39 32 33 37 Data Ascii: x)(f,{mfaChallenge:t,mfaFinish:s,onClose:r,onEarlyClose:r})})}function S(e,t,s){(0,i.openModal)(s=>(0,n.jsx)(m,{finish:t,mfaChallenge:e,...s}),{onCloseCallback:()=>{s(Error(h.Z.Messages.MFA_V2_CANCELED))}})}},507453:function(e,t,s){var n=s(200651);s(19237
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 22 2c 63 6c 61 73 73 4e 61 6d 65 3a 6f 2e 73 75 62 74 69 74 6c 65 2c 63 68 69 6c 64 72 65 6e 3a 74 7d 29 2c 28 30 2c 6e 2e 6a 73 78 29 28 6c 2e 4d 6f 64 61 6c 43 6c 6f 73 65 42 75 74 74 6f 6e 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 6f 2e 63 6c 6f 73 65 42 75 74 74 6f 6e 2c 6f 6e 43 6c 69 63 6b 3a 73 7d 29 5d 7d 29 7d 7d 7d 2c 34 34 37 30 39 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 73 29 7b 73 2e 64 28 74 2c 7b 5a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 64 7d 7d 29 2c 73 28 37 35 37 31 34 33 29 2c 73 28 34 37 31 32 30 29 2c 73 28 37 37 33 36 30 33 29 3b 76 61 72 20 6e 3d 73 28 32 30 30 36 35 31 29 2c 6c 3d 73 28 31 39 32 33 37 39 29 2c 69 3d 73 28 36 35 38 35 35 30 29 2c 72 3d 73 28 34 38 31 30 36 30 29 2c 6f 3d 73 28 35 30 37 34 35 33 29 Data Ascii: ",className:o.subtitle,children:t}),(0,n.jsx)(l.ModalCloseButton,{className:o.closeButton,onClick:s})]})}}},447097:function(e,t,s){s.d(t,{Z:function(){return d}}),s(757143),s(47120),s(773603);var n=s(200651),l=s(192379),i=s(658550),r=s(481060),o=s(507453)
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 29 2c 69 3d 73 28 34 38 31 30 36 30 29 2c 72 3d 73 28 35 30 37 34 35 33 29 2c 6f 3d 73 28 36 38 39 39 33 38 29 3b 66 75 6e 63 74 69 6f 6e 20 61 28 65 29 7b 6c 65 74 7b 6d 66 61 43 68 61 6c 6c 65 6e 67 65 3a 74 2c 66 69 6e 69 73 68 3a 73 2c 73 65 74 53 6c 69 64 65 3a 61 2c 6f 6e 43 6c 6f 73 65 3a 64 2c 69 73 53 6c 69 64 65 52 65 61 64 79 3a 75 7d 3d 65 2c 5b 63 2c 68 5d 3d 6c 2e 75 73 65 53 74 61 74 65 28 21 31 29 2c 5b 66 2c 6d 5d 3d 6c 2e 75 73 65 53 74 61 74 65 28 6e 75 6c 6c 29 2c 5b 53 2c 5f 5d 3d 6c 2e 75 73 65 53 74 61 74 65 28 22 22 29 2c 67 3d 6c 2e 75 73 65 52 65 66 28 6e 75 6c 6c 29 3b 72 65 74 75 72 6e 20 6c 2e 75 73 65 45 66 66 65 63 74 28 28 29 3d 3e 7b 69 66 28 75 29 7b 76 61 72 20 65 3b 6e 75 6c 6c 3d 3d 3d 28 65 3d 67 2e 63 75 72 72 65 6e Data Ascii: ),i=s(481060),r=s(507453),o=s(689938);function a(e){let{mfaChallenge:t,finish:s,setSlide:a,onClose:d,isSlideReady:u}=e,[c,h]=l.useState(!1),[f,m]=l.useState(null),[S,_]=l.useState(""),g=l.useRef(null);return l.useEffect(()=>{if(u){var e;null===(e=g.curren
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 6c 69 63 6b 3a 28 29 3d 3e 7b 73 28 65 2e 74 79 70 65 29 7d 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 6e 2e 6a 73 78 29 28 6c 2e 54 65 78 74 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 61 2e 6c 69 73 74 49 74 65 6d 54 65 78 74 2c 76 61 72 69 61 6e 74 3a 22 74 65 78 74 2d 6d 64 2f 73 65 6d 69 62 6f 6c 64 22 2c 63 68 69 6c 64 72 65 6e 3a 72 2e 50 5b 65 2e 74 79 70 65 5d 7d 29 2c 28 30 2c 6e 2e 6a 73 78 29 28 6c 2e 43 68 65 76 72 6f 6e 53 6d 61 6c 6c 52 69 67 68 74 49 63 6f 6e 2c 7b 73 69 7a 65 3a 22 63 75 73 74 6f 6d 22 2c 63 6f 6c 6f 72 3a 22 63 75 72 72 65 6e 74 43 6f 6c 6f 72 22 2c 77 69 64 74 68 3a 32 30 2c 68 65 69 67 68 74 3a 32 30 2c 63 6c 61 73 73 4e 61 6d 65 3a 61 2e 6c 69 73 74 49 74 65 6d 41 72 72 6f 77 7d 29 5d 7d 2c 65 2e 74 79 70 65 29 29 7d 29 5d 7d Data Ascii: lick:()=>{s(e.type)},children:[(0,n.jsx)(l.Text,{className:a.listItemText,variant:"text-md/semibold",children:r.P[e.type]}),(0,n.jsx)(l.ChevronSmallRightIcon,{size:"custom",color:"currentColor",width:20,height:20,className:a.listItemArrow})]},e.type))})]}
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 66 7d 29 2c 28 30 2c 6e 2e 6a 73 78 29 28 61 2e 5a 2e 53 6c 69 64 65 43 6f 6e 74 65 6e 74 2c 7b 63 68 69 6c 64 72 65 6e 3a 28 30 2c 6e 2e 6a 73 78 73 29 28 6f 2e 46 6f 72 6d 49 74 65 6d 2c 7b 74 69 74 6c 65 3a 75 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 54 57 4f 5f 46 41 5f 45 4e 54 45 52 5f 54 4f 4b 45 4e 5f 4e 4f 5f 42 41 43 4b 55 50 5f 4c 41 42 45 4c 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 6e 2e 6a 73 78 73 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 63 2e 73 6d 73 49 6e 70 75 74 43 6f 6e 74 61 69 6e 65 72 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 6e 2e 6a 73 78 29 28 6f 2e 54 65 78 74 49 6e 70 75 74 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 63 2e 73 6d 73 49 6e 70 75 74 2c 69 6e 70 75 74 52 65 66 3a 4d 2c 6f 6e 43 68 61 6e 67 65 3a 5a 2c 70 6c 61 Data Ascii: f}),(0,n.jsx)(a.Z.SlideContent,{children:(0,n.jsxs)(o.FormItem,{title:u.Z.Messages.TWO_FA_ENTER_TOKEN_NO_BACKUP_LABEL,children:[(0,n.jsxs)("div",{className:c.smsInputContainer,children:[(0,n.jsx)(o.TextInput,{className:c.smsInput,inputRef:M,onChange:Z,pla
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 69 64 20 30 21 3d 3d 73 3f 73 3a 6e 75 6c 6c 3d 3d 3d 28 74 3d 65 2e 62 6f 64 79 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 6d 65 73 73 61 67 65 29 7d 29 2e 66 69 6e 61 6c 6c 79 28 28 29 3d 3e 7b 66 28 21 31 29 7d 29 7d 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 6e 2e 6a 73 78 29 28 6f 2e 5a 2e 53 6c 69 64 65 48 65 61 64 65 72 2c 7b 6f 6e 43 6c 6f 73 65 3a 75 7d 29 2c 28 30 2c 6e 2e 6a 73 78 29 28 6f 2e 5a 2e 53 6c 69 64 65 43 6f 6e 74 65 6e 74 2c 7b 63 68 69 6c 64 72 65 6e 3a 28 30 2c 6e 2e 6a 73 78 73 29 28 72 2e 46 6f 72 6d 49 74 65 6d 2c 7b 74 69 74 6c 65 3a 61 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 54 57 4f 5f 46 41 5f 45 4e 54 45 52 5f 54 4f 4b 45 4e 5f 4e 4f 5f 42 41 43 4b 55 50 5f 4c 41 42 45 4c 2c 63 68 69 6c 64 72 65 6e 3a Data Ascii: id 0!==s?s:null===(t=e.body)\|\|void 0===t?void 0:t.message)}).finally(()=>{f(!1)})},children:[(0,n.jsx)(o.Z.SlideHeader,{onClose:u}),(0,n.jsx)(o.Z.SlideContent,{children:(0,n.jsxs)(r.FormItem,{title:a.Z.Messages.TWO_FA_ENTER_TOKEN_NO_BACKUP_LABEL,children:
2024-10-24 07:16:24 UTC	1177	IN	Data Raw: 45 4e 45 52 49 43 5f 45 52 52 4f 52 29 7d 66 69 6e 61 6c 6c 79 7b 5f 28 21 31 29 7d 7d 3b 72 65 74 75 72 6e 28 30 2c 6e 2e 6a 73 78 73 29 28 6e 2e 46 72 61 67 6d 65 6e 74 2c 7b 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 6e 2e 6a 73 78 29 28 75 2e 5a 2e 53 6c 69 64 65 48 65 61 64 65 72 2c 7b 6f 6e 43 6c 6f 73 65 3a 6d 7d 29 2c 28 30 2c 6e 2e 6a 73 78 73 29 28 75 2e 5a 2e 53 6c 69 64 65 43 6f 6e 74 65 6e 74 2c 7b 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 6e 2e 6a 73 78 29 28 72 2e 42 75 74 74 6f 6e 2c 7b 73 75 62 6d 69 74 74 69 6e 67 3a 53 2c 6f 6e 43 6c 69 63 6b 3a 43 2c 63 68 69 6c 64 72 65 6e 3a 68 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 4d 46 41 5f 56 32 5f 57 45 42 41 55 54 48 4e 5f 43 54 41 7d 29 2c 28 30 2c 6e 2e 6a 73 78 29 28 75 2e 5a 2e 53 6c 69 64 65 45 72 Data Ascii: ENERIC_ERROR)}finally{_(!1)}};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(u.Z.SlideHeader,{onClose:m}),(0,n.jsxs)(u.Z.SlideContent,{children:[(0,n.jsx)(r.Button,{submitting:S,onClick:C,children:h.Z.Messages.MFA_V2_WEBAUTHN_CTA}),(0,n.jsx)(u.Z.SlideEr

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.9	49863	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:24 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:24 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:24 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: a4c96680-901e-008f-156c-2367a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071624Z-17fbfdc98bb75b2fuh11781a0n00000006tg000000005298 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:24 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.9	49862	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:24 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:24 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:24 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: f0881de6-001e-002b-6759-2399f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071624Z-17fbfdc98bb75b2fuh11781a0n00000006sg000000005za5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:24 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.9	49867	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:24 UTC	868	OUT	GET /assets/fdc71c23d09e18e94ce2.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:24 UTC	960	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:24 GMT Content-Type: text/javascript Content-Length: 11547 Connection: close CF-Ray: 8d782e671a476b5e-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "ac6ce4e7ff5f746693ab549f03be7ade" Last-Modified: Tue, 15 Oct 2024 21:50:02 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U5Qx7vCzOt2a9sMmqn%2Fbv4LejNlfdHh0vqYPueNhSfxvwP5QsXxG%2Bl3XFa0mh4GYKadeBd0rNjiVjSnjrtZCw6rMYzbvzmasDi2lCZidunhTS05fLuonVCVVnYPq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:24 UTC	409	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 39 30 36 32 38 22 5d 2c 7b 32 33 31 34 34 33 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 65 30 34 62 63 62 37 33 31 36 66 37 32 30 35 65 38 35 66 62 2e 73 76 67 22 7d 2c 37 34 38 33 30 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 32 33 61 37 61 33 66 64 36 36 32 34 33 34 32 31 31 37 62 66 2e 73 76 67 22 7d 2c 32 30 36 38 31 38 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["90628"],{231443:function(e){e.exports="/assets/e04bcb7316f7205e85fb.svg"},74830:function(e){e.exports="/assets/23a7a3fd6624342117bf.svg"},206818:function(e){e.exports="/a
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 62 2e 6d 70 34 22 7d 2c 35 35 34 33 35 35 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 66 62 37 30 63 36 33 32 35 61 37 64 37 32 38 63 62 36 64 30 2e 70 6e 67 22 7d 2c 39 39 31 39 38 39 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 73 2c 6e 29 7b 65 2e 65 78 70 6f 72 74 73 3d 6e 2e 70 2b 22 34 38 61 64 31 39 65 38 30 30 38 33 62 65 65 36 38 32 64 32 2e 77 65 62 6d 22 7d 2c 37 38 37 34 36 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 73 2c 6e 29 7b 65 2e 65 78 70 6f 72 74 73 3d 6e 2e 70 2b 22 61 34 37 36 38 36 33 64 34 66 34 34 31 36 31 38 38 34 30 66 2e 6d 6f 76 22 7d 2c 36 33 35 35 30 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 73 2c 6e 29 7b 65 2e 65 78 70 6f 72 74 73 3d 6e 2e 70 2b 22 38 37 63 33 61 62 64 39 30 65 32 34 36 Data Ascii: b.mp4"},554355:function(e){e.exports="/assets/fb70c6325a7d728cb6d0.png"},991989:function(e,s,n){e.exports=n.p+"48ad19e80083bee682d2.webm"},787462:function(e,s,n){e.exports=n.p+"a476863d4f441618840f.mov"},635507:function(e,s,n){e.exports=n.p+"87c3abd90e246
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 3a 68 2e 67 75 69 6c 64 49 63 6f 6e 2c 63 68 69 6c 64 72 65 6e 3a 28 30 2c 74 2e 6a 73 78 29 28 69 2e 56 6a 2c 7b 67 75 69 6c 64 3a 73 2c 73 69 7a 65 3a 69 2e 56 6a 2e 53 69 7a 65 73 2e 4c 41 52 47 45 52 2c 61 6e 69 6d 61 74 65 3a 21 30 7d 29 7d 29 3b 65 6c 73 65 20 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 3b 73 2e 5a 3d 65 3d 3e 7b 76 61 72 20 73 3b 6c 65 74 20 6e 2c 61 2c 75 2c 7b 69 6e 76 69 74 65 3a 6f 2c 64 69 73 61 62 6c 65 55 73 65 72 3a 66 3d 21 31 2c 65 72 72 6f 72 3a 53 2c 66 6c 61 74 41 63 74 69 76 69 74 79 43 6f 75 6e 74 3a 76 3d 21 31 2c 69 73 52 65 67 69 73 74 65 72 3a 4d 3d 21 31 7d 3d 65 2c 7b 63 75 72 72 65 6e 74 55 73 65 72 3a 52 2c 6d 75 6c 74 69 41 63 63 6f 75 6e 74 73 3a 4f 7d 3d 28 30 2c 6c 2e 63 6a 29 28 5b 6d 2e 5a 2c 45 2e 64 65 66 61 Data Ascii: :h.guildIcon,children:(0,t.jsx)(i.Vj,{guild:s,size:i.Vj.Sizes.LARGER,animate:!0})});else return null};s.Z=e=>{var s;let n,a,u,{invite:o,disableUser:f=!1,error:S,flatActivityCount:v=!1,isRegister:M=!1}=e,{currentUser:R,multiAccounts:O}=(0,l.cj)([m.Z,E.defa
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 69 2e 44 4b 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 68 2e 61 70 70 49 6e 2c 63 68 69 6c 64 72 65 6e 3a 6a 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 45 4d 42 45 44 44 45 44 5f 41 43 54 49 56 49 54 49 45 53 5f 49 4e 56 49 54 45 5f 49 4e 7d 29 2c 28 30 2c 74 2e 6a 73 78 73 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 68 2e 67 75 69 6c 64 43 6f 6e 74 61 69 6e 65 72 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 74 2e 6a 73 78 29 28 69 2e 56 6a 2c 7b 67 75 69 6c 64 3a 44 2c 73 69 7a 65 3a 69 2e 56 6a 2e 53 69 7a 65 73 2e 53 4d 41 4c 4c 7d 29 2c 28 30 2c 74 2e 6a 73 78 29 28 72 2e 54 65 78 74 2c 7b 74 61 67 3a 22 73 70 61 6e 22 2c 76 61 72 69 61 6e 74 3a 22 74 65 78 74 2d 6c 67 2f 6e 6f 72 6d 61 6c 22 2c 63 6f 6c 6f 72 3a 22 68 65 61 64 65 72 2d 70 72 69 6d 61 72 Data Ascii: i.DK,{className:h.appIn,children:j.Z.Messages.EMBEDDED_ACTIVITIES_INVITE_IN}),(0,t.jsxs)("div",{className:h.guildContainer,children:[(0,t.jsx)(i.Vj,{guild:D,size:i.Vj.Sizes.SMALL}),(0,t.jsx)(r.Text,{tag:"span",variant:"text-lg/normal",color:"header-primar
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 4e 61 6d 65 3a 68 2e 74 69 74 6c 65 2c 63 68 69 6c 64 72 65 6e 3a 5b 6e 75 6c 6c 21 3d 44 3f 28 30 2c 74 2e 6a 73 78 29 28 63 2e 5a 2c 7b 67 75 69 6c 64 3a 44 2c 63 6c 61 73 73 4e 61 6d 65 3a 68 2e 67 75 69 6c 64 42 61 64 67 65 2c 74 6f 6f 6c 74 69 70 50 6f 73 69 74 69 6f 6e 3a 22 6c 65 66 74 22 7d 29 3a 6e 75 6c 6c 2c 6e 2c 61 5d 7d 29 5d 7d 29 2c 75 2c 6e 75 6c 6c 21 3d 5a 7c 7c 42 7c 7c 28 6e 75 6c 6c 3d 3d 6f 3f 76 6f 69 64 20 30 3a 6e 75 6c 6c 3d 3d 3d 28 73 3d 6f 2e 67 75 69 6c 64 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 73 3f 76 6f 69 64 20 30 3a 73 2e 69 64 29 3d 3d 3d 54 2e 66 51 3f 6e 75 6c 6c 3a 28 30 2c 74 2e 6a 73 78 29 28 69 2e 45 4a 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 68 2e 61 63 74 69 76 69 74 79 43 6f 75 6e 74 2c 6f 6e 6c 69 6e 65 3a 6f 2e 61 Data Ascii: Name:h.title,children:[null!=D?(0,t.jsx)(c.Z,{guild:D,className:h.guildBadge,tooltipPosition:"left"}):null,n,a]})]}),u,null!=Z\|\|B\|\|(null==o?void 0:null===(s=o.guild)\|\|void 0===s?void 0:s.id)===T.fQ?null:(0,t.jsx)(i.EJ,{className:h.activityCount,online:o.a
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 3e 7b 6c 65 74 7b 63 6c 61 73 73 4e 61 6d 65 3a 73 2c 2e 2e 2e 6e 7d 3d 65 2c 61 3d 6e 2e 6c 6f 6f 6b 3d 3d 3d 72 2e 42 75 74 74 6f 6e 2e 4c 6f 6f 6b 73 2e 4c 49 4e 4b 3b 72 65 74 75 72 6e 28 30 2c 74 2e 6a 73 78 29 28 72 2e 42 75 74 74 6f 6e 2c 7b 73 69 7a 65 3a 61 3f 72 2e 42 75 74 74 6f 6e 2e 53 69 7a 65 73 2e 4d 49 4e 3a 72 2e 42 75 74 74 6f 6e 2e 53 69 7a 65 73 2e 4c 41 52 47 45 2c 66 75 6c 6c 57 69 64 74 68 3a 21 61 2c 63 6c 61 73 73 4e 61 6d 65 3a 6c 28 29 28 73 2c 7b 5b 45 2e 62 75 74 74 6f 6e 5d 3a 21 61 2c 5b 45 2e 6c 69 6e 6b 42 75 74 74 6f 6e 5d 3a 61 7d 29 2c 2e 2e 2e 6e 7d 29 7d 3b 6a 2e 4c 6f 6f 6b 73 3d 72 2e 42 75 74 74 6f 6e 2e 4c 6f 6f 6b 73 2c 6a 2e 43 6f 6c 6f 72 73 3d 72 2e 42 75 74 74 6f 6e 2e 43 6f 6c 6f 72 73 2c 6a 2e 53 69 7a 65 Data Ascii: >{let{className:s,...n}=e,a=n.look===r.Button.Looks.LINK;return(0,t.jsx)(r.Button,{size:a?r.Button.Sizes.MIN:r.Button.Sizes.LARGE,fullWidth:!a,className:l()(s,{[E.button]:!a,[E.linkButton]:a}),...n})};j.Looks=r.Button.Looks,j.Colors=r.Button.Colors,j.Size
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 65 3d 3e 7b 6c 65 74 7b 63 6c 61 73 73 4e 61 6d 65 3a 73 2c 63 68 69 6c 64 72 65 6e 3a 6e 7d 3d 65 3b 72 65 74 75 72 6e 28 30 2c 74 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 6c 28 29 28 45 2e 62 6c 6f 63 6b 2c 73 29 2c 63 68 69 6c 64 72 65 6e 3a 6e 7d 29 7d 2c 4d 3d 65 3d 3e 7b 6c 65 74 7b 63 6c 61 73 73 4e 61 6d 65 3a 73 2c 63 68 69 6c 64 72 65 6e 3a 6e 2c 69 73 50 72 6f 6d 69 6e 65 6e 74 3a 61 7d 3d 65 3b 72 65 74 75 72 6e 28 30 2c 74 2e 6a 73 78 29 28 72 2e 54 65 78 74 2c 7b 76 61 72 69 61 6e 74 3a 61 3f 22 74 65 78 74 2d 73 6d 2f 6e 6f 72 6d 61 6c 22 3a 22 74 65 78 74 2d 78 73 2f 6e 6f 72 6d 61 6c 22 2c 63 6c 61 73 73 4e 61 6d 65 3a 6c 28 29 28 45 2e 73 75 62 54 65 78 74 2c 73 29 2c 63 68 69 6c 64 72 65 6e 3a 6e 7d 29 7d 2c Data Ascii: e=>{let{className:s,children:n}=e;return(0,t.jsx)("div",{className:l()(E.block,s),children:n})},M=e=>{let{className:s,children:n,isProminent:a}=e;return(0,t.jsx)(r.Text,{variant:a?"text-sm/normal":"text-xs/normal",className:l()(E.subText,s),children:n})},
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 4f 55 4e 54 5f 53 45 52 56 45 52 5f 49 4e 56 49 54 45 5f 4a 4f 49 4e 49 4e 47 5f 41 53 7d 29 2c 28 30 2c 74 2e 6a 73 78 29 28 68 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 45 2e 6a 6f 69 6e 69 6e 67 41 73 41 76 61 74 61 72 2c 73 72 63 3a 73 2e 67 65 74 41 76 61 74 61 72 55 52 4c 28 76 6f 69 64 20 30 2c 32 34 29 2c 73 69 7a 65 3a 72 2e 41 76 61 74 61 72 53 69 7a 65 73 2e 53 49 5a 45 5f 32 34 2c 22 61 72 69 61 2d 6c 61 62 65 6c 22 3a 73 2e 75 73 65 72 6e 61 6d 65 7d 29 2c 28 30 2c 74 2e 6a 73 78 29 28 72 2e 54 65 78 74 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 45 2e 6a 6f 69 6e 69 6e 67 41 73 55 73 65 72 6e 61 6d 65 2c 74 61 67 3a 22 73 70 61 6e 22 2c 76 61 72 69 61 6e 74 3a 22 74 65 78 74 2d 6d 64 2f 73 65 6d 69 62 6f 6c 64 22 2c 63 6f 6c 6f 72 3a 22 68 65 61 64 65 72 Data Ascii: OUNT_SERVER_INVITE_JOINING_AS}),(0,t.jsx)(h,{className:E.joiningAsAvatar,src:s.getAvatarURL(void 0,24),size:r.AvatarSizes.SIZE_24,"aria-label":s.username}),(0,t.jsx)(r.Text,{className:E.joiningAsUsername,tag:"span",variant:"text-md/semibold",color:"header
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 6d 70 34 44 61 72 6b 3a 61 3d 64 2c 6d 70 34 4c 69 67 68 74 3a 6c 3d 45 2c 70 6e 67 44 61 72 6b 3a 72 3d 49 2c 70 6e 67 4c 69 67 68 74 3a 69 3d 78 2c 77 65 62 6d 44 61 72 6b 3a 6f 3d 4e 2c 77 65 62 6d 4c 69 67 68 74 3a 54 3d 70 7d 3d 65 2c 67 3d 28 30 2c 75 2e 76 75 29 28 29 2c 6a 3d 5b 28 30 2c 74 2e 6a 73 78 29 28 22 73 6f 75 72 63 65 22 2c 7b 73 72 63 3a 61 2c 74 79 70 65 3a 22 76 69 64 65 6f 2f 6d 70 34 22 7d 2c 22 6d 70 34 22 29 2c 28 30 2c 74 2e 6a 73 78 29 28 22 69 6d 67 22 2c 7b 61 6c 74 3a 22 22 2c 73 72 63 3a 72 7d 2c 22 70 6e 67 22 29 5d 2c 68 3d 5b 28 30 2c 74 2e 6a 73 78 29 28 22 73 6f 75 72 63 65 22 2c 7b 73 72 63 3a 6c 2c 74 79 70 65 3a 22 76 69 64 65 6f 2f 6d 70 34 22 7d 2c 22 6d 70 34 22 29 2c 28 30 2c 74 2e 6a 73 78 29 28 22 69 6d 67 22 Data Ascii: mp4Dark:a=d,mp4Light:l=E,pngDark:r=I,pngLight:i=x,webmDark:o=N,webmLight:T=p}=e,g=(0,u.vu)(),j=[(0,t.jsx)("source",{src:a,type:"video/mp4"},"mp4"),(0,t.jsx)("img",{alt:"",src:r},"png")],h=[(0,t.jsx)("source",{src:l,type:"video/mp4"},"mp4"),(0,t.jsx)("img"
2024-10-24 07:16:24 UTC	186	IN	Data Raw: 53 55 42 4d 49 54 5f 53 43 48 4f 4f 4c 3d 22 53 55 42 4d 49 54 5f 53 43 48 4f 4f 4c 22 2c 61 2e 45 4d 41 49 4c 5f 43 4f 4e 46 49 52 4d 41 54 49 4f 4e 3d 22 45 4d 41 49 4c 5f 43 4f 4e 46 49 52 4d 41 54 49 4f 4e 22 2c 61 2e 45 4d 41 49 4c 5f 57 41 49 54 4c 49 53 54 3d 22 45 4d 41 49 4c 5f 57 41 49 54 4c 49 53 54 22 3b 6c 65 74 20 6c 3d 22 38 38 34 39 32 34 38 37 33 30 31 35 36 38 39 32 32 36 22 7d 7d 5d 29 3b 0a 2f 2f 23 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 3d 66 64 63 37 31 63 32 33 64 30 39 65 31 38 65 39 34 63 65 32 2e 6a 73 2e 6d 61 70 Data Ascii: SUBMIT_SCHOOL="SUBMIT_SCHOOL",a.EMAIL_CONFIRMATION="EMAIL_CONFIRMATION",a.EMAIL_WAITLIST="EMAIL_WAITLIST";let l="884924873015689226"}}]);//# sourceMappingURL=fdc71c23d09e18e94ce2.js.map

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.9	49868	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:25 UTC	868	OUT	GET /assets/89b7ddebcacbe8dfbd3a.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:25 UTC	962	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:25 GMT Content-Type: text/javascript Content-Length: 18462 Connection: close CF-Ray: 8d782e6a3d9e6b10-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "dc15d17d50a8a78e8c593e27fa1eaf57" Last-Modified: Tue, 15 Oct 2024 21:50:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oeG8TKbaJhWj1%2BswEahv0EJobl1MgWi7b3b2InYzFEx%2F64b1F3uH5Q%2FjHQ6MsPS3g3PtIYpHnY6Lp7tEszFwSRewlQFUiukPqDE0JS6kRwWfTKvyFIKEvAv9oWgd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:25 UTC	407	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 32 30 30 31 31 22 5d 2c 7b 34 38 32 36 38 32 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 65 62 62 35 62 34 31 64 65 38 32 33 66 62 63 31 39 64 31 32 2e 70 6e 67 22 7d 2c 34 35 30 31 32 35 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 31 65 34 39 33 32 61 37 61 66 62 62 31 66 63 64 62 61 32 64 2e 70 6e 67 22 7d 2c 37 33 33 39 34 39 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 22 2f Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["20011"],{482682:function(t){t.exports="/assets/ebb5b41de823fbc19d12.png"},450125:function(t){t.exports="/assets/1e4932a7afbb1fcdba2d.png"},733949:function(t){t.exports="/
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 72 6e 20 69 20 69 6e 20 74 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 69 2c 7b 76 61 6c 75 65 3a 65 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 74 5b 69 5d 3d 65 2c 74 7d 6c 65 74 20 64 3d 74 3d 3e 6e 65 77 20 50 72 6f 6d 69 73 65 28 28 69 2c 65 29 3d 3e 7b 6e 75 6c 6c 3d 3d 74 26 26 65 28 45 72 72 6f 72 28 22 4e 6f 20 69 6d 61 67 65 20 73 72 63 20 70 61 73 73 65 64 22 29 29 3b 6c 65 74 20 73 3d 6e 65 77 20 49 6d 61 67 65 3b 73 2e 73 72 63 3d 74 2c 73 2e 6f 6e 6c 6f 61 64 3d 28 29 3d 3e 69 28 73 29 2c 73 2e 6f 6e 65 72 72 6f 72 3d 74 3d 3e 65 28 74 29 7d 29 3b 63 6c 61 73 73 20 75 20 65 78 74 65 6e 64 73 28 73 3d 68 2e 50 75 72 65 43 Data Ascii: rn i in t?Object.defineProperty(t,i,{value:e,enumerable:!0,configurable:!0,writable:!0}):t[i]=e,t}let d=t=>new Promise((i,e)=>{null==t&&e(Error("No image src passed"));let s=new Image;s.src=t,s.onload=()=>i(s),s.onerror=t=>e(t)});class u extends(s=h.PureC
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 70 73 2e 73 68 6f 77 3f 31 3a 30 29 7d 67 65 74 41 6e 69 6d 61 74 65 64 53 74 79 6c 65 28 29 7b 6c 65 74 7b 61 6e 69 6d 3a 74 7d 3d 74 68 69 73 2c 7b 72 65 64 75 63 65 64 4d 6f 74 69 6f 6e 3a 69 7d 3d 74 68 69 73 2e 63 6f 6e 74 65 78 74 3b 72 65 74 75 72 6e 7b 6f 70 61 63 69 74 79 3a 74 2c 74 72 61 6e 73 66 6f 72 6d 3a 69 2e 65 6e 61 62 6c 65 64 3f 76 6f 69 64 20 30 3a 5b 7b 74 72 61 6e 73 6c 61 74 65 59 3a 74 2e 69 6e 74 65 72 70 6f 6c 61 74 65 28 7b 69 6e 70 75 74 52 61 6e 67 65 3a 5b 30 2c 31 5d 2c 6f 75 74 70 75 74 52 61 6e 67 65 3a 5b 22 2d 31 30 30 70 78 22 2c 22 30 70 78 22 5d 7d 29 7d 2c 7b 74 72 61 6e 73 6c 61 74 65 5a 3a 30 7d 5d 7d 7d 72 65 6e 64 65 72 28 29 7b 72 65 74 75 72 6e 28 30 2c 6e 2e 6a 73 78 29 28 6c 2e 5a 2e 61 2c 7b 68 72 65 66 3a Data Ascii: ps.show?1:0)}getAnimatedStyle(){let{anim:t}=this,{reducedMotion:i}=this.context;return{opacity:t,transform:i.enabled?void 0:[{translateY:t.interpolate({inputRange:[0,1],outputRange:["-100px","0px"]})},{translateZ:0}]}}render(){return(0,n.jsx)(l.Z.a,{href:
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 72 45 61 63 68 28 74 3d 3e 74 2e 74 65 72 6d 69 6e 61 74 65 28 29 29 7d 62 69 6e 64 45 76 65 6e 74 73 28 29 7b 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 72 65 73 69 7a 65 22 2c 74 68 69 73 2e 72 65 73 69 7a 65 43 61 6e 76 61 73 2c 21 31 29 2c 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 62 6c 75 72 22 2c 74 68 69 73 2e 64 65 6c 61 79 65 64 50 61 75 73 65 2c 21 31 29 2c 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 66 6f 63 75 73 22 2c 74 68 69 73 2e 70 6c 61 79 2c 21 31 29 2c 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 76 69 73 69 62 69 6c 69 74 79 63 68 61 6e 67 65 22 2c 74 68 69 73 2e 68 61 6e 64 6c 65 56 69 73 69 62 69 6c 69 Data Ascii: rEach(t=>t.terminate())}bindEvents(){window.addEventListener("resize",this.resizeCanvas,!1),window.addEventListener("blur",this.delayedPause,!1),window.addEventListener("focus",this.play,!1),document.addEventListener("visibilitychange",this.handleVisibili
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 7d 29 7d 29 3a 28 30 2c 6e 2e 6a 73 78 29 28 22 63 61 6e 76 61 73 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 72 28 29 28 77 2e 63 61 6e 76 61 73 2c 7b 5b 77 2e 65 6d 62 65 64 64 65 64 5d 3a 65 7d 29 2c 72 65 66 3a 74 68 69 73 2e 73 65 74 43 61 6e 76 61 73 7d 29 7d 7d 29 7d 63 6f 6e 73 74 72 75 63 74 6f 72 28 74 29 7b 73 75 70 65 72 28 74 29 2c 62 28 74 68 69 73 2c 22 77 69 64 74 68 22 2c 30 29 2c 62 28 74 68 69 73 2c 22 68 65 69 67 68 74 22 2c 30 29 2c 62 28 74 68 69 73 2c 22 63 61 6e 76 61 73 22 2c 76 6f 69 64 20 30 29 2c 62 28 74 68 69 73 2c 22 63 61 6e 76 61 73 43 6f 6e 74 65 78 74 22 2c 76 6f 69 64 20 30 29 2c 62 28 74 68 69 73 2c 22 63 68 69 6c 64 72 65 6e 22 2c 5b 5d 29 2c 62 28 74 68 69 73 2c 22 77 61 76 65 22 2c 76 6f 69 64 20 30 29 2c 62 28 74 68 69 Data Ascii: })}):(0,n.jsx)("canvas",{className:r()(w.canvas,{[w.embedded]:e}),ref:this.setCanvas})}})}constructor(t){super(t),b(this,"width",0),b(this,"height",0),b(this,"canvas",void 0),b(this,"canvasContext",void 0),b(this,"children",[]),b(this,"wave",void 0),b(thi
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 65 6f 75 74 29 2c 74 68 69 73 2e 5f 69 73 50 6c 61 79 69 6e 67 3d 21 31 2c 6e 75 6c 6c 21 3d 74 68 69 73 2e 5f 72 65 71 41 6e 69 6d 49 64 26 26 77 69 6e 64 6f 77 2e 63 61 6e 63 65 6c 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 28 74 68 69 73 2e 5f 72 65 71 41 6e 69 6d 49 64 29 2c 74 68 69 73 2e 5f 72 65 71 41 6e 69 6d 49 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 61 64 76 61 6e 63 65 54 72 61 6e 73 69 74 69 6f 6e 61 6c 53 74 61 74 65 28 29 7d 29 2c 62 28 74 68 69 73 2c 22 64 65 6c 61 79 65 64 50 61 75 73 65 22 2c 28 29 3d 3e 7b 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 74 68 69 73 2e 5f 70 61 75 73 65 54 69 6d 65 6f 75 74 29 2c 74 68 69 73 2e 5f 70 61 75 73 65 54 69 6d 65 6f 75 74 3d 73 65 74 54 69 6d 65 6f 75 74 28 74 68 69 73 2e 70 61 75 73 65 2c 34 65 33 29 7d 29 Data Ascii: eout),this._isPlaying=!1,null!=this._reqAnimId&&window.cancelAnimationFrame(this._reqAnimId),this._reqAnimId=null,this.advanceTransitionalState()}),b(this,"delayedPause",()=>{clearTimeout(this._pauseTimeout),this._pauseTimeout=setTimeout(this.pause,4e3)})
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 68 3a 65 2c 69 6e 6e 65 72 48 65 69 67 68 74 3a 73 7d 3d 77 69 6e 64 6f 77 3b 69 66 28 30 3d 3d 3d 74 7c 7c 30 3d 3d 3d 69 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 6c 65 74 20 6e 3d 69 2f 74 2c 68 3d 65 2c 61 3d 4d 61 74 68 2e 72 6f 75 6e 64 28 65 2a 6e 29 3b 72 65 74 75 72 6e 20 61 3c 73 26 26 28 61 3d 73 2c 68 3d 4d 61 74 68 2e 72 6f 75 6e 64 28 73 2a 28 6e 3d 74 2f 69 29 29 29 2c 7b 6e 61 74 75 72 61 6c 57 69 64 74 68 3a 74 2c 6e 61 74 75 72 61 6c 48 65 69 67 68 74 3a 69 2c 77 69 64 74 68 3a 68 2c 68 65 69 67 68 74 3a 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 77 28 74 29 7b 6c 65 74 7b 73 70 6c 61 73 68 3a 69 2c 63 68 69 6c 64 72 65 6e 3a 65 7d 3d 74 2c 5b 7b 77 69 64 74 68 3a 73 2c 68 65 69 67 68 74 3a 61 7d 2c 6c 5d 3d 68 2e 75 73 65 53 74 61 74 65 28 7b 77 Data Ascii: h:e,innerHeight:s}=window;if(0===t\|\|0===i)return null;let n=i/t,h=e,a=Math.round(en);return a<s&&(a=s,h=Math.round(s(n=t/i))),{naturalWidth:t,naturalHeight:i,width:h,height:a}}function w(t){let{splash:i,children:e}=t,[{width:s,height:a},l]=h.useState({w
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 6c 6c 62 61 63 6b 3a 21 68 7d 29 3a 28 30 2c 6e 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 6d 2e 6d 6f 62 69 6c 65 57 61 76 65 7d 29 7d 72 65 6e 64 65 72 43 6f 6e 74 65 6e 74 28 29 7b 6c 65 74 7b 63 68 69 6c 64 72 65 6e 3a 74 2c 77 61 76 65 53 74 61 74 65 3a 69 2c 73 68 6f 77 4c 6f 67 6f 3a 65 2c 6c 6f 67 6f 43 6c 61 73 73 4e 61 6d 65 3a 73 2c 65 6d 62 65 64 64 65 64 3a 61 7d 3d 74 68 69 73 2e 70 72 6f 70 73 2c 7b 73 68 6f 77 57 61 76 65 41 6e 69 6d 61 74 69 6f 6e 3a 6c 7d 3d 74 68 69 73 2e 73 74 61 74 65 3b 72 65 74 75 72 6e 28 30 2c 6e 2e 6a 73 78 73 29 28 68 2e 46 72 61 67 6d 65 6e 74 2c 7b 63 68 69 6c 64 72 65 6e 3a 5b 74 68 69 73 2e 72 65 6e 64 65 72 57 61 76 65 28 29 2c 28 30 2c 6e 2e 6a 73 78 73 29 28 22 64 69 76 22 2c 7b Data Ascii: llback:!h}):(0,n.jsx)("div",{className:m.mobileWave})}renderContent(){let{children:t,waveState:i,showLogo:e,logoClassName:s,embedded:a}=this.props,{showWaveAnimation:l}=this.state;return(0,n.jsxs)(h.Fragment,{children:[this.renderWave(),(0,n.jsxs)("div",{
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 65 3a 65 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 74 5b 69 5d 3d 65 2c 74 7d 69 2e 5a 3d 63 6c 61 73 73 20 74 7b 69 6e 69 74 69 61 6c 69 7a 65 28 29 7b 74 68 69 73 2e 69 6d 67 3d 6e 65 77 20 49 6d 61 67 65 2c 74 68 69 73 2e 69 6d 67 2e 6f 6e 6c 6f 61 64 3d 28 29 3d 3e 7b 74 68 69 73 2e 6c 6f 61 64 65 64 3d 21 30 7d 2c 74 68 69 73 2e 69 6d 67 2e 73 72 63 3d 6e 2c 74 68 69 73 2e 62 69 6e 64 28 29 7d 62 69 6e 64 28 29 7b 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6d 6f 75 73 65 6d 6f 76 65 22 2c 74 68 69 73 2e 68 61 6e 64 6c 65 4d 6f 75 73 65 4d 6f 76 65 2c 21 31 29 7d 75 6e 62 69 6e 64 28 29 7b 77 69 6e 64 6f 77 2e 72 65 6d 6f 76 65 Data Ascii: e:e,enumerable:!0,configurable:!0,writable:!0}):t[i]=e,t}i.Z=class t{initialize(){this.img=new Image,this.img.onload=()=>{this.loaded=!0},this.img.src=n,this.bind()}bind(){window.addEventListener("mousemove",this.handleMouseMove,!1)}unbind(){window.remove
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 28 38 39 38 36 32 35 29 3b 66 75 6e 63 74 69 6f 6e 20 68 28 74 2c 69 2c 65 29 7b 72 65 74 75 72 6e 20 69 20 69 6e 20 74 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 69 2c 7b 76 61 6c 75 65 3a 65 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 74 5b 69 5d 3d 65 2c 74 7d 6c 65 74 20 61 3d 5b 22 23 37 64 38 31 38 37 22 2c 22 23 31 38 31 39 31 63 22 2c 22 23 38 66 61 32 64 66 22 2c 22 23 34 66 35 34 35 63 22 5d 3b 69 2e 5a 3d 63 6c 61 73 73 20 74 7b 63 68 65 63 6b 42 6f 75 6e 64 73 28 29 7b 74 68 69 73 2e 78 3e 74 68 69 73 2e 6f 66 66 73 63 72 65 65 6e 58 3f 74 68 69 73 2e 78 3d 2d 74 68 69 73 2e 73 69 7a 65 3a 74 68 69 73 2e 79 3e 74 68 69 73 Data Ascii: (898625);function h(t,i,e){return i in t?Object.defineProperty(t,i,{value:e,enumerable:!0,configurable:!0,writable:!0}):t[i]=e,t}let a=["#7d8187","#18191c","#8fa2df","#4f545c"];i.Z=class t{checkBounds(){this.x>this.offscreenX?this.x=-this.size:this.y>this

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.9	49869	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:25 UTC	868	OUT	GET /assets/ea8b2ed5e609f40e7f7b.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:25 UTC	962	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:25 GMT Content-Type: text/javascript Content-Length: 17794 Connection: close CF-Ray: 8d782e6a3a300c07-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "8f5beb794777eac4c63978cd0ef850f4" Last-Modified: Tue, 15 Oct 2024 21:50:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q64Ii4MjJeZkZIaytGIEFELojPX3f7%2BJ4rRNXZWhDXwsVuDj6hC0opEOYkzHtLsbZ9satHLw8Li7cbegqOqBrTSnkM7Q21NCncAnE%2BLfNxl5twyazcE%2FoPoO32Ud"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 31 31 32 36 30 22 5d 2c 7b 32 36 32 33 30 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 61 66 64 34 34 61 65 30 35 31 32 36 62 35 66 61 62 34 30 64 2e 73 76 67 22 7d 2c 39 33 35 32 32 37 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 35 30 62 39 36 36 30 31 31 37 31 66 64 33 36 31 31 30 31 63 2e 73 76 67 22 7d 2c 34 37 39 34 39 35 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 73 29 7b 73 28 37 35 37 31 34 33 29 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["11260"],{26230:function(e){e.exports="/assets/afd44ae05126b5fab40d.svg"},935227:function(e){e.exports="/assets/50b96601171fd361101c.svg"},479495:function(e,t,s){s(757143)
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 2e 6a 73 78 29 28 6d 2e 7a 78 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 53 2e 6d 61 72 67 69 6e 54 6f 70 38 2c 6f 6e 43 6c 69 63 6b 3a 74 68 69 73 2e 68 61 6e 64 6c 65 47 6f 54 6f 4c 6f 67 69 6e 2c 73 75 62 6d 69 74 74 69 6e 67 3a 69 2c 63 6f 6c 6f 72 3a 6d 2e 7a 78 2e 43 6f 6c 6f 72 73 2e 50 52 49 4d 41 52 59 2c 63 68 69 6c 64 72 65 6e 3a 45 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 43 41 4e 43 45 4c 7d 29 3a 6e 75 6c 6c 5d 7d 29 5d 7d 29 7d 72 65 6e 64 65 72 4d 46 41 28 29 7b 6c 65 74 20 65 3d 7b 74 69 63 6b 65 74 3a 74 68 69 73 2e 70 72 6f 70 73 2e 6d 66 61 54 69 63 6b 65 74 2c 6d 65 74 68 6f 64 73 3a 74 68 69 73 2e 70 72 6f 70 73 2e 6d 66 61 4d 65 74 68 6f 64 73 7d 3b 72 65 74 75 72 6e 28 30 2c 72 2e 6a 73 78 29 28 6d 2e 5a 50 2c 7b 73 74 79 6c 65 3a 7b 70 61 64 Data Ascii: .jsx)(m.zx,{className:S.marginTop8,onClick:this.handleGoToLogin,submitting:i,color:m.zx.Colors.PRIMARY,children:E.Z.Messages.CANCEL}):null]})]})}renderMFA(){let e={ticket:this.props.mfaTicket,methods:this.props.mfaMethods};return(0,r.jsx)(m.ZP,{style:{pad
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 73 6d 73 3a 74 2c 77 65 62 61 75 74 68 6e 3a 72 2c 74 69 63 6b 65 74 3a 61 2c 74 6f 6b 65 6e 3a 6c 2c 74 6f 74 70 3a 63 2c 62 61 63 6b 75 70 3a 75 7d 3d 61 77 61 69 74 20 68 2e 5a 2e 72 65 73 65 74 50 61 73 73 77 6f 72 64 28 6f 2c 69 2c 6e 29 3b 65 3d 3d 3d 68 2e 63 2e 4d 46 41 3f 64 2e 5a 2e 64 69 73 70 61 74 63 68 28 7b 74 79 70 65 3a 22 4c 4f 47 49 4e 5f 4d 46 41 5f 53 54 45 50 22 2c 74 69 63 6b 65 74 3a 61 2c 73 6d 73 3a 74 2c 77 65 62 61 75 74 68 6e 3a 72 2c 74 6f 74 70 3a 63 2c 62 61 63 6b 75 70 3a 75 7d 29 3a 6e 75 6c 6c 21 3d 73 3f 73 28 6c 29 3a 28 64 2e 5a 2e 64 69 73 70 61 74 63 68 28 7b 74 79 70 65 3a 22 4c 4f 47 49 4e 5f 53 55 43 43 45 53 53 22 2c 74 6f 6b 65 6e 3a 6c 7d 29 2c 74 68 69 73 2e 68 61 6e 64 6c 65 50 61 73 73 77 6f 72 64 43 68 61 Data Ascii: sms:t,webauthn:r,ticket:a,token:l,totp:c,backup:u}=await h.Z.resetPassword(o,i,n);e===h.c.MFA?d.Z.dispatch({type:"LOGIN_MFA_STEP",ticket:a,sms:t,webauthn:r,totp:c,backup:u}):null!=s?s(l):(d.Z.dispatch({type:"LOGIN_SUCCESS",token:l}),this.handlePasswordCha
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 73 3d 74 5b 65 5d 3b 72 65 74 75 72 6e 20 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 73 29 3f 73 5b 30 5d 3a 73 7d 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 29 3b 6c 65 74 20 73 3d 28 6e 75 6c 6c 3d 3d 3d 28 74 3d 74 68 69 73 2e 70 72 6f 70 73 2e 6c 6f 63 61 74 69 6f 6e 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 73 65 61 72 63 68 29 21 3d 6e 75 6c 6c 26 26 22 22 21 3d 3d 74 68 69 73 2e 70 72 6f 70 73 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 3f 28 30 2c 6c 2e 70 61 72 73 65 29 28 74 68 69 73 2e 70 72 6f 70 73 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 29 3a 6e 75 6c 6c 3b 74 68 69 73 2e 73 74 61 74 65 3d 7b 6d 65 74 68 6f 64 3a 22 22 2c 70 61 73 73 77 6f 72 64 3a 22 22 2c 63 6f 64 65 3a 22 22 2c 65 72 72 6f 72 3a 6e 75 6c 6c Data Ascii: s=t[e];return Array.isArray(s)?s[0]:s}return null});let s=(null===(t=this.props.location)\|\|void 0===t?void 0:t.search)!=null&&""!==this.props.location.search?(0,l.parse)(this.props.location.search):null;this.state={method:"",password:"",code:"",error:null
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 69 76 22 2c 7b 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 6e 2e 6a 73 78 29 28 61 2e 5a 2c 7b 69 6e 70 75 74 43 6c 61 73 73 4e 61 6d 65 3a 63 2e 63 6f 64 65 49 6e 70 75 74 2c 6f 6e 53 75 62 6d 69 74 3a 68 7d 29 2c 6e 75 6c 6c 21 3d 64 3f 28 30 2c 6e 2e 6a 73 78 29 28 72 2e 54 65 78 74 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 63 2e 65 72 72 6f 72 2c 76 61 72 69 61 6e 74 3a 22 74 65 78 74 2d 73 6d 2f 6e 6f 72 6d 61 6c 22 2c 63 68 69 6c 64 72 65 6e 3a 64 7d 29 3a 6e 75 6c 6c 5d 7d 29 2c 6e 75 6c 6c 21 3d 70 26 26 28 30 2c 6e 2e 6a 73 78 29 28 72 2e 42 75 74 74 6f 6e 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 63 2e 62 75 74 74 6f 6e 2c 6f 6e 43 6c 69 63 6b 3a 70 2c 63 6f 6c 6f 72 3a 72 2e 42 75 74 74 6f 6e 2e 43 6f 6c 6f 72 73 2e 50 52 49 4d 41 52 59 2c 63 68 69 6c 64 72 65 Data Ascii: iv",{children:[(0,n.jsx)(a.Z,{inputClassName:c.codeInput,onSubmit:h}),null!=d?(0,n.jsx)(r.Text,{className:c.error,variant:"text-sm/normal",children:d}):null]}),null!=p&&(0,n.jsx)(r.Button,{className:c.button,onClick:p,color:r.Button.Colors.PRIMARY,childre
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 50 72 6f 70 73 22 2c 7b 61 75 74 6f 46 6f 63 75 73 3a 21 31 7d 29 3b 63 6c 61 73 73 20 70 20 65 78 74 65 6e 64 73 28 72 3d 61 2e 50 75 72 65 43 6f 6d 70 6f 6e 65 6e 74 29 7b 72 65 6e 64 65 72 28 29 7b 6c 65 74 7b 63 6c 61 73 73 4e 61 6d 65 3a 65 2c 69 6e 70 75 74 43 6c 61 73 73 4e 61 6d 65 3a 74 7d 3d 74 68 69 73 2e 70 72 6f 70 73 2c 7b 63 6f 64 65 73 3a 73 7d 3d 74 68 69 73 2e 73 74 61 74 65 2c 6e 3d 5b 5d 3b 66 6f 72 28 6c 65 74 20 65 3d 30 3b 65 3c 73 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 65 3d 3d 3d 73 2e 6c 65 6e 67 74 68 2f 32 26 26 6e 2e 70 75 73 68 28 28 30 2c 69 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 75 2e 73 70 61 63 65 72 7d 2c 22 73 70 61 63 65 72 22 29 29 2c 6e 2e 70 75 73 68 28 28 30 2c 69 2e 6a 73 78 29 28 68 2c Data Ascii: Props",{autoFocus:!1});class p extends(r=a.PureComponent){render(){let{className:e,inputClassName:t}=this.props,{codes:s}=this.state,n=[];for(let e=0;e<s.length;e++)e===s.length/2&&n.push((0,i.jsx)("div",{className:u.spacer},"spacer")),n.push((0,i.jsx)(h,
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 36 30 29 2c 64 3d 73 28 38 39 33 37 37 36 29 2c 68 3d 73 28 32 33 39 30 39 31 29 2c 70 3d 73 28 35 39 38 30 37 37 29 2c 6d 3d 73 28 33 31 34 38 39 37 29 2c 66 3d 73 28 32 34 36 39 34 36 29 2c 43 3d 73 28 35 39 34 31 37 34 29 2c 67 3d 73 28 36 32 36 31 33 35 29 2c 78 3d 73 28 35 31 31 34 34 29 2c 4e 3d 73 28 34 38 30 33 38 37 29 2c 76 3d 73 28 37 32 36 37 34 35 29 2c 45 3d 73 28 32 35 31 34 32 33 29 2c 53 3d 73 28 39 38 31 36 33 31 29 2c 41 3d 73 28 36 38 39 39 33 38 29 2c 6a 3d 73 28 35 31 36 36 30 33 29 3b 66 75 6e 63 74 69 6f 6e 20 79 28 65 29 7b 6c 65 74 7b 61 63 74 69 6f 6e 54 65 78 74 3a 74 2c 75 73 65 72 3a 73 2c 6f 6e 41 63 74 69 6f 6e 3a 6e 7d 3d 65 2c 7b 63 75 72 72 65 6e 74 55 73 65 72 3a 72 2c 68 69 64 65 50 72 69 76 61 74 65 44 61 74 61 3a 61 Data Ascii: 60),d=s(893776),h=s(239091),p=s(598077),m=s(314897),f=s(246946),C=s(594174),g=s(626135),x=s(51144),N=s(480387),v=s(726745),E=s(251423),S=s(981631),A=s(689938),j=s(516603);function y(e){let{actionText:t,user:s,onAction:n}=e,{currentUser:r,hidePrivateData:a
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 61 62 6c 65 3a 61 3f 22 6e 65 76 65 72 22 3a 22 61 6c 77 61 79 73 22 7d 29 7d 29 2c 28 30 2c 69 2e 6a 73 78 29 28 75 2e 54 65 78 74 2c 7b 63 6f 6c 6f 72 3a 22 68 65 61 64 65 72 2d 73 65 63 6f 6e 64 61 72 79 22 2c 76 61 72 69 61 6e 74 3a 22 74 65 78 74 2d 73 6d 2f 6e 6f 72 6d 61 6c 22 2c 63 68 69 6c 64 72 65 6e 3a 49 7d 29 5d 7d 29 2c 5f 5d 7d 29 2c 28 30 2c 69 2e 6a 73 78 73 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 6a 2e 75 73 65 72 41 63 74 69 6f 6e 73 2c 63 68 69 6c 64 72 65 6e 3a 5b 21 79 26 26 28 30 2c 69 2e 6a 73 78 29 28 75 2e 42 75 74 74 6f 6e 2c 7b 6f 6e 43 6c 69 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 54 29 7b 6e 28 30 2c 73 2e 69 64 29 3b 72 65 74 75 72 6e 7d 67 2e 64 65 66 61 75 6c 74 2e 74 72 61 63 6b 28 53 2e 72 4d Data Ascii: able:a?"never":"always"})}),(0,i.jsx)(u.Text,{color:"header-secondary",variant:"text-sm/normal",children:I})]}),_]}),(0,i.jsxs)("div",{className:j.userActions,children:[!y&&(0,i.jsx)(u.Button,{onClick:function(){if(T){n(0,s.id);return}g.default.track(S.rM
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 2c 69 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 6a 2e 6c 69 73 74 2c 63 68 69 6c 64 72 65 6e 3a 6e 3f 28 30 2c 69 2e 6a 73 78 29 28 75 2e 53 70 69 6e 6e 65 72 2c 7b 7d 29 3a 72 2e 6d 61 70 28 28 65 2c 6e 29 3d 3e 28 30 2c 69 2e 6a 73 78 73 29 28 61 2e 46 72 61 67 6d 65 6e 74 2c 7b 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 69 2e 6a 73 78 29 28 79 2c 7b 75 73 65 72 3a 65 2c 61 63 74 69 6f 6e 54 65 78 74 3a 74 2c 6f 6e 41 63 74 69 6f 6e 3a 73 7d 2c 65 2e 69 64 29 2c 72 2e 6c 65 6e 67 74 68 2d 31 21 3d 3d 6e 26 26 28 30 2c 69 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 72 6f 6c 65 3a 22 73 65 70 61 72 61 74 6f 72 22 2c 63 6c 61 73 73 4e 61 6d 65 3a 6a 2e 73 65 70 61 72 61 74 6f 72 7d 29 5d 7d 2c 65 2e 69 64 29 29 7d 29 7d 28 72 3d 6e 7c 7c Data Ascii: ,i.jsx)("div",{className:j.list,children:n?(0,i.jsx)(u.Spinner,{}):r.map((e,n)=>(0,i.jsxs)(a.Fragment,{children:[(0,i.jsx)(y,{user:e,actionText:t,onAction:s},e.id),r.length-1!==n&&(0,i.jsx)("div",{role:"separator",className:j.separator})]},e.id))})}(r=n\|\|
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 75 74 28 29 7d 7d 29 2c 63 68 69 6c 64 72 65 6e 3a 65 3d 3e 28 30 2c 6e 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 61 28 29 28 64 2e 6f 75 74 65 72 43 6f 6e 74 61 69 6e 65 72 2c 7b 5b 64 2e 68 69 64 64 65 6e 5d 3a 21 28 74 7c 7c 66 29 7d 29 2c 63 68 69 6c 64 72 65 6e 3a 28 30 2c 6e 2e 6a 73 78 29 28 6f 2e 61 6e 69 6d 61 74 65 64 2e 64 69 76 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 64 2e 63 6f 6e 74 61 69 6e 65 72 2c 73 74 79 6c 65 3a 67 2c 63 68 69 6c 64 72 65 6e 3a 28 30 2c 6e 2e 6a 73 78 73 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 64 2e 69 6e 6e 65 72 43 6f 6e 74 61 69 6e 65 72 2c 72 65 66 3a 68 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 6e 2e 6a 73 78 73 29 28 6c 2e 43 6c 69 63 6b 61 62 6c 65 2c 7b 2e 2e 2e 65 2c 63 Data Ascii: ut()}}),children:e=>(0,n.jsx)("div",{className:a()(d.outerContainer,{[d.hidden]:!(t\|\|f)}),children:(0,n.jsx)(o.animated.div,{className:d.container,style:g,children:(0,n.jsxs)("div",{className:d.innerContainer,ref:h,children:[(0,n.jsxs)(l.Clickable,{...e,c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.9	49874	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:25 UTC	868	OUT	GET /assets/af6b8f380faee0e9f47d.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:25 UTC	965	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:25 GMT Content-Type: text/javascript Content-Length: 9359 Connection: close CF-Ray: 8d782e6a88e04680-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "52287a03a33104e4e3508b67501db130" Last-Modified: Tue, 15 Oct 2024 21:50:03 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5rEDTDO8bI%2BLVD2nYND6ECyLkdlxpi1kaUvbaW%2FzDmpXoA0JPTH7qFxFedc%2BSkiHUMnLZroah79ODFYAR9OiqcwWQL2%2BkYmjpcG6uy83fWAmvI%2BHjArxm6qliFGG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:25 UTC	404	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 34 37 37 35 22 5d 2c 7b 32 39 32 38 32 34 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 30 30 66 65 38 61 36 35 35 37 65 32 30 34 65 62 39 35 30 33 2e 73 76 67 22 7d 2c 32 33 31 32 33 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 6e 28 39 39 30 35 34 37 29 2c 69 3d 6e 28 32 38 33 36 39 33 29 2c 6c 3d 6e 28 35 37 30 31 34 30 29 2c 75 3d 6e 28 35 37 33 32 36 31 29 2c 6f 3d 6e 28 39 38 31 36 33 31 29 3b 65 2e 5a 3d 7b 73 69 67 6e 75 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["4775"],{292824:function(t){t.exports="/assets/00fe8a6557e204eb9503.svg"},231239:function(t,e,n){var r=n(990547),i=n(283693),l=n(570140),u=n(573261),o=n(981631);e.Z={signu
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 3a 74 3d 3e 7b 76 61 72 20 65 3b 6c 65 74 20 6e 3d 21 31 2c 72 3d 6e 75 6c 6c 3d 3d 74 3f 76 6f 69 64 20 30 3a 6e 75 6c 6c 3d 3d 3d 28 65 3d 74 2e 62 6f 64 79 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 65 6d 61 69 6c 5f 64 6f 6d 61 69 6e 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 72 26 26 28 6e 3d 2d 31 21 3d 3d 72 2e 73 70 6c 69 74 28 22 2e 22 29 2e 69 6e 64 65 78 4f 66 28 22 65 64 75 22 29 29 2c 28 30 2c 69 2e 69 47 29 28 7b 69 73 5f 65 64 75 5f 65 6d 61 69 6c 3a 6e 7d 29 7d 7d 7d 29 2c 73 65 6e 64 56 65 72 69 66 69 63 61 74 69 6f 6e 45 6d 61 69 6c 3a 61 73 79 6e 63 28 74 2c 65 2c 6e 29 3d 3e 28 61 77 61 69 74 20 75 2e 5a 2e 70 6f 73 74 28 7b 75 72 6c 3a 6f 2e 41 4e 4d 2e 48 55 42 5f 45 4d 41 49 4c 5f 56 45 52 49 46 59 5f 53 45 Data Ascii: :t=>{var e;let n=!1,r=null==t?void 0:null===(e=t.body)\|\|void 0===e?void 0:e.email_domain;return null!=r&&(n=-1!==r.split(".").indexOf("edu")),(0,i.iG)({is_edu_email:n})}}}),sendVerificationEmail:async(t,e,n)=>(await u.Z.post({url:o.ANM.HUB_EMAIL_VERIFY_SE
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 31 29 3b 69 66 28 6e 28 31 39 32 33 37 39 29 2c 31 32 36 33 33 3d 3d 6e 2e 6a 29 76 61 72 20 69 3d 6e 28 35 31 32 39 36 39 29 3b 76 61 72 20 6c 3d 6e 28 38 36 30 39 31 31 29 2c 75 3d 6e 28 39 38 31 36 33 31 29 2c 6f 3d 6e 28 31 38 38 37 38 35 29 3b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 6c 65 74 20 74 3d 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 2b 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 3b 72 65 74 75 72 6e 20 6f 2e 61 3f 75 2e 5a 35 63 2e 52 45 47 49 53 54 45 52 3a 28 30 2c 6c 2e 55 69 29 28 74 2c 21 31 29 7d 65 2e 5a 3d 31 32 36 33 33 3d 3d 6e 2e 6a 3f 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 30 2c 72 2e 6a 73 78 29 28 69 2e 6c 5f 2c 7b 74 6f 3a 61 28 29 7d 29 7d 3a 6e 75 6c 6c 7d 2c 39 36 32 32 32 30 3a 66 75 6e 63 74 69 6f Data Ascii: 1);if(n(192379),12633==n.j)var i=n(512969);var l=n(860911),u=n(981631),o=n(188785);function a(){let t=location.pathname+location.search;return o.a?u.Z5c.REGISTER:(0,l.Ui)(t,!1)}e.Z=12633==n.j?function(){return(0,r.jsx)(i.l_,{to:a()})}:null},962220:functio
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 72 69 7a 61 74 69 6f 6e 3a 6f 7d 2c 72 65 74 72 69 65 73 3a 33 7d 29 7d 63 61 74 63 68 28 65 29 7b 6c 65 74 20 74 3d 28 6e 75 6c 6c 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 73 74 61 74 75 73 29 3d 3d 3d 34 30 31 7c 7c 28 6e 75 6c 6c 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 73 74 61 74 75 73 29 3d 3d 3d 34 30 33 3b 6c 2e 5a 2e 64 69 73 70 61 74 63 68 28 7b 74 79 70 65 3a 74 3f 22 4d 55 4c 54 49 5f 41 43 43 4f 55 4e 54 5f 56 41 4c 49 44 41 54 45 5f 54 4f 4b 45 4e 5f 46 41 49 4c 55 52 45 22 3a 22 4d 55 4c 54 49 5f 41 43 43 4f 55 4e 54 5f 56 41 4c 49 44 41 54 45 5f 54 4f 4b 45 4e 5f 53 55 43 43 45 53 53 22 2c 75 73 65 72 49 64 3a 75 7d 29 3b 72 65 74 75 72 6e 7d 6c 2e 5a 2e 64 69 73 70 61 74 63 68 28 7b 74 79 70 65 3a 74 3d 3d 3d 75 3f 22 43 55 52 52 45 4e 54 5f Data Ascii: rization:o},retries:3})}catch(e){let t=(null==e?void 0:e.status)===401\|\|(null==e?void 0:e.status)===403;l.Z.dispatch({type:t?"MULTI_ACCOUNT_VALIDATE_TOKEN_FAILURE":"MULTI_ACCOUNT_VALIDATE_TOKEN_SUCCESS",userId:u});return}l.Z.dispatch({type:t===u?"CURRENT_
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 41 52 4b 45 54 49 4e 47 5f 55 4e 43 4c 41 49 4d 45 44 22 2c 69 5b 69 2e 49 4e 56 49 54 45 5f 55 4e 43 4c 41 49 4d 45 44 3d 31 5d 3d 22 49 4e 56 49 54 45 5f 55 4e 43 4c 41 49 4d 45 44 22 2c 69 5b 69 2e 4f 52 47 41 4e 49 43 5f 52 45 47 49 53 54 45 52 45 44 3d 32 5d 3d 22 4f 52 47 41 4e 49 43 5f 52 45 47 49 53 54 45 52 45 44 22 2c 69 5b 69 2e 4f 52 47 41 4e 49 43 5f 52 45 47 49 53 54 45 52 45 44 5f 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 3d 33 5d 3d 22 4f 52 47 41 4e 49 43 5f 52 45 47 49 53 54 45 52 45 44 5f 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 22 7d 2c 31 37 39 36 34 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 2c 69 3d 6e 28 34 34 32 38 33 37 29 2c 6c 3d 6e 28 35 37 30 31 34 30 29 3b 66 75 6e 63 74 69 6f 6e 20 75 28 74 2c 65 Data Ascii: ARKETING_UNCLAIMED",i[i.INVITE_UNCLAIMED=1]="INVITE_UNCLAIMED",i[i.ORGANIC_REGISTERED=2]="ORGANIC_REGISTERED",i[i.ORGANIC_REGISTERED_GUILD_TEMPLATE=3]="ORGANIC_REGISTERED_GUILD_TEMPLATE"},179645:function(t,e,n){var r,i=n(442837),l=n(570140);function u(t,e
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 30 37 32 34 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6c 2c 75 2c 6f 2c 61 2c 63 2c 73 2c 5f 2c 64 3b 6e 2e 64 28 65 2c 7b 45 57 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 2c 46 46 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 2c 4d 4b 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 2c 58 32 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 7d 2c 6d 78 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 7d 7d 29 2c 28 61 3d 72 7c 7c 28 72 3d 7b 7d 29 29 2e 55 4e 4b 4e 4f 57 4e 3d 22 75 6e 6b 6e 6f 77 6e 22 2c 61 2e 41 4e 59 3d 22 61 6e 79 22 2c 61 2e 49 4e 56 49 54 45 3d 22 69 6e 76 69 74 65 22 2c 61 2e 4f 52 47 41 4e 49 43 3d 22 6f 72 67 61 6e 69 63 5f Data Ascii: 0724:function(t,e,n){var r,i,l,u,o,a,c,s,_,d;n.d(e,{EW:function(){return o},FF:function(){return i},MK:function(){return r},X2:function(){return u},mx:function(){return l}}),(a=r\|\|(r={})).UNKNOWN="unknown",a.ANY="any",a.INVITE="invite",a.ORGANIC="organic_
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 73 29 3b 69 66 28 6e 75 6c 6c 3d 3d 6e 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 6c 65 74 7b 5b 6e 5d 3a 72 7d 3d 65 28 29 2e 66 6c 6f 77 73 2c 69 3d 6e 75 6c 6c 21 3d 72 3f 72 3a 64 28 6e 29 3b 72 65 74 75 72 6e 28 6e 75 6c 6c 3d 3d 69 3f 76 6f 69 64 20 30 3a 69 2e 63 75 72 72 65 6e 74 53 74 65 70 29 21 3d 6e 75 6c 6c 3f 6e 3a 6e 75 6c 6c 7d 7d 29 29 3b 66 75 6e 63 74 69 6f 6e 20 66 28 74 2c 65 29 7b 6c 65 74 7b 5b 74 5d 3a 6e 2c 2e 2e 2e 72 7d 3d 45 2e 67 65 74 53 74 61 74 65 28 29 2e 66 6c 6f 77 73 2c 6c 3d 6e 75 6c 6c 21 3d 6e 3f 6e 3a 64 28 74 29 3b 69 66 28 28 6e 75 6c 6c 3d 3d 6c 3f 76 6f 69 64 20 30 3a 6c 2e 63 75 72 72 65 6e 74 53 74 65 70 29 3d 3d 6e 75 6c 6c 7c 7c 6c 2e 63 75 72 72 65 6e 74 53 74 65 70 21 3d 3d 65 29 28 30 2c 69 2e 6a 29 28 28 29 Data Ascii: s);if(null==n)return null;let{[n]:r}=e().flows,i=null!=r?r:d(n);return(null==i?void 0:i.currentStep)!=null?n:null}}));function f(t,e){let{[t]:n,...r}=E.getState().flows,l=null!=n?n:d(t);if((null==l?void 0:l.currentStep)==null\|\|l.currentStep!==e)(0,i.j)(()
2024-10-24 07:16:25 UTC	741	IN	Data Raw: 7b 2e 2e 2e 45 2e 67 65 74 53 74 61 74 65 28 29 2e 66 6c 6f 77 73 7d 3b 64 65 6c 65 74 65 20 65 5b 74 2e 74 79 70 65 5d 2c 28 30 2c 69 2e 6a 29 28 28 29 3d 3e 7b 45 2e 73 65 74 53 74 61 74 65 28 7b 66 6c 6f 77 73 3a 65 2c 63 75 72 72 65 6e 74 46 6c 6f 77 3a 6e 75 6c 6c 7d 29 7d 29 7d 7d 7d 2c 74 3d 3e 6e 75 6c 6c 21 3d 74 2e 63 75 72 72 65 6e 74 46 6c 6f 77 3f 74 2e 66 6c 6f 77 73 5b 74 2e 63 75 72 72 65 6e 74 46 6c 6f 77 5d 3a 76 6f 69 64 20 30 29 3b 66 75 6e 63 74 69 6f 6e 20 41 28 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 45 2e 67 65 74 53 74 61 74 65 28 29 2e 61 63 74 69 76 65 46 6c 6f 77 28 29 7d 65 2e 5a 3d 7b 66 6c 6f 77 53 74 61 72 74 3a 66 2c 66 6c 6f 77 53 74 65 70 4f 72 53 74 61 72 74 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 41 28 29 3f Data Ascii: {...E.getState().flows};delete e[t.type],(0,i.j)(()=>{E.setState({flows:e,currentFlow:null})})}}},t=>null!=t.currentFlow?t.flows[t.currentFlow]:void 0);function A(){return null!=E.getState().activeFlow()}e.Z={flowStart:f,flowStepOrStart:function(t,e){A()?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.9	49870	162.159.128.233	443	7592	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:25 UTC	868	OUT	GET /assets/6674c18c2e4160ceca2d.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=db77273091d711ef95c465a906b1cad8; __sdcfduid=db77273191d711ef95c465a906b1cad803e23f031a4a239dd4d3260177727bb77997ab42eeec6501cd365d990f881f42; __cfruid=bf0599a7f73c2d245dc614a8df3a570e6f142a36-1729754175; _cfuvid=9Q_Gbqd3Ag_ao9I98KyL.2jlgUR.NjLBpdgSXgmwoUM-1729754175783-0.0.1.1-604800000
2024-10-24 07:16:25 UTC	959	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:25 GMT Content-Type: text/javascript Content-Length: 9368 Connection: close CF-Ray: 8d782e6a8af4ddac-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "484b9f4bda963a4ade71a4eb95d2538f" Last-Modified: Tue, 15 Oct 2024 21:50:02 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w3pMh9hjrrpMky9W4zIwkEy0khDXrGBTom0NHKi3eWUzbT0A9wpjfwQnU7B0JrknNjWX54g3A%2BC5Vfm%2BUspToE7OIEDHnQUPuhTmtmgIb9vknw3CpFz9lfERmASw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:25 UTC	410	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 38 34 39 35 36 22 5d 2c 7b 39 38 36 31 39 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 69 3d 6e 28 39 39 30 35 34 37 29 2c 6f 3d 6e 28 35 34 34 38 39 31 29 2c 61 3d 6e 28 35 37 30 31 34 30 29 2c 73 3d 6e 28 38 38 31 30 35 32 29 2c 72 3d 6e 28 36 32 36 31 33 35 29 2c 75 3d 6e 28 35 37 33 32 36 31 29 2c 6c 3d 6e 28 35 34 35 38 35 31 29 2c 67 3d 6e 28 31 30 39 34 38 38 29 2c 64 3d 6e 28 37 39 34 30 39 39 29 2c 63 3d 6e 28 39 38 31 36 33 31 29 2c 6d 3d 6e 28 36 38 39 39 33 38 29 3b 6e 28 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["84956"],{986197:function(e,t,n){var i=n(990547),o=n(544891),a=n(570140),s=n(881052),r=n(626135),u=n(573261),l=n(545851),g=n(109488),d=n(794099),c=n(981631),m=n(689938);n(
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3a 31 35 30 30 3b 69 66 28 21 21 28 30 2c 64 2e 76 63 29 28 29 29 7b 61 2e 5a 2e 64 69 73 70 61 74 63 68 28 7b 74 79 70 65 3a 22 50 4f 4d 45 4c 4f 5f 53 55 47 47 45 53 54 49 4f 4e 53 5f 52 45 53 45 54 22 7d 29 3b 74 72 79 7b 76 61 72 20 6e 3b 6c 65 74 20 69 3d 61 77 61 69 74 20 6f 2e 74 6e 2e 67 65 74 28 7b 75 72 6c 3a 63 2e 41 4e 4d 2e 50 4f 4d 45 4c 4f 5f 53 55 47 47 45 53 54 49 4f 4e 53 5f 55 4e 41 55 54 48 45 44 2c 71 75 65 72 79 3a 6e 75 6c 6c 3d 3d 65 3f 76 6f 69 64 20 30 3a 7b 67 6c 6f 62 61 6c 5f 6e 61 6d 65 3a 65 7d 2c 74 69 6d 65 6f 75 74 3a 74 7d 29 3b 69 66 28 69 2e 6f 6b 26 26 28 6e 75 6c 6c 3d 3d 3d 28 6e 3d 69 2e 62 6f 64 79 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 6e 3f Data Ascii: arguments[1]?arguments[1]:1500;if(!!(0,d.vc)()){a.Z.dispatch({type:"POMELO_SUGGESTIONS_RESET"});try{var n;let i=await o.tn.get({url:c.ANM.POMELO_SUGGESTIONS_UNAUTHED,query:null==e?void 0:{global_name:e},timeout:t});if(i.ok&&(null===(n=i.body)\|\|void 0===n?
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 54 5f 46 41 49 4c 55 52 45 22 2c 75 73 65 72 6e 61 6d 65 3a 65 2c 65 72 72 6f 72 3a 45 7d 29 3b 69 66 28 21 21 28 30 2c 6c 2e 45 29 28 29 29 74 72 79 7b 6c 65 74 20 74 3d 61 77 61 69 74 20 75 2e 5a 2e 70 6f 73 74 28 7b 75 72 6c 3a 67 3f 63 2e 41 4e 4d 2e 50 4f 4d 45 4c 4f 5f 41 54 54 45 4d 50 54 5f 55 4e 41 55 54 48 45 44 3a 63 2e 41 4e 4d 2e 50 4f 4d 45 4c 4f 5f 41 54 54 45 4d 50 54 2c 62 6f 64 79 3a 7b 75 73 65 72 6e 61 6d 65 3a 65 7d 2c 74 72 61 63 6b 65 64 41 63 74 69 6f 6e 44 61 74 61 3a 7b 65 76 65 6e 74 3a 69 2e 4e 65 74 77 6f 72 6b 41 63 74 69 6f 6e 4e 61 6d 65 73 2e 50 4f 4d 45 4c 4f 5f 41 54 54 45 4d 50 54 2c 70 72 6f 70 65 72 74 69 65 73 3a 7b 72 65 71 75 65 73 74 65 64 5f 75 73 65 72 6e 61 6d 65 3a 65 7d 7d 7d 29 3b 74 2e 62 6f 64 79 2e 74 61 Data Ascii: T_FAILURE",username:e,error:E});if(!!(0,l.E)())try{let t=await u.Z.post({url:g?c.ANM.POMELO_ATTEMPT_UNAUTHED:c.ANM.POMELO_ATTEMPT,body:{username:e},trackedActionData:{event:i.NetworkActionNames.POMELO_ATTEMPT,properties:{requested_username:e}}});t.body.ta
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 70 6f 73 75 72 65 3a 21 31 7d 29 2e 65 6e 61 62 6c 65 64 7d 2c 36 35 34 33 34 34 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 63 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 3b 6c 65 74 20 69 3d 28 30 2c 6e 28 38 31 38 30 38 33 29 2e 42 29 28 7b 6b 69 6e 64 3a 22 75 73 65 72 22 2c 6c 61 62 65 6c 3a 22 50 6f 6d 65 6c 6f 20 44 65 62 6f 75 6e 63 65 20 44 65 6c 61 79 22 2c 69 64 3a 22 32 30 32 33 2d 30 33 5f 70 6f 6d 65 6c 6f 5f 64 65 62 6f 75 6e 63 65 5f 64 65 6c 61 79 22 2c 64 65 66 61 75 6c 74 43 6f 6e 66 69 67 3a 7b 64 65 6c 61 79 3a 36 30 30 7d 2c 74 72 65 61 74 6d 65 6e 74 73 3a 5b 7b 69 64 3a 31 2c 6c 61 62 65 6c 3a 22 36 30 30 6d 73 22 2c 63 6f 6e 66 69 67 3a 7b 64 65 6c 61 79 3a 36 30 30 7d 7d 2c 7b Data Ascii: posure:!1}).enabled},654344:function(e,t,n){n.d(t,{c:function(){return o}});let i=(0,n(818083).B)({kind:"user",label:"Pomelo Debounce Delay",id:"2023-03_pomelo_debounce_delay",defaultConfig:{delay:600},treatments:[{id:1,label:"600ms",config:{delay:600}},{
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 73 65 72 6e 61 6d 65 53 75 67 67 65 73 74 69 6f 6e 4c 6f 61 64 69 6e 67 7d 69 73 43 75 72 72 65 6e 74 55 73 65 72 6e 61 6d 65 49 6e 76 61 6c 69 64 28 29 7b 72 65 74 75 72 6e 20 6d 2e 63 75 72 72 65 6e 74 55 73 65 72 6e 61 6d 65 49 6e 76 61 6c 69 64 7d 77 61 73 52 65 67 69 73 74 72 61 74 69 6f 6e 53 75 67 67 65 73 74 69 6f 6e 46 65 74 63 68 65 64 28 65 29 7b 72 65 74 75 72 6e 20 6d 2e 73 75 67 67 65 73 74 69 6f 6e 73 2e 72 65 67 69 73 74 72 61 74 69 6f 6e 2e 73 6f 75 72 63 65 3d 3d 3d 65 26 26 6d 2e 73 75 67 67 65 73 74 69 6f 6e 73 2e 72 65 67 69 73 74 72 61 74 69 6f 6e 2e 66 65 74 63 68 65 64 7d 77 61 73 53 75 67 67 65 73 74 69 6f 6e 73 46 65 74 63 68 65 64 28 29 7b 72 65 74 75 72 6e 20 6d 2e 73 75 67 67 65 73 74 69 6f 6e 73 2e 6d 69 67 72 61 74 69 6f 6e Data Ascii: sernameSuggestionLoading}isCurrentUsernameInvalid(){return m.currentUsernameInvalid}wasRegistrationSuggestionFetched(e){return m.suggestions.registration.source===e&&m.suggestions.registration.fetched}wasSuggestionsFetched(){return m.suggestions.migration
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 45 53 54 49 4f 4e 53 5f 53 55 43 43 45 53 53 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6c 65 74 7b 73 75 67 67 65 73 74 69 6f 6e 3a 74 2c 73 6f 75 72 63 65 3a 6e 7d 3d 65 3b 6d 2e 73 75 67 67 65 73 74 69 6f 6e 73 2e 72 65 67 69 73 74 72 61 74 69 6f 6e 3d 7b 73 75 67 67 65 73 74 69 6f 6e 3a 74 2c 73 6f 75 72 63 65 3a 6e 2c 66 65 74 63 68 65 64 3a 21 30 7d 2c 28 6e 75 6c 6c 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 75 73 65 72 6e 61 6d 65 29 21 3d 6e 75 6c 6c 26 26 6d 2e 76 61 6c 69 64 61 74 69 6f 6e 73 2e 73 65 74 28 74 2e 75 73 65 72 6e 61 6d 65 2c 7b 74 61 6b 65 6e 3a 21 31 7d 29 7d 7d 29 7d 2c 31 30 39 34 38 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 50 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 3b 6c Data Ascii: ESTIONS_SUCCESS:function(e){let{suggestion:t,source:n}=e;m.suggestions.registration={suggestion:t,source:n,fetched:!0},(null==t?void 0:t.username)!=null&&m.validations.set(t.username,{taken:!1})}})},109488:function(e,t,n){n.d(t,{P:function(){return o}});l
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 61 75 74 6f 54 72 61 63 6b 45 78 70 6f 73 75 72 65 3a 21 31 7d 29 2e 73 75 67 67 65 73 74 69 6f 6e 73 7d 2c 33 36 33 35 37 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 4d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 67 7d 7d 29 3b 76 61 72 20 69 3d 6e 28 31 39 32 33 37 39 29 2c 6f 3d 6e 28 33 39 32 37 31 31 29 2c 61 3d 6e 28 33 39 39 36 30 36 29 2c 73 3d 6e 28 39 38 36 31 39 37 29 2c 72 3d 6e 28 36 35 34 33 34 34 29 2c 75 3d 6e 28 31 33 35 32 30 30 29 2c 6c 3d 6e 28 33 34 36 35 38 35 29 3b 6c 65 74 20 67 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6c 65 74 20 74 3d 21 28 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 31 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 31 5d 7c 7c 61 72 67 75 6d 65 Data Ascii: autoTrackExposure:!1}).suggestions},363577:function(e,t,n){n.d(t,{M:function(){return g}});var i=n(192379),o=n(392711),a=n(399606),s=n(986197),r=n(654344),u=n(135200),l=n(346585);let g=function(e){let t=!(arguments.length>1)\|\|void 0===arguments[1]\|\|argume
2024-10-24 07:16:25 UTC	744	IN	Data Raw: 6f 75 74 45 66 66 65 63 74 28 28 29 3d 3e 28 6e 75 6c 6c 21 3d 65 2e 63 75 72 72 65 6e 74 26 26 69 2e 6f 62 73 65 72 76 65 28 65 2e 63 75 72 72 65 6e 74 29 2c 28 29 3d 3e 69 2e 64 69 73 63 6f 6e 6e 65 63 74 28 29 29 2c 5b 69 5d 29 2c 7b 72 65 66 3a 65 2c 68 65 69 67 68 74 3a 74 7d 7d 3b 66 75 6e 63 74 69 6f 6e 20 6c 28 65 29 7b 6c 65 74 7b 73 68 6f 77 3a 74 2c 63 68 69 6c 64 72 65 6e 3a 6e 2c 74 6f 70 3a 6f 3d 30 2c 62 6f 74 74 6f 6d 3a 73 3d 30 7d 3d 65 2c 7b 72 65 66 3a 6c 2c 68 65 69 67 68 74 3a 67 7d 3d 75 28 29 2c 64 3d 28 30 2c 72 2e 75 73 65 53 70 72 69 6e 67 29 28 7b 66 72 6f 6d 3a 7b 68 65 69 67 68 74 3a 30 2c 70 61 64 64 69 6e 67 42 6f 74 74 6f 6d 3a 22 30 70 78 22 2c 6d 61 72 67 69 6e 54 6f 70 3a 22 30 70 78 22 7d 2c 74 6f 3a 7b 68 65 69 67 68 Data Ascii: outEffect(()=>(null!=e.current&&i.observe(e.current),()=>i.disconnect()),[i]),{ref:e,height:t}};function l(e){let{show:t,children:n,top:o=0,bottom:s=0}=e,{ref:l,height:g}=u(),d=(0,r.useSpring)({from:{height:0,paddingBottom:"0px",marginTop:"0px"},to:{heigh

Target ID:	0
Start time:	03:16:05
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\Fa1QSXjTZD.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Fa1QSXjTZD.exe"
Imagebase:	0x7ff7c6af0000
File size:	506'368 bytes
MD5 hash:	43A2789DB11A7A83CA1250FFBC135210
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:16:05
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:16:05
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff608320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:16:05
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff7be5c0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:16:05
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff608320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:16:06
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff7be5c0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:16:06
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff608320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:16:06
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff7be5c0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:16:06
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff608320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:16:06
Start date:	24/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff679fa0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:16:06
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff608320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:16:06
Start date:	24/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff679fa0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:16:06
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff608320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:16:06
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff608320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 7792, Parent PID: 7776

General

Target ID:	15
Start time:	03:16:06
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff7be5c0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:16:06
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff608320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 7836, Parent PID: 7820

General

Target ID:	17
Start time:	03:16:06
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff7be5c0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:16:08
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff608320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 7916, Parent PID: 7900

General

Target ID:	19
Start time:	03:16:08
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff7be5c0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:16:08
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff608320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 7964, Parent PID: 7948

General

Target ID:	21
Start time:	03:16:08
Start date:	24/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff679fa0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:16:08
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff608320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 7996, Parent PID: 7980

General

Target ID:	23
Start time:	03:16:08
Start date:	24/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff679fa0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:16:08
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff608320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	03:16:09
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff608320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	03:16:09
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff7be5c0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	03:16:09
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff608320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	03:16:09
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff7be5c0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	03:16:09
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff608320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 8140, Parent PID: 8124

General

Target ID:	30
Start time:	03:16:09
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff7be5c0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	03:16:09
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff608320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 8188, Parent PID: 8172

General

Target ID:	32
Start time:	03:16:09
Start date:	24/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff679fa0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	03:16:10
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff608320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 7224, Parent PID: 7184

General

Target ID:	34
Start time:	03:16:10
Start date:	24/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff679fa0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	03:16:10
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff608320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: chrome.exePID: 4848, Parent PID: 7472

General

Target ID:	37
Start time:	03:16:11
Start date:	24/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://discord.gg/privatecommunity
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	03:16:12
Start date:	24/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1916,i,2913657158474156013,13990504573392746197,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	03:16:18
Start date:	24/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5732 --field-trial-handle=1916,i,2913657158474156013,13990504573392746197,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	03:16:19
Start date:	24/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 --field-trial-handle=1916,i,2913657158474156013,13990504573392746197,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	94

Executed Functions

Function 00007FF7C6B1F5A0 Relevance: 178.5, APIs: 31, Strings: 70, Instructions: 1702stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1F678
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B1F685
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1F758
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1F7DC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1F883
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1F91A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1F9E5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1FA1D
strchr.VCRUNTIME140 ref: 00007FF7C6B1FB97
strchr.VCRUNTIME140 ref: 00007FF7C6B1FBAA
strchr.VCRUNTIME140 ref: 00007FF7C6B1FBBC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1FCC3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1FD33
memcpy.VCRUNTIME140 ref: 00007FF7C6B1FD5A
strchr.VCRUNTIME140 ref: 00007FF7C6B1FD6E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1FD82
strstr.VCRUNTIME140 ref: 00007FF7C6B1FFB8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B200F1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B20269

Part of subcall function 00007FF7C6B18DC0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B18E33

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B2031C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B203A1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B205FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B20610
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B2061F

Part of subcall function 00007FF7C6B21970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B219CA

strchr.VCRUNTIME140 ref: 00007FF7C6B20BD7
strchr.VCRUNTIME140 ref: 00007FF7C6B20BEA
strchr.VCRUNTIME140 ref: 00007FF7C6B20BFC

Part of subcall function 00007FF7C6B21970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B219EA
Part of subcall function 00007FF7C6B21970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B219F3

strchr.VCRUNTIME140 ref: 00007FF7C6B20E4F
strchr.VCRUNTIME140 ref: 00007FF7C6B20E62
strchr.VCRUNTIME140 ref: 00007FF7C6B20E74

Part of subcall function 00007FF7C6B23FA0: strchr.VCRUNTIME140 ref: 00007FF7C6B24086
Part of subcall function 00007FF7C6B23FA0: strchr.VCRUNTIME140 ref: 00007FF7C6B24099
Part of subcall function 00007FF7C6B23FA0: strchr.VCRUNTIME140 ref: 00007FF7C6B240AB

Strings

%s , xrefs: 00007FF7C6B20333
Proxy-Connection: Keep-Alive, xrefs: 00007FF7C6B2049F, 00007FF7C6B204B4
Chunky upload is not supported by HTTP 1.0, xrefs: 00007FF7C6B1FC9C
Cookie, xrefs: 00007FF7C6B1F9A2
PUT, xrefs: 00007FF7C6B1F718
Proxy-Connection, xrefs: 00007FF7C6B20473
;type=%c, xrefs: 00007FF7C6B20021
Host: %s%s%s, xrefs: 00007FF7C6B1FE3D
;type=, xrefs: 00007FF7C6B1FFAE
Failed sending POST request, xrefs: 00007FF7C6B20AA9, 00007FF7C6B20CED
Failed sending PUT request, xrefs: 00007FF7C6B20A49
?%s, xrefs: 00007FF7C6B2040B
Accept, xrefs: 00007FF7C6B20073
Referer, xrefs: 00007FF7C6B1F933
User-Agent, xrefs: 00007FF7C6B1F73D
Could not seek stream, xrefs: 00007FF7C6B20168
Transfer-Encoding: chunked, xrefs: 00007FF7C6B1FC8F
If-Modified-Since, xrefs: 00007FF7C6B2086D
ftp, xrefs: 00007FF7C6B1FF89
Failed sending HTTP request, xrefs: 00007FF7C6B20D46
Content-Range: bytes %s/%I64d, xrefs: 00007FF7C6B202B6
Cookie: , xrefs: 00007FF7C6B2070E, 00007FF7C6B20784
Host, xrefs: 00007FF7C6B1FCC9
chunked, xrefs: 00007FF7C6B1FBD6
multipart/form-data, xrefs: 00007FF7C6B1FACA
Invalid TIMEVALUE, xrefs: 00007FF7C6B20823
HEAD, xrefs: 00007FF7C6B1F6E1
Accept-Encoding, xrefs: 00007FF7C6B1F9C1
Host:, xrefs: 00007FF7C6B1FD91
POST, xrefs: 00007FF7C6B1F725
OPTIONS, xrefs: 00007FF7C6B1F70B
Content-Range: bytes 0-%I64d/%I64d, xrefs: 00007FF7C6B20284
Transfer-Encoding, xrefs: 00007FF7C6B1FB2D
Last-Modified, xrefs: 00007FF7C6B2085B
Content-Length, xrefs: 00007FF7C6B209B4, 00007FF7C6B20B09, 00007FF7C6B20D8E
Content-Range, xrefs: 00007FF7C6B2024E
%s: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 00007FF7C6B208F4
Range, xrefs: 00007FF7C6B200D2
upload completely sent off: %I64d out of %I64d bytes, xrefs: 00007FF7C6B2117E
http, xrefs: 00007FF7C6B1FF1B
Content-Length: 0, xrefs: 00007FF7C6B20A70
1.1, xrefs: 00007FF7C6B2030E
%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF7C6B205DB
Failed sending HTTP POST request, xrefs: 00007FF7C6B2107B
%s?%s, xrefs: 00007FF7C6B1F775
Accept-Encoding: %s, xrefs: 00007FF7C6B1F9F2
%s%s, xrefs: 00007FF7C6B207B0
Content-Range: bytes %s%I64d/%I64d, xrefs: 00007FF7C6B202A8
Host:%s, xrefs: 00007FF7C6B1FDC6
%s%s=%s, xrefs: 00007FF7C6B20729
GET, xrefs: 00007FF7C6B1F732
1.0, xrefs: 00007FF7C6B20300
Referer: %s, xrefs: 00007FF7C6B1F94E
Expect:, xrefs: 00007FF7C6B20B95, 00007FF7C6B20E0A
If-Unmodified-Since, xrefs: 00007FF7C6B20864
Content-Type: application/x-www-form-urlencoded, xrefs: 00007FF7C6B20DD1
Host: %s%s%s:%d, xrefs: 00007FF7C6B1FE82
Accept: */*, xrefs: 00007FF7C6B20085
File already completely uploaded, xrefs: 00007FF7C6B20209
100-continue, xrefs: 00007FF7C6B20C16, 00007FF7C6B20E96
Content-Length: %I64d, xrefs: 00007FF7C6B209CB, 00007FF7C6B20B20, 00007FF7C6B20DA5
0, xrefs: 00007FF7C6B20FC6, 00007FF7C6B210C5
Transfer-Encoding:, xrefs: 00007FF7C6B1FB4E
Expect, xrefs: 00007FF7C6B20B74, 00007FF7C6B20DE9
%s, xrefs: 00007FF7C6B20B53
Could only read %I64d bytes from the input, xrefs: 00007FF7C6B20225
%x, xrefs: 00007FF7C6B20F75
ftp://%s:%s@%s, xrefs: 00007FF7C6B203CB
Range: bytes=%s, xrefs: 00007FF7C6B200FE
Content-Type, xrefs: 00007FF7C6B1FA87, 00007FF7C6B20DBD

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$strchr$_strdup$callocmemcpystrstr
String ID: %s$%s $%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s$%s%s$%s%s=%s$%s: %s, %02d %s %4d %02d:%02d:%02d GMT$%s?%s$%x$0$1.0$1.1$100-continue$;type=$;type=%c$?%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: */*$Chunky upload is not supported by HTTP 1.0$Content-Length$Content-Length: %I64d$Content-Length: 0$Content-Range$Content-Range: bytes %s%I64d/%I64d$Content-Range: bytes %s/%I64d$Content-Range: bytes 0-%I64d/%I64d$Content-Type$Content-Type: application/x-www-form-urlencoded$Cookie$Cookie: $Could not seek stream$Could only read %I64d bytes from the input$Expect$Expect:$Failed sending HTTP POST request$Failed sending HTTP request$Failed sending POST request$Failed sending PUT request$File already completely uploaded$GET$HEAD$Host$Host:$Host: %s%s%s$Host: %s%s%s:%d$Host:%s$If-Modified-Since$If-Unmodified-Since$Invalid TIMEVALUE$Last-Modified$OPTIONS$POST$PUT$Proxy-Connection$Proxy-Connection: Keep-Alive$Range$Range: bytes=%s$Referer$Referer: %s$Transfer-Encoding$Transfer-Encoding:$Transfer-Encoding: chunked$User-Agent$chunked$ftp$ftp://%s:%s@%s$http$multipart/form-data$upload completely sent off: %I64d out of %I64d bytes
API String ID: 2045874074-4264080130
Opcode ID: 22438c2abf2d2fbc8a5cd89d405582d5a8d09b7c3ab9212a29b0d982f638b029
Instruction ID: 15e067a4e348372939e657f7659512e648cfa672675662a8d9799c50b9e096c8
Opcode Fuzzy Hash: 22438c2abf2d2fbc8a5cd89d405582d5a8d09b7c3ab9212a29b0d982f638b029
Instruction Fuzzy Hash: FB03B461A08A8395FB56BF21DC902FBA7E6AF45BA4FA44035CE0D57699DF3CE441C320

Function 00007FF7C6B29F4D Relevance: 116.1, APIs: 43, Strings: 23, Instructions: 552stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7C6B2A0A8
strchr.VCRUNTIME140 ref: 00007FF7C6B2A0D4
strchr.VCRUNTIME140 ref: 00007FF7C6B2A10E
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B2A132
strchr.VCRUNTIME140 ref: 00007FF7C6B2A242
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B2A25A

Strings

Services, xrefs: 00007FF7C6B2A1A7
schannel: Failed to read cert file %s, xrefs: 00007FF7C6B2A609
schannel: unable to allocate memory, xrefs: 00007FF7C6B2A5CC, 00007FF7C6B2A857
LocalMachineGroupPolicy, xrefs: 00007FF7C6B2A1FC
schannel: Failed to import cert file %s, last error is 0x%x, xrefs: 00007FF7C6B2A514
Users, xrefs: 00007FF7C6B2A1C6
schannel: TLS 1.3 is not yet supported, xrefs: 00007FF7C6B29FDB
Unable to set ciphers to passed via SSL_CONN_CONFIG, xrefs: 00007FF7C6B2A147
schannel: Failed to open cert store %x %s, last error is 0x%x, xrefs: 00007FF7C6B2A2C0
schannel: ALPN, offering %s, xrefs: 00007FF7C6B2A785
schannel: AcquireCredentialsHandle failed: %s, xrefs: 00007FF7C6B2A6C5
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF7C6B2A4E9
LocalMachineEnterprise, xrefs: 00007FF7C6B2A21B
Microsoft Unified Security Protocol Provider, xrefs: 00007FF7C6B2A64F
http/1.1, xrefs: 00007FF7C6B2A777
schannel: Failed to get certificate location or file for %s, xrefs: 00007FF7C6B2A632
LocalMachine, xrefs: 00007FF7C6B2A163
CurrentUser, xrefs: 00007FF7C6B2A122
CurrentService, xrefs: 00007FF7C6B2A185
CurrentUserGroupPolicy, xrefs: 00007FF7C6B2A1DD
http/1.1, xrefs: 00007FF7C6B2A763
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF7C6B2A743
schannel: Failed to get certificate from file %s, last error is 0x%x, xrefs: 00007FF7C6B2A55F

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: strchr$_strdupstrncmpstrtol
String ID: CurrentService$CurrentUser$CurrentUserGroupPolicy$LocalMachine$LocalMachineEnterprise$LocalMachineGroupPolicy$Microsoft Unified Security Protocol Provider$Services$Unable to set ciphers to passed via SSL_CONN_CONFIG$Users$http/1.1$http/1.1$schannel: ALPN, offering %s$schannel: AcquireCredentialsHandle failed: %s$schannel: Failed to get certificate from file %s, last error is 0x%x$schannel: Failed to get certificate location or file for %s$schannel: Failed to import cert file %s, last error is 0x%x$schannel: Failed to import cert file %s, password is bad$schannel: Failed to open cert store %x %s, last error is 0x%x$schannel: Failed to read cert file %s$schannel: TLS 1.3 is not yet supported$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.
API String ID: 707411602-3372543188
Opcode ID: 27fa9c1d3608c544f84ac4d009e00f9b1edde746412362c74c54531a340aa5b4
Instruction ID: e9cf8037a8b11aae90046f414a06445d22f813e3e9090acef9e0e214ff616aaa
Opcode Fuzzy Hash: 27fa9c1d3608c544f84ac4d009e00f9b1edde746412362c74c54531a340aa5b4
Instruction Fuzzy Hash: 3442B271A08B8285EB26AF15EC903BBA7A5FF45BA4FA04135DA1E47794DF3CE444C720

Function 00007FF7C6B01540 Relevance: 114.1, APIs: 51, Strings: 14, Instructions: 304
processsleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF7C6B0156A
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF7C6B015A6
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF7C6B015D2
SetConsoleTitleA.KERNEL32 ref: 00007FF7C6B01650
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B01689
GetConsoleWindow.KERNEL32 ref: 00007FF7C6B01695
GetWindowLongPtrA.USER32 ref: 00007FF7C6B016A6
SetWindowLongPtrA.USER32 ref: 00007FF7C6B016BC
SetLayeredWindowAttributes.USER32 ref: 00007FF7C6B016D0
GetStdHandle.KERNEL32 ref: 00007FF7C6B016E0
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7C6B016EC
GetStdHandle.KERNEL32 ref: 00007FF7C6B016F7
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7C6B01703
GetStdHandle.KERNEL32 ref: 00007FF7C6B0171A
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7C6B01726

Part of subcall function 00007FF7C6B00690: memcpy.VCRUNTIME140(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF7C6AF11FC), ref: 00007FF7C6B0076F

Part of subcall function 00007FF7C6B01A80: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,0000000B,00007FF7C6B01738), ref: 00007FF7C6B01AA4
Part of subcall function 00007FF7C6B01A80: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,0000000B,00007FF7C6B01738), ref: 00007FF7C6B01AC5

GetStdHandle.KERNEL32 ref: 00007FF7C6B01749
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7C6B01755
GetStdHandle.KERNEL32 ref: 00007FF7C6B0176C
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7C6B01778
GetStdHandle.KERNEL32 ref: 00007FF7C6B0178F
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7C6B0179B
GetStdHandle.KERNEL32 ref: 00007FF7C6B017B2
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7C6B017BE
GetStdHandle.KERNEL32 ref: 00007FF7C6B017D5
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7C6B017E1
GetStdHandle.KERNEL32 ref: 00007FF7C6B017F8
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7C6B01804
GetStdHandle.KERNEL32 ref: 00007FF7C6B01827
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7C6B01833
GetStdHandle.KERNEL32 ref: 00007FF7C6B0184A
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7C6B01856
GetStdHandle.KERNEL32 ref: 00007FF7C6B0186D
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7C6B01879
GetStdHandle.KERNEL32 ref: 00007FF7C6B0189C
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7C6B018A8
GetStdHandle.KERNEL32 ref: 00007FF7C6B018BF
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7C6B018CB
GetStdHandle.KERNEL32 ref: 00007FF7C6B018E2
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7C6B018EE
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z.MSVCP140 ref: 00007FF7C6B0190B
URLDownloadToFileA.URLMON ref: 00007FF7C6B0195F
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B0196B
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B01978
Sleep.KERNEL32 ref: 00007FF7C6B01983
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B0198B
URLDownloadToFileA.URLMON ref: 00007FF7C6B019DD
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B019E9
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B019F6
Sleep.KERNEL32 ref: 00007FF7C6B01A01
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B01A09
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B01A42

Strings

.exe, xrefs: 00007FF7C6B01573
Selecione a opcao: , xrefs: 00007FF7C6B018F4
##########################################################, xrefs: 00007FF7C6B0177E
##########################################################, xrefs: 00007FF7C6B01738
start C:\Windows\System32\SeuetingsHostialog.exe, xrefs: 00007FF7C6B019EF
start C:\Windows\System32\SeieHuSttinstialog.exe, xrefs: 00007FF7C6B01971
http://185.101.104.122/espsemhvibronkz.exe, xrefs: 00007FF7C6B01919
cd C:\, xrefs: 00007FF7C6B01964, 00007FF7C6B019E2
[ Selecione uma opcao: ], xrefs: 00007FF7C6B0175B
http://185.101.104.122/esphvibronkz.exe, xrefs: 00007FF7C6B01997
Iniciar Valorant ESP (HVCI DESLIGADO): , xrefs: 00007FF7C6B0180A
C:\Windows\System32\SeieHuSttinstialog.exe, xrefs: 00007FF7C6B0192A
Iniciar Valorant ESP (HVCI HABILITADO): , xrefs: 00007FF7C6B0187F
C:\Windows\System32\SeuetingsHostialog.exe, xrefs: 00007FF7C6B019A8

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: Console$AttributeHandleText$Windowsystem$rand$DownloadFileLongSleep_invalid_parameter_noinfo_noreturnexit$??5?$basic_istream@AttributesD@std@@@std@@LayeredTitleU?$char_traits@V01@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: Iniciar Valorant ESP (HVCI DESLIGADO): $ Iniciar Valorant ESP (HVCI HABILITADO): $ Selecione a opcao: $##########################################################$##########################################################$.exe$C:\Windows\System32\SeieHuSttinstialog.exe$C:\Windows\System32\SeuetingsHostialog.exe$[ Selecione uma opcao: ]$cd C:\$http://185.101.104.122/esphvibronkz.exe$http://185.101.104.122/espsemhvibronkz.exe$start C:\Windows\System32\SeieHuSttinstialog.exe$start C:\Windows\System32\SeuetingsHostialog.exe
API String ID: 2233566951-149862079
Opcode ID: 2827d15ecf071187ada9c6dee49aa2b5d213a5e2d26c402d93d3b1b8bee2126d
Instruction ID: 56c21251167e7fec43391ff313f4173831acfaf9d90e68b041bbfb412868b82f
Opcode Fuzzy Hash: 2827d15ecf071187ada9c6dee49aa2b5d213a5e2d26c402d93d3b1b8bee2126d
Instruction Fuzzy Hash: 12E15171A08E4385EB06BF70DCD45FAB361AF85764FA04235D52E46AE9DE3CE849C360

Function 00007FF7C6B18990 Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 191
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00007FF7C6B189B8
WSACleanup.WS2_32 ref: 00007FF7C6B189D3
GetModuleHandleA.KERNEL32 ref: 00007FF7C6B18A24
GetProcAddress.KERNEL32 ref: 00007FF7C6B18A50
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B18A6A
LoadLibraryA.KERNEL32 ref: 00007FF7C6B18A8D
GetProcAddress.KERNEL32 ref: 00007FF7C6B18AAA
LoadLibraryExA.KERNEL32 ref: 00007FF7C6B18AC0
GetSystemDirectoryA.KERNEL32 ref: 00007FF7C6B18AD6
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B18AEE
GetSystemDirectoryA.KERNEL32 ref: 00007FF7C6B18B02
LoadLibraryA.KERNEL32 ref: 00007FF7C6B18B70
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B18B7C
GetProcAddress.KERNEL32 ref: 00007FF7C6B18BA8
VerSetConditionMask.KERNEL32 ref: 00007FF7C6B18C31
VerSetConditionMask.KERNEL32 ref: 00007FF7C6B18C44
VerSetConditionMask.KERNEL32 ref: 00007FF7C6B18C53
VerSetConditionMask.KERNEL32 ref: 00007FF7C6B18C62
VerSetConditionMask.KERNEL32 ref: 00007FF7C6B18C72
VerifyVersionInfoA.KERNEL32 ref: 00007FF7C6B18C83
QueryPerformanceFrequency.KERNEL32 ref: 00007FF7C6B18C9F

Strings

if_nametoindex, xrefs: 00007FF7C6B18B9E
LoadLibraryExA, xrefs: 00007FF7C6B18A3E
kernel32, xrefs: 00007FF7C6B18A0B
iphlpapi.dll, xrefs: 00007FF7C6B18A56
AddDllDirectory, xrefs: 00007FF7C6B18AA0

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ConditionMask$AddressLibraryLoadProc$DirectorySystem$CleanupFrequencyHandleInfoModulePerformanceQueryStartupVerifyVersionfreemallocstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$if_nametoindex$iphlpapi.dll$kernel32
API String ID: 2612373469-2794540096
Opcode ID: 0005b9d5aaa7a315a932e34faef17ab75e9eb08de23d66b364ff834b5afcdde8
Instruction ID: ba9e2e46abef4e4b32cf1a285b593c1fce2c7db8709e53324faaad56e3698f6a
Opcode Fuzzy Hash: 0005b9d5aaa7a315a932e34faef17ab75e9eb08de23d66b364ff834b5afcdde8
Instruction Fuzzy Hash: C2919561A0DB8281E766AF21AC943FBB3A1FF99BA0F945135C94D07758EF3CE4458720

Function 00007FF7C6B17CD0 Relevance: 38.9, APIs: 15, Strings: 7, Instructions: 357
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF7C6B17D6C
socket.WS2_32 ref: 00007FF7C6B17DB5
htons.WS2_32 ref: 00007FF7C6B17E41
setsockopt.WS2_32 ref: 00007FF7C6B17EA3
WSAGetLastError.WS2_32 ref: 00007FF7C6B17EAD
getsockopt.WS2_32 ref: 00007FF7C6B17F4F
setsockopt.WS2_32 ref: 00007FF7C6B17F7E
setsockopt.WS2_32 ref: 00007FF7C6B17FBD
WSAIoctl.WS2_32 ref: 00007FF7C6B1804A
WSAGetLastError.WS2_32 ref: 00007FF7C6B18054

Part of subcall function 00007FF7C6B24CA0: ioctlsocket.WS2_32 ref: 00007FF7C6B24CB9

Part of subcall function 00007FF7C6B1D7C0: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF7C6B0583F), ref: 00007FF7C6B1D7D7

connect.WS2_32 ref: 00007FF7C6B1817B
WSAGetLastError.WS2_32 ref: 00007FF7C6B18198

Part of subcall function 00007FF7C6B02510: GetLastError.KERNEL32 ref: 00007FF7C6B02532
Part of subcall function 00007FF7C6B02510: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B0253A

Part of subcall function 00007FF7C6B15B00: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C6B15C25
Part of subcall function 00007FF7C6B15B00: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C6B15C40

Part of subcall function 00007FF7C6B165E0: closesocket.WS2_32 ref: 00007FF7C6B16623

Strings

Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 00007FF7C6B1805D
@, xrefs: 00007FF7C6B17EE7
Failed to set SO_KEEPALIVE on fd %d, xrefs: 00007FF7C6B17FCA
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 00007FF7C6B1823E
Immediate connect fail for %s: %s, xrefs: 00007FF7C6B181C8
Trying %s:%ld..., xrefs: 00007FF7C6B17E4F
Could not set TCP_NODELAY: %s, xrefs: 00007FF7C6B17ECA

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ErrorLast$setsockopt$fwrite$CounterIoctlPerformanceQuery_errnoclosesocketconnectgetsockopthtonsioctlsocketmemcpysocket
String ID: Trying %s:%ld...$ @$Could not set TCP_NODELAY: %s$Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d$Immediate connect fail for %s: %s$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 3453287622-3868455274
Opcode ID: aa0764b77566f12d1b8d317b421162359ca862f96dcce43cfdc57f85895b746c
Instruction ID: 87b137bd06f975aa0ed68977c13e3d3d738c76fca7f360dbcc3f42f064e92188
Opcode Fuzzy Hash: aa0764b77566f12d1b8d317b421162359ca862f96dcce43cfdc57f85895b746c
Instruction Fuzzy Hash: 45F1D6B2A0864296E752EF25D8846FFA392FB447A8FE04035DA4D47794DF3CE944CB20

Function 00007FF7C6B18670 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 128
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?,00007FF7C6B424CA,?,?,?,?,00007FF7C6B189FB), ref: 00007FF7C6B18684
GetProcAddress.KERNEL32(?,?,00007FF7C6B424CA,?,?,?,?,00007FF7C6B189FB), ref: 00007FF7C6B186A9
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00007FF7C6B424CA,?,?,?,?,00007FF7C6B189FB), ref: 00007FF7C6B186BC

Strings

LoadLibraryExA, xrefs: 00007FF7C6B1869A
kernel32, xrefs: 00007FF7C6B1867D
AddDllDirectory, xrefs: 00007FF7C6B18703

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: AddressHandleModuleProcstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$kernel32
API String ID: 27745253-3327535076
Opcode ID: 312030cda8914d24e805353e033298dbd0e29c9c08ccac29ae1e73f350b62b26
Instruction ID: 3c5aa2546be69e1bc6e53a01e7366d83118a54e1f7f9508c63bee89af0bf6333
Opcode Fuzzy Hash: 312030cda8914d24e805353e033298dbd0e29c9c08ccac29ae1e73f350b62b26
Instruction Fuzzy Hash: E341E852B09A4295EB17AF16AD901BAA791FF45FF1FA84130CE1D07794DE3DD885C320

Function 00007FF7C6B24A70 Relevance: 24.1, APIs: 16, Instructions: 127
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 00007FF7C6B24AB1
htonl.WS2_32 ref: 00007FF7C6B24ADE
setsockopt.WS2_32 ref: 00007FF7C6B24B15
bind.WS2_32 ref: 00007FF7C6B24B30
getsockname.WS2_32 ref: 00007FF7C6B24B4C
listen.WS2_32 ref: 00007FF7C6B24B61
socket.WS2_32 ref: 00007FF7C6B24B78
connect.WS2_32 ref: 00007FF7C6B24B97
accept.WS2_32 ref: 00007FF7C6B24BAE
send.WS2_32 ref: 00007FF7C6B24BFC
recv.WS2_32 ref: 00007FF7C6B24C1A
memcmp.VCRUNTIME140 ref: 00007FF7C6B24C35
closesocket.WS2_32 ref: 00007FF7C6B24C41

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: socket$acceptbindclosesocketconnectgetsocknamehtonllistenmemcmprecvsendsetsockopt
String ID:
API String ID: 3699910901-0
Opcode ID: 3f2c22b51acda6d000839698e23c2376e2171051a68121b04c563781dd75fae3
Instruction ID: 160d5a1154f1ddf7ff2981c5ed1330b64e9fd14e8489d4faa533ea6140efdaa9
Opcode Fuzzy Hash: 3f2c22b51acda6d000839698e23c2376e2171051a68121b04c563781dd75fae3
Instruction Fuzzy Hash: C4519671608A8281D755AF25E9941BAF361FF44BB4FA05730E67E43AE8DF3CD8498B10

Function 00007FF7C6B16990 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

connect to %s port %ld failed: %s, xrefs: 00007FF7C6B16C0D
After %I64dms connect time, move on!, xrefs: 00007FF7C6B16B55
Connection failed, xrefs: 00007FF7C6B16D76
Connection time-out, xrefs: 00007FF7C6B16A79
Failed to connect to %s port %ld: %s, xrefs: 00007FF7C6B16EBE

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID:
String ID: After %I64dms connect time, move on!$Connection failed$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 0-3307081561
Opcode ID: 87775263a7726a8b5b5b297506faea29a38a0a1fff8a10dcaa637955050cd21b
Instruction ID: 828198943a9b92bc3a519a92c6fb0e64ba31eab97774b0a88b209c9e15649c4c
Opcode Fuzzy Hash: 87775263a7726a8b5b5b297506faea29a38a0a1fff8a10dcaa637955050cd21b
Instruction Fuzzy Hash: 1CE106A2B0868292EB16AF25D9802BFA762FB447A4FA44235DA5D077C5EF3CE541C710

Function 00007FF7C6AF2AB0 Relevance: 40.7, APIs: 16, Strings: 7, Instructions: 402
sleepwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7C6AF2850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF28B7
Part of subcall function 00007FF7C6AF2850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2927
Part of subcall function 00007FF7C6AF2850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2987
Part of subcall function 00007FF7C6AF2850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF29D7
Part of subcall function 00007FF7C6AF2850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2A27

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2C58

Part of subcall function 00007FF7C6AF48D0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF4990

Part of subcall function 00007FF7C6B4F200: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7C6AF43FE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7C6AF1B59), ref: 00007FF7C6B4F21A

Part of subcall function 00007FF7C6AF4320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7C6AF1B59), ref: 00007FF7C6AF4351

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2CA8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2CE7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2D35
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2D74
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2E28
memcpy.VCRUNTIME140 ref: 00007FF7C6AF2E4D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2F23
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2F6A
ShellExecuteA.SHELL32 ref: 00007FF7C6AF3062
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF306A
MessageBoxA.USER32 ref: 00007FF7C6AF30A0
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF30B1
Sleep.KERNEL32 ref: 00007FF7C6AF3119
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF3121
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C6AF3128

Part of subcall function 00007FF7C6AF3170: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF327F
Part of subcall function 00007FF7C6AF3170: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF32C0

Part of subcall function 00007FF7C6AF3C40: memcpy.VCRUNTIME140 ref: 00007FF7C6AF3C93

Part of subcall function 00007FF7C6AF32E0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF33C0

Part of subcall function 00007FF7C6AF33E0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF34C0

Strings

sessionid, xrefs: 00007FF7C6AF2EAE
invalidver, xrefs: 00007FF7C6AF2FE9
download, xrefs: 00007FF7C6AF3025
success, xrefs: 00007FF7C6AF2E86
Failure, xrefs: 00007FF7C6AF3097
open, xrefs: 00007FF7C6AF3059
message, xrefs: 00007FF7C6AF2FB3, 00007FF7C6AF3071

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$system$exitmemcpy$Concurrency::cancel_current_taskExecuteMessageShellSleepmalloc
String ID: Failure$download$invalidver$message$open$sessionid$success
API String ID: 3283070336-3881042241
Opcode ID: 605aca67a43f63dff2784ec0a1c61a4c1a1c0773b7d0f1659980d6d69c7d289d
Instruction ID: 24c99fc146f03cc68a6a01f2c1f8e491f3c5eb6da65a49d2e4d3408675bd696f
Opcode Fuzzy Hash: 605aca67a43f63dff2784ec0a1c61a4c1a1c0773b7d0f1659980d6d69c7d289d
Instruction Fuzzy Hash: 1C02F772A08B8285EB02EF64D8847AEA761FF457B4F904236EA5D036D9DF3CE485C351

Function 00007FF7C6B2B5D0 Relevance: 38.9, APIs: 6, Strings: 16, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF7C6B2BC11
memcpy.VCRUNTIME140 ref: 00007FF7C6B2BC2D

Strings

schannel: server closed abruptly (missing close_notify), xrefs: 00007FF7C6B2BBBE
schannel: enough decrypted data is already available, xrefs: 00007FF7C6B2B655
schannel: can't renogotiate, an error is pending, xrefs: 00007FF7C6B2BB92
schannel: remote party requests renegotiation, xrefs: 00007FF7C6B2B9F2
schannel: server indicated shutdown in a prior call, xrefs: 00007FF7C6B2B698
schannel: failed to read data from server: %s, xrefs: 00007FF7C6B2BB62
schannel: SSL/TLS connection renegotiated, xrefs: 00007FF7C6B2BA6F
schannel: can't renogotiate, encrypted data available, xrefs: 00007FF7C6B2BBB2
schannel: server closed the connection, xrefs: 00007FF7C6B2BAA4
schannel: Curl_read_plain returned error %d, xrefs: 00007FF7C6B2B971
schannel: Curl_read_plain returned CURLE_RECV_ERROR, xrefs: 00007FF7C6B2B79D
schannel: unable to re-allocate memory, xrefs: 00007FF7C6B2B70D, 00007FF7C6B2BB76
schannel: an unrecoverable error occurred in a prior call, xrefs: 00007FF7C6B2B675
schannel: renegotiating SSL/TLS connection, xrefs: 00007FF7C6B2BA28
schannel: failed to decrypt data, need more data, xrefs: 00007FF7C6B2BB3A
schannel: renegotiation failed, xrefs: 00007FF7C6B2BB9E

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: memcpy
String ID: schannel: Curl_read_plain returned CURLE_RECV_ERROR$schannel: Curl_read_plain returned error %d$schannel: SSL/TLS connection renegotiated$schannel: an unrecoverable error occurred in a prior call$schannel: can't renogotiate, an error is pending$schannel: can't renogotiate, encrypted data available$schannel: enough decrypted data is already available$schannel: failed to decrypt data, need more data$schannel: failed to read data from server: %s$schannel: remote party requests renegotiation$schannel: renegotiating SSL/TLS connection$schannel: renegotiation failed$schannel: server closed abruptly (missing close_notify)$schannel: server closed the connection$schannel: server indicated shutdown in a prior call$schannel: unable to re-allocate memory
API String ID: 3510742995-857957974
Opcode ID: dd4bc5a1d48941af2fac58f45b82ab7917cd92131374f268c4c569010bb9c7b9
Instruction ID: 0e97cdeb5403b5aed988f3f715c9897c6ad643dca686b68a244f3e077bc84b86
Opcode Fuzzy Hash: dd4bc5a1d48941af2fac58f45b82ab7917cd92131374f268c4c569010bb9c7b9
Instruction Fuzzy Hash: 0402D272A08A8685EB52EF05DCC47ABB7A5FB44BA8FB04536DA4D473A4DF38D841C710

Function 00007FF7C6B2AA60 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 415
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B2AB50
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B2ABA1
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B2ABE4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B2ACC7
memcpy.VCRUNTIME140 ref: 00007FF7C6B2AD69
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B2ADD2
memcpy.VCRUNTIME140 ref: 00007FF7C6B2AEAA
memset.VCRUNTIME140 ref: 00007FF7C6B2B077
CertFreeCertificateContext.CRYPT32 ref: 00007FF7C6B2B0DA

Strings

schannel: failed to receive handshake, SSL/TLS connection failed, xrefs: 00007FF7C6B2AED6
schannel: failed to send next handshake data: sent %zd of %lu bytes, xrefs: 00007FF7C6B2AF84
SSL: public key does not match pinned public key!, xrefs: 00007FF7C6B2B0BC, 00007FF7C6B2B0E4
schannel: next InitializeSecurityContext failed: %s, xrefs: 00007FF7C6B2AF6E, 00007FF7C6B2B182
schannel: SNI or certificate check failed: %s, xrefs: 00007FF7C6B2AF3B
schannel: unable to re-allocate memory, xrefs: 00007FF7C6B2ABF2
schannel: unable to allocate memory, xrefs: 00007FF7C6B2B1CF
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF7C6B2B11A
SSL: failed retrieving public key from server certificate, xrefs: 00007FF7C6B2B0FA

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: malloc$memcpy$CertCertificateContextFreefreememsetrealloc
String ID: SSL: failed retrieving public key from server certificate$SSL: public key does not match pinned public key!$schannel: Failed to read remote certificate context: %s$schannel: SNI or certificate check failed: %s$schannel: failed to receive handshake, SSL/TLS connection failed$schannel: failed to send next handshake data: sent %zd of %lu bytes$schannel: next InitializeSecurityContext failed: %s$schannel: unable to allocate memory$schannel: unable to re-allocate memory
API String ID: 860210379-3059304359
Opcode ID: 35434011fc40b531e2705825d4b257061eabe2c4370a9eef93637380705544f8
Instruction ID: 6024c2b777d6fd604cc67da40301f33ca23dba527ed4171e247418fcaa7d1a55
Opcode Fuzzy Hash: 35434011fc40b531e2705825d4b257061eabe2c4370a9eef93637380705544f8
Instruction Fuzzy Hash: 29129072608B8286EB66AF19DC903AFB7A1FB44BA8FA00136CA5D57794DF3CD445C710

Function 00007FF7C6B29C80 Relevance: 30.1, APIs: 4, Strings: 13, Instructions: 348
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7C6B29D51
GetProcAddress.KERNEL32 ref: 00007FF7C6B29D61

Strings

Unrecognized parameter passed via CURLOPT_SSLVERSION, xrefs: 00007FF7C6B2A6FF
schannel: SNI or certificate check failed: %s, xrefs: 00007FF7C6B2A93D
schannel: failed to send initial handshake data: sent %zd of %lu bytes, xrefs: 00007FF7C6B2A9F9
schannel: unable to allocate memory, xrefs: 00007FF7C6B2A857
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF7C6B29DF2
wine_get_version, xrefs: 00007FF7C6B29D5A
ntdll, xrefs: 00007FF7C6B29D4A
schannel: ALPN, offering %s, xrefs: 00007FF7C6B2A785
http/1.1, xrefs: 00007FF7C6B2A777
schannel: initial InitializeSecurityContext failed: %s, xrefs: 00007FF7C6B2A91C, 00007FF7C6B2A963
schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc., xrefs: 00007FF7C6B29D32
http/1.1, xrefs: 00007FF7C6B2A763
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF7C6B2A743

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Unrecognized parameter passed via CURLOPT_SSLVERSION$http/1.1$http/1.1$ntdll$schannel: ALPN, offering %s$schannel: SNI or certificate check failed: %s$schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc.$schannel: failed to send initial handshake data: sent %zd of %lu bytes$schannel: initial InitializeSecurityContext failed: %s$schannel: this version of Windows is too old to support certificate verification via CA bundle file.$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.$wine_get_version
API String ID: 1646373207-2477831187
Opcode ID: c76139ff52126ea816adc21ac68d73592e5fcad2caf0fc67380415d72780900b
Instruction ID: 6d81e6056587e61e0c82be3366e84b09c25b1352e6e9626f8586da68ae3c5eab
Opcode Fuzzy Hash: c76139ff52126ea816adc21ac68d73592e5fcad2caf0fc67380415d72780900b
Instruction Fuzzy Hash: AA02EE72A08B818AEB12AF25DC803EFB7A6FB447A4FA04135DA5D07795DF38E544C710

Function 00007FF7C6B0B2C0 Relevance: 28.7, APIs: 19, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0B2F2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0B38D
InitializeCriticalSectionEx.KERNEL32 ref: 00007FF7C6B0B3A6

Part of subcall function 00007FF7C6B24A70: socket.WS2_32 ref: 00007FF7C6B24AB1

DeleteCriticalSection.KERNEL32 ref: 00007FF7C6B0B3E0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0B3EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0B3F4
closesocket.WS2_32 ref: 00007FF7C6B0B412
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0B448
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B0B44E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B0B47D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0B497
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B0B4A0
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B0B4D5
EnterCriticalSection.KERNEL32 ref: 00007FF7C6B0B4F6
LeaveCriticalSection.KERNEL32 ref: 00007FF7C6B0B50A
CloseHandle.KERNEL32 ref: 00007FF7C6B0B517
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0B542
closesocket.WS2_32 ref: 00007FF7C6B0B55B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0B56F

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$CriticalSection$_errno_strdupclosesocket$CloseDeleteEnterHandleInitializeLeavecallocmallocsocket
String ID:
API String ID: 259767416-0
Opcode ID: 03299397237b93bf54a8e059ab257eefa0efaac53b519c0da3c9f50a590a7eca
Instruction ID: 527fcb36a43022a1aedbc4ab4d5a824a780436c2505651a4f2237352b876973f
Opcode Fuzzy Hash: 03299397237b93bf54a8e059ab257eefa0efaac53b519c0da3c9f50a590a7eca
Instruction Fuzzy Hash: A1817066D09B8183E625EF11E89067AB760FB98B60F645235CB9E037A1DF38F4D4C310

Function 00007FF7C6B12930 Relevance: 28.6, APIs: 6, Strings: 10, Instructions: 557COMMON

Download Yara Rule

Strings

NTLM picked AND auth done set, clear picked!, xrefs: 00007FF7C6B13182
NTLM-proxy picked AND auth done set, clear picked!, xrefs: 00007FF7C6B131B0
proxy, xrefs: 00007FF7C6B12FF2
No connections available in cache, xrefs: 00007FF7C6B1332B
No more connections allowed to host %s: %zu, xrefs: 00007FF7C6B130C2
ftp@example.com, xrefs: 00007FF7C6B12AEF
host, xrefs: 00007FF7C6B13000
Re-using existing connection! (#%ld) with %s %s, xrefs: 00007FF7C6B13013
No connections available., xrefs: 00007FF7C6B130D1
anonymous, xrefs: 00007FF7C6B12AE8

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID:
String ID: NTLM picked AND auth done set, clear picked!$NTLM-proxy picked AND auth done set, clear picked!$No connections available in cache$No connections available.$No more connections allowed to host %s: %zu$Re-using existing connection! (#%ld) with %s %s$anonymous$ftp@example.com$host$proxy
API String ID: 0-760484938
Opcode ID: bc2d408d2b982223d1a1825a6027afd98298acaff7571cdd7bf63365d8da98ba
Instruction ID: ee114cbfd7a50c802e087d46564e4b82140efb255912e6eff5768a90a242f5dc
Opcode Fuzzy Hash: bc2d408d2b982223d1a1825a6027afd98298acaff7571cdd7bf63365d8da98ba
Instruction Fuzzy Hash: F542C9A2609BC2A1EB5AAF2599803BAA7E1FF45B94F940135CF5D47785DF3CE460C320

Function 00007FF7C6B118C0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B01B71,?,?,?,?,00007FF7C6AF35A1), ref: 00007FF7C6B118D8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B11921

Strings

v, xrefs: 00007FF7C6B11BCF
<, xrefs: 00007FF7C6B11B68
<, xrefs: 00007FF7C6B11B5E
`, xrefs: 00007FF7C6B11BBA
<, xrefs: 00007FF7C6B11A37

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: callocfree
String ID: <$<$<$`$v
API String ID: 306872129-2056843887
Opcode ID: 26e4e81a9c9f437bb8bb3b7ae7bbc2a3e6040ac12686267bc81c14722b497342
Instruction ID: 095bd9cde567315cabc2d7f569c8e14a491d4e599ce5ae1b640cab9abb128fde
Opcode Fuzzy Hash: 26e4e81a9c9f437bb8bb3b7ae7bbc2a3e6040ac12686267bc81c14722b497342
Instruction Fuzzy Hash: 3B914A72908BC186E3019F24D8443E977A0FB55B6CF585239CF9D1B39ADFBAA095C720

Function 00007FF7C6B17310 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 161
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getpeername.WS2_32 ref: 00007FF7C6B1737C
WSAGetLastError.WS2_32 ref: 00007FF7C6B17386

Part of subcall function 00007FF7C6B02510: GetLastError.KERNEL32 ref: 00007FF7C6B02532
Part of subcall function 00007FF7C6B02510: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B0253A

getsockname.WS2_32 ref: 00007FF7C6B17406
WSAGetLastError.WS2_32 ref: 00007FF7C6B17410

Strings

ssloc inet_ntop() failed with errno %d: %s, xrefs: 00007FF7C6B1752C
ssrem inet_ntop() failed with errno %d: %s, xrefs: 00007FF7C6B17496
getsockname() failed with errno %d: %s, xrefs: 00007FF7C6B17430
getpeername() failed with errno %d: %s, xrefs: 00007FF7C6B173A6

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ErrorLast$_errnogetpeernamegetsockname
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 2911674258-670633250
Opcode ID: 91fc6a06602858445d674867f205da412d6175ac75bfcb9aae03c2b9dd01b72a
Instruction ID: bc9b7604097179d0497e574995fe5def334786315fca4a5b40580bda59f69c1d
Opcode Fuzzy Hash: 91fc6a06602858445d674867f205da412d6175ac75bfcb9aae03c2b9dd01b72a
Instruction Fuzzy Hash: E391B672A18BC582D711DF25D8902EA73A1FB88B98F945235DF4C47659EF38D185C720

Function 00007FF7C6B286E0 Relevance: 19.6, APIs: 13, Instructions: 128
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32 ref: 00007FF7C6B28702
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B0B205), ref: 00007FF7C6B2876E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B0B205), ref: 00007FF7C6B287A8
memcpy.VCRUNTIME140(?,?,?,00007FF7C6B0B205), ref: 00007FF7C6B287C1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C6B0B205), ref: 00007FF7C6B287CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B0B205), ref: 00007FF7C6B2880A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B0B205), ref: 00007FF7C6B28813
freeaddrinfo.WS2_32(?,?,?,00007FF7C6B0B205), ref: 00007FF7C6B28841
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B0B205), ref: 00007FF7C6B28855
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B0B205), ref: 00007FF7C6B2885F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B0B205), ref: 00007FF7C6B2886C
WSASetLastError.WS2_32(?,?,?,00007FF7C6B0B205), ref: 00007FF7C6B2888D

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$malloc$ErrorLast_strdupfreeaddrinfogetaddrinfomemcpy
String ID:
API String ID: 2364279375-0
Opcode ID: 154528c5ac2e19c040c17a13c339d88deec472f70e433b4999d8b39ec98f9330
Instruction ID: 7a97d303b7b4dae2323b20f36c208e2fa5e3bc3608f8f713e51de074307dc96d
Opcode Fuzzy Hash: 154528c5ac2e19c040c17a13c339d88deec472f70e433b4999d8b39ec98f9330
Instruction Fuzzy Hash: F5512535A0978182EA6AAF11A99013AF7E1FF44BA4FA44435DE4E17750DF3CE449C720

Function 00007FF7C6B25FF0 Relevance: 16.7, APIs: 11, Instructions: 241
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32 ref: 00007FF7C6B2604D
Sleep.KERNEL32 ref: 00007FF7C6B2605E
WSASetLastError.WS2_32 ref: 00007FF7C6B261C8
Sleep.KERNEL32 ref: 00007FF7C6B261D9
__WSAFDIsSet.WS2_32 ref: 00007FF7C6B2628C
__WSAFDIsSet.WS2_32 ref: 00007FF7C6B262A3
__WSAFDIsSet.WS2_32 ref: 00007FF7C6B262BE
__WSAFDIsSet.WS2_32 ref: 00007FF7C6B262D2
__WSAFDIsSet.WS2_32 ref: 00007FF7C6B262ED
__WSAFDIsSet.WS2_32 ref: 00007FF7C6B26301

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: b164742fa9766fce12f121a3d8df35783951738aa7c086fea6dfe903711930fa
Instruction ID: c41556d675551818bd3aba28208927cba0dac1d025e77a3e1d0d22e0a2d2c46d
Opcode Fuzzy Hash: b164742fa9766fce12f121a3d8df35783951738aa7c086fea6dfe903711930fa
Instruction Fuzzy Hash: FF910A61A0C6D387EB266E149CC02BBA3D2FB44365FB45134DA1E86BC6FE3DE9418610

Function 00007FF7C6B14F00 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B14F4F

Strings

Unix socket path too long: '%s', xrefs: 00007FF7C6B14FA6
Couldn't resolve host '%s', xrefs: 00007FF7C6B15081
Couldn't resolve proxy '%s', xrefs: 00007FF7C6B1512C

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: calloc
String ID: Couldn't resolve host '%s'$Couldn't resolve proxy '%s'$Unix socket path too long: '%s'
API String ID: 2635317215-3812100122
Opcode ID: d726379b730963aba88b2228892cd83b354e96b8a630839deb714462da6f090e
Instruction ID: de01b2394a7ea7c131d03b9a79c8456f4f492df8d4409341e05ae624de023dc6
Opcode Fuzzy Hash: d726379b730963aba88b2228892cd83b354e96b8a630839deb714462da6f090e
Instruction Fuzzy Hash: 4251D7A2B0CA8297F61BAF2599903BAE791EB457A0FA40031DB5D43391DF3DE4658720

Function 00007FF7C6AF2850 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 121processCOMMON

Download Yara Rule

APIs

system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF28B7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2927
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2987
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF29D7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2A27
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2A98

Strings

.8, xrefs: 00007FF7C6AF2A75
h%49, xrefs: 00007FF7C6AF2A6E

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: system
String ID: .8$h%49
API String ID: 3377271179-4206735779
Opcode ID: e399e6682246bdde8fd0893be3d982c4dd70a710d10abba11dc5eb58184e60af
Instruction ID: f386eb59e9927b4f5ba3cb3bc3617455e560926cf80472530c49ffac8d9eb70b
Opcode Fuzzy Hash: e399e6682246bdde8fd0893be3d982c4dd70a710d10abba11dc5eb58184e60af
Instruction Fuzzy Hash: CF618022E28BD688F302DFB8EC851FDB770BB89758F505238CFC926919EB685508C754

Function 00007FF7C6B0B1B0 Relevance: 12.1, APIs: 8, Instructions: 67networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C6B286E0: getaddrinfo.WS2_32 ref: 00007FF7C6B28702
Part of subcall function 00007FF7C6B286E0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B0B205), ref: 00007FF7C6B2876E
Part of subcall function 00007FF7C6B286E0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B0B205), ref: 00007FF7C6B287A8
Part of subcall function 00007FF7C6B286E0: memcpy.VCRUNTIME140(?,?,?,00007FF7C6B0B205), ref: 00007FF7C6B287C1
Part of subcall function 00007FF7C6B286E0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C6B0B205), ref: 00007FF7C6B287CF
Part of subcall function 00007FF7C6B286E0: freeaddrinfo.WS2_32(?,?,?,00007FF7C6B0B205), ref: 00007FF7C6B28841
Part of subcall function 00007FF7C6B286E0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B0B205), ref: 00007FF7C6B28855
Part of subcall function 00007FF7C6B286E0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B0B205), ref: 00007FF7C6B2885F
Part of subcall function 00007FF7C6B286E0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B0B205), ref: 00007FF7C6B2886C

WSAGetLastError.WS2_32 ref: 00007FF7C6B0B20B
WSAGetLastError.WS2_32 ref: 00007FF7C6B0B215
EnterCriticalSection.KERNEL32 ref: 00007FF7C6B0B230
LeaveCriticalSection.KERNEL32 ref: 00007FF7C6B0B23F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0B250
send.WS2_32 ref: 00007FF7C6B0B273
WSAGetLastError.WS2_32 ref: 00007FF7C6B0B27D
LeaveCriticalSection.KERNEL32 ref: 00007FF7C6B0B290

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$CriticalErrorLastSection$Leavemalloc$Enter_strdupfreeaddrinfogetaddrinfomemcpysend
String ID:
API String ID: 506363382-0
Opcode ID: 4047936f60699270977655c49edccd24d1f69eb329923c1ae4debe2a9cc8b8a0
Instruction ID: f54b81b729f6c7f22fbf75e8048c7bf55b529e08b7b31f07e6d8eabba47068d7
Opcode Fuzzy Hash: 4047936f60699270977655c49edccd24d1f69eb329923c1ae4debe2a9cc8b8a0
Instruction Fuzzy Hash: D1319C71A08A4285E742AF65ECD066FB7A0FF44BB4FA00131D61E83698DF3DD845C750

Function 00007FF7C6B25C50 Relevance: 10.7, APIs: 7, Instructions: 242sleepnetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32 ref: 00007FF7C6B25CB6
WSASetLastError.WS2_32 ref: 00007FF7C6B25E76
Sleep.KERNEL32 ref: 00007FF7C6B25E86
__WSAFDIsSet.WS2_32 ref: 00007FF7C6B25F9A
__WSAFDIsSet.WS2_32 ref: 00007FF7C6B25FB2
Sleep.KERNEL32 ref: 00007FF7C6B25FDD

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 4e0f1499a8a40be29bc936bbccb70d398a53947eba8efbb1ca6e156ed583dac6
Instruction ID: 3edd5499cd2cb38e87cbb47b5820d2ba9c6401339cc26f5b7d3b0c5020ea5168
Opcode Fuzzy Hash: 4e0f1499a8a40be29bc936bbccb70d398a53947eba8efbb1ca6e156ed583dac6
Instruction Fuzzy Hash: 35A10A33A296C286EB6A6F149D406BBA3D6FF44BB4FA04234E91E467C4DF3DD8018310

Function 00007FF7C6B28EC0 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B290EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B2912F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B29157
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B29199

Strings

schannel: ApplyControlToken failure: %s, xrefs: 00007FF7C6B28FC8
schannel: failed to send close msg: %s (bytes written: %zd), xrefs: 00007FF7C6B290B3
schannel: shutting down SSL/TLS connection with %s port %hu, xrefs: 00007FF7C6B28F3E

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: schannel: ApplyControlToken failure: %s$schannel: failed to send close msg: %s (bytes written: %zd)$schannel: shutting down SSL/TLS connection with %s port %hu
API String ID: 1294909896-116363806
Opcode ID: 6ba23b058ca05ffa138ca91ec095aeca9f0c923994899359b32db004eba8c186
Instruction ID: fdcfd13bcc3f9d55e9aa9201f3c8ce35b3d8c2901d75978adfdb33212675dac6
Opcode Fuzzy Hash: 6ba23b058ca05ffa138ca91ec095aeca9f0c923994899359b32db004eba8c186
Instruction Fuzzy Hash: E4918A32608F8186EB15AF26D8906AEB7B5FB88BA5F940535CE4C47764DF38D445CB10

Function 00007FF7C6B2BCA0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B2BD3E
memcpy.VCRUNTIME140 ref: 00007FF7C6B2BDD6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B2BF0C

Strings

select/poll on SSL socket, errno: %d, xrefs: 00007FF7C6B2BEB4
schannel: timed out sending data (bytes sent: %zd), xrefs: 00007FF7C6B2BED4

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: freemallocmemcpy
String ID: schannel: timed out sending data (bytes sent: %zd)$select/poll on SSL socket, errno: %d
API String ID: 3056473165-3891197721
Opcode ID: afcaa9a67b8d832eadfd511aac790e96e8f870143be1df55cde6f79a51460a79
Instruction ID: 17697b9504b77f8ad03172aa5a1b67d2e8771eaf02408ccfca9143ee48336281
Opcode Fuzzy Hash: afcaa9a67b8d832eadfd511aac790e96e8f870143be1df55cde6f79a51460a79
Instruction Fuzzy Hash: F1719E72B04B428AEB11DF65D8906AE73A2FB48BB8F604635DE2D477D4EE38D406C750

Function 00007FF7C6B4F86C Relevance: 10.6, APIs: 7, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_release_startup_lock.LIBCMT ref: 00007FF7C6B4F903
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B4F951
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B4F956
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B4F95E
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B4F966
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B4F988
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B4F9E2

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1328870896-0
Opcode ID: f5a37ee8610542b426fffd651d0c7e4e91b005b4a4351f98243e1d2f9b230c75
Instruction ID: 6f828a54a21501c4100c32a5b7881149905db7520599cbd962b7f5a2d78fcf3c
Opcode Fuzzy Hash: f5a37ee8610542b426fffd651d0c7e4e91b005b4a4351f98243e1d2f9b230c75
Instruction Fuzzy Hash: 0D314E21A0864392EA57BF649CD13FBA3959F857A4FE44035DA4E072D7DE2EE8448231

Function 00007FF7C6B06D10 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B06D5E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B06D75
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B06EA2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B06ECE

Strings

Connection #%ld to host %s left intact, xrefs: 00007FF7C6B06F8B
%s, xrefs: 00007FF7C6B06FD7

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: %s$Connection #%ld to host %s left intact
API String ID: 1294909896-118628944
Opcode ID: 727acb4a023aa86b33c54c1ecc8fdbe9e5a8cfbb6846fd41be22f63e0e29c2ff
Instruction ID: 5e199b672ad2efabe85c33a574e3f07d8f706742131676dbf2f42c2dfabe4c66
Opcode Fuzzy Hash: 727acb4a023aa86b33c54c1ecc8fdbe9e5a8cfbb6846fd41be22f63e0e29c2ff
Instruction Fuzzy Hash: E191A6B2A0868292E75ABF25DD807FBA795FB45BA4FA44431DF0E07355DF38E4608360

Function 00007FF7C6B111A0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B111CB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B111E1

Part of subcall function 00007FF7C6B10F80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B10FFD
Part of subcall function 00007FF7C6B10F80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B1101A
Part of subcall function 00007FF7C6B10F80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B1102E
Part of subcall function 00007FF7C6B10F80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B1104A
Part of subcall function 00007FF7C6B10F80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B11067
Part of subcall function 00007FF7C6B10F80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B1108A
Part of subcall function 00007FF7C6B10F80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B1109E
Part of subcall function 00007FF7C6B10F80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B110B2
Part of subcall function 00007FF7C6B10F80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B110D8
Part of subcall function 00007FF7C6B10F80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B110EC
Part of subcall function 00007FF7C6B10F80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B11100
Part of subcall function 00007FF7C6B10F80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B1114F
Part of subcall function 00007FF7C6B10F80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B1115C

Part of subcall function 00007FF7C6B10F80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B11185

memset.VCRUNTIME140 ref: 00007FF7C6B11215

Strings

User-Agent: %s, xrefs: 00007FF7C6B112AF
Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF7C6B113F1

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$memset
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 2717317152-3248832348
Opcode ID: b958897df89457a4b7c2fb38d9397078eb8379d3de42428143e7958436c8e668
Instruction ID: 973477401be0aef344efb485eea967805ad549a55ef8920313b601a4f1657e24
Opcode Fuzzy Hash: b958897df89457a4b7c2fb38d9397078eb8379d3de42428143e7958436c8e668
Instruction Fuzzy Hash: 637194A290CBC291E752EF2598903FFA762EB85BA4FA84131DF5D47685DF38E4418360

Function 00007FF7C6B21720 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B217B8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B217C1
memcpy.VCRUNTIME140 ref: 00007FF7C6B217DC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B2193C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B21945

Strings

1.1, xrefs: 00007FF7C6B2172F

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$memcpy
String ID: 1.1
API String ID: 4107583993-2150719395
Opcode ID: d912d6c1481fb8d7d6349b9ec54b5a3eb109c5e30d89e6ead009031c354b3233
Instruction ID: b1270f6cdaf0da80b87ab130117f0cdde763c706b35ab0c64d4efb81c2fc8fce
Opcode Fuzzy Hash: d912d6c1481fb8d7d6349b9ec54b5a3eb109c5e30d89e6ead009031c354b3233
Instruction Fuzzy Hash: 42518E76609BC186D66A9F22E8803ABB3A1FB89B94F944031CF9D47755CF3CE0A5C310

Function 00007FF7C6B15EE0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B15FA6
recv.WS2_32 ref: 00007FF7C6B15FD0
send.WS2_32 ref: 00007FF7C6B15FF3
WSAGetLastError.WS2_32 ref: 00007FF7C6B16005

Strings

Send failure: %s, xrefs: 00007FF7C6B16035

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ErrorLastmallocrecvsend
String ID: Send failure: %s
API String ID: 25851408-857917747
Opcode ID: a229e53d8aff5a9d4ae16459c23925996ae4728e0febe8a277d54671151be6f8
Instruction ID: 4fb985331283047180f1a0300a1d5e2d96c2d458255226841603eafdfd7f88d8
Opcode Fuzzy Hash: a229e53d8aff5a9d4ae16459c23925996ae4728e0febe8a277d54671151be6f8
Instruction Fuzzy Hash: 7741C2B2705B8145EB26AF25ED94BBAA391EB08BB8FA44135CE6D47384DE3CD440C710

Function 00007FF7C6B07E08 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 297COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B07F58
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B07F9F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B07FCA

Part of subcall function 00007FF7C6B06D10: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B06D5E
Part of subcall function 00007FF7C6B06D10: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B06D75

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B07FFF

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF7C6B07346

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: Resolving timed out after %I64d milliseconds
API String ID: 1294909896-3343404259
Opcode ID: 078ac899b20e6b8c3a6a2033a3ed6725d992359fb10c0c17492541335f063aec
Instruction ID: 5603bed9c01ae6ce4a831d16bfefb0d7c8a2847d881597e498c78e9f715df38a
Opcode Fuzzy Hash: 078ac899b20e6b8c3a6a2033a3ed6725d992359fb10c0c17492541335f063aec
Instruction Fuzzy Hash: 3FD1DAB1A0864285FB26FF2598907BEABA1FF44BA8FA45431CE0D07695DF3CE541C360

Function 00007FF7C6AF3560 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 157windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C6AF2850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF28B7
Part of subcall function 00007FF7C6AF2850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2927
Part of subcall function 00007FF7C6AF2850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2987
Part of subcall function 00007FF7C6AF2850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF29D7
Part of subcall function 00007FF7C6AF2850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2A27

MessageBoxA.USER32 ref: 00007FF7C6AF3737

Part of subcall function 00007FF7C6AF4320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7C6AF1B59), ref: 00007FF7C6AF4351

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF379A

Strings

keyauth.win, xrefs: 00007FF7C6AF36C3
null, xrefs: 00007FF7C6AF35C2

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: system$Message_invalid_parameter_noinfo_noreturnmemcpy
String ID: keyauth.win$null
API String ID: 3545939226-2841560827
Opcode ID: 53c9dd3c7611d9581695dd2502bc2e89c905e898833604cc37c84ee1bcbdc4f7
Instruction ID: a9f13508d7cc7a22222fc47c8099a3fc56bec6130a878c26833dcf3d28e727ac
Opcode Fuzzy Hash: 53c9dd3c7611d9581695dd2502bc2e89c905e898833604cc37c84ee1bcbdc4f7
Instruction Fuzzy Hash: 1551D062A08B4185FB05EF71D9847AE6721AB44BA8FD04135DF4D17B8ADF7CD0928391

Function 00007FF7C6B42490 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C6B18670: GetModuleHandleA.KERNEL32(?,?,?,00007FF7C6B424CA,?,?,?,?,00007FF7C6B189FB), ref: 00007FF7C6B18684

GetProcAddressForCaller.KERNELBASE(?,?,?,?,00007FF7C6B189FB), ref: 00007FF7C6B424E0

Strings

security.dll, xrefs: 00007FF7C6B424BA
secur32.dll, xrefs: 00007FF7C6B424B3
InitSecurityInterfaceA, xrefs: 00007FF7C6B424D6

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: AddressCallerHandleModuleProc
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 2084706301-3788156360
Opcode ID: 42a7777d76208aed39c7dcb6693bc4b0667e81b70cb710217a1a9bf012b016f9
Instruction ID: 3cf5ad54bf4e156e07cbae95a9f8fbdf3be3eba79ba4e2bd53cf129c2643c77c
Opcode Fuzzy Hash: 42a7777d76208aed39c7dcb6693bc4b0667e81b70cb710217a1a9bf012b016f9
Instruction Fuzzy Hash: 2FF01961F09A0280EE1ABF11ACD17B2A2E1AF547A4FE44438C50C42698EE3CE9859320

Function 00007FF7C6B0793B Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF7C6B07346

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID:
String ID: Resolving timed out after %I64d milliseconds
API String ID: 0-3343404259
Opcode ID: e4b2fe925d595f4f4f7b7ebe845fc31a8af3696bd53bf1e5ba1c45b42da6e5fe
Instruction ID: 7c25fc8908fc84a2f71c427fe13ae857b0a5f73e13e6aac6059cd43176491653
Opcode Fuzzy Hash: e4b2fe925d595f4f4f7b7ebe845fc31a8af3696bd53bf1e5ba1c45b42da6e5fe
Instruction Fuzzy Hash: 3AB1B5B1A0864295FB26BE259C90A7EEBA1FF45B68FB40531CE1E07285DE3CE540C360

Function 00007FF7C6B212E0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B213E0

Part of subcall function 00007FF7C6B21970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B219CA

Part of subcall function 00007FF7C6B21720: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B217B8
Part of subcall function 00007FF7C6B21720: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B217C1

Strings

TCP4, xrefs: 00007FF7C6B2137A
TCP6, xrefs: 00007FF7C6B21367
PROXY %s %s %s %li %li, xrefs: 00007FF7C6B213B4

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$calloc
String ID: PROXY %s %s %s %li %li$TCP4$TCP6
API String ID: 3095843317-1242256665
Opcode ID: 6656595aade7df7c85bedc1241cc305a3e88b172560b07e5515a5b31f3418a6e
Instruction ID: 3e6da0968bac20518b8d4fc87e5a0df308bb2b7b0e404d7a0f8624b87796d242
Opcode Fuzzy Hash: 6656595aade7df7c85bedc1241cc305a3e88b172560b07e5515a5b31f3418a6e
Instruction Fuzzy Hash: 2D419671A0C6C255E762EF25AC913BBB7E2AB85798FA44032DB4C47695DE2CD444CB20

Function 00007FF7C6B05BD0 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000,00007FF7C6B01C06,?,?,?,?,00000000,?,00007FF7C6AF371E), ref: 00007FF7C6B05BED
closesocket.WS2_32 ref: 00007FF7C6B05CF9
closesocket.WS2_32 ref: 00007FF7C6B05D06

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: closesocket$calloc
String ID:
API String ID: 2958813939-0
Opcode ID: ba2ce935c3711142949e8524ec06bf9a52e435b800477985d63e87ab61eac627
Instruction ID: 96c747f6bae5451d27a1a14fc740c723b48810104fb57420cf6f509b6f16119d
Opcode Fuzzy Hash: ba2ce935c3711142949e8524ec06bf9a52e435b800477985d63e87ab61eac627
Instruction Fuzzy Hash: C941A272A08A4291E712FF30DC902EAA7A1EF88774FE44631DE5D462D6EF38D5058320

Function 00007FF7C6B29A90 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

SSL/TLS connection timeout, xrefs: 00007FF7C6B29BEC
select/poll on SSL/TLS socket, errno: %d, xrefs: 00007FF7C6B29BD3

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID:
String ID: SSL/TLS connection timeout$select/poll on SSL/TLS socket, errno: %d
API String ID: 0-3791222319
Opcode ID: d7554ef49e72c6f9b710e2acf5164db086fb836b23ded6c625f006ae02bb2581
Instruction ID: b7ab9da7c801b4b46c4f8f2b8157fd354125ebbfc3e5868d93f8991ce6117fcd
Opcode Fuzzy Hash: d7554ef49e72c6f9b710e2acf5164db086fb836b23ded6c625f006ae02bb2581
Instruction Fuzzy Hash: 8751A662A086C695EB16BF1299C42BBE3D2EF44BB4FA44231DA2D473D5DE3DE441C320

Function 00007FF7C6B05DD0 Relevance: 4.8, APIs: 3, Instructions: 309networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF7C6B061C6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B061E7

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: freerecv
String ID:
API String ID: 2032557106-0
Opcode ID: e924adc48e7e9940488dfba5ccda5745780b454becc98e90148f400d9646db93
Instruction ID: e90e9c2949b028036683cfd1cbf23bdaabfa405b9d7277ac4f1f0726650eb3ac
Opcode Fuzzy Hash: e924adc48e7e9940488dfba5ccda5745780b454becc98e90148f400d9646db93
Instruction Fuzzy Hash: 22C12BB260869245EB26BF259990BBBA790FF447B4FA44235DE5E43BC4EF3CD8418710

Function 00007FF7C6B11EA0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B11F05

Strings

User-Agent: %s, xrefs: 00007FF7C6B11F16
Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF7C6B12044

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 1294909896-3248832348
Opcode ID: c363448362b4baf1fc6f4463642dcf20a9e32e2482c0e09df4d070d1644f846d
Instruction ID: ce1d794459d3b3a80b0e802657d3bee65ba8ed42bad3b68907c973b14e131b51
Opcode Fuzzy Hash: c363448362b4baf1fc6f4463642dcf20a9e32e2482c0e09df4d070d1644f846d
Instruction Fuzzy Hash: 6551B362A0CAC181E7429F24D8943EAA7A1EB85BA8F984135DF4C0B389CF78D481C320

Function 00007FF7C6B15D00 Relevance: 3.0, APIs: 2, Instructions: 23networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF7C6B15D0C
WSAGetLastError.WS2_32 ref: 00007FF7C6B15D1B

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: 324328076e8e3b1bc2712ce39ee4e3af39e15be943e88a303bd45705dc1a1884
Instruction ID: a7a9fac4986df734c7737f05333b11f65be23952d1a3b802643b2e20bea214fb
Opcode Fuzzy Hash: 324328076e8e3b1bc2712ce39ee4e3af39e15be943e88a303bd45705dc1a1884
Instruction Fuzzy Hash: 65E0DF61F0490542FF2A6FB0B8A577A12949B44772F945734CA3F867C0EA2C48D24310

Function 00007FF7C6B165E0 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FF7C6B16623

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 4e6227dd915e3becf5f87fa90cb5f2d97a2c40aa098edc4412a71138ab525d6a
Instruction ID: 930a0df4ce67d11352b1d162af1306e87f77ba488f39ca0139b64be58986d6d6
Opcode Fuzzy Hash: 4e6227dd915e3becf5f87fa90cb5f2d97a2c40aa098edc4412a71138ab525d6a
Instruction Fuzzy Hash: 4001F962B0554282EF56FF2AE5D83BEA791EF88B94FA84030C70D87291DF38D4918710

Function 00007FF7C6B1E100 Relevance: 1.5, APIs: 1, Instructions: 23networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF7C6B1E129

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: f972b5cd3191404c3539d450209f84c52aa91310a77686eb69e13fa3a99b332b
Instruction ID: f7c7ac82e360a8bcd255b3a040596dccf877a09235df0c8876113dbc2af5a770
Opcode Fuzzy Hash: f972b5cd3191404c3539d450209f84c52aa91310a77686eb69e13fa3a99b332b
Instruction Fuzzy Hash: 85E0E575E0250581CE096F2188811A623516B40734FD04370C63D033C0DD2CD2679B10

Function 00007FF7C6B28D60 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B28D7B

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: d369c30ec1556fa0a9e59853e5080838b8299aa6d097239cc50fb2d5d6841df4
Instruction ID: fc44e1206cf75b4d59f3efefd7b9594fdc3c95fbff1fb8065f1419f9c23e0291
Opcode Fuzzy Hash: d369c30ec1556fa0a9e59853e5080838b8299aa6d097239cc50fb2d5d6841df4
Instruction Fuzzy Hash: 01D02B63B18B00839F10DF71AC40069E351B788774B884338AE7D827E4DB3CD1454600

Function 00007FF7C6B24CA0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF7C6B24CB9

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: f49050e3522fa62cfa49c42176f9cbfbe71e0a0f4158500c95ce76ae537b17ff
Instruction ID: 3354551ef6f3819eaf951c6aa25993f097d1ea887ececb9cd70a34188cc5de56
Opcode Fuzzy Hash: f49050e3522fa62cfa49c42176f9cbfbe71e0a0f4158500c95ce76ae537b17ff
Instruction Fuzzy Hash: 3AC08026F14981C2D3446F7158C50C7A771ABC4218FE56435D24F42128DD3CD6E58F50

Non-executed Functions

Function 00007FF7C6B228A0 Relevance: 127.2, APIs: 25, Strings: 47, Instructions: 1229stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B23A63

Part of subcall function 00007FF7C6B15B00: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C6B15C25
Part of subcall function 00007FF7C6B15B00: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C6B15C40

memchr.VCRUNTIME140 ref: 00007FF7C6B23B56
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B23C6E
strchr.VCRUNTIME140 ref: 00007FF7C6B23C82
strchr.VCRUNTIME140 ref: 00007FF7C6B23CAA
strchr.VCRUNTIME140 ref: 00007FF7C6B23CC0

Strings

HTTP error before end of send, keep sending, xrefs: 00007FF7C6B23A89
RTSP/%1d.%1d%c%3d, xrefs: 00007FF7C6B22C2D
HTTP/, xrefs: 00007FF7C6B22BA9
Content-Encoding:, xrefs: 00007FF7C6B232A1
, xrefs: 00007FF7C6B22A8C
Content-Type:, xrefs: 00007FF7C6B22E56
The requested URL returned error: %s, xrefs: 00007FF7C6B23CD7
Lying server, not serving HTTP/2, xrefs: 00007FF7C6B22ABC
Received HTTP/0.9 when not allowed, xrefs: 00007FF7C6B23BCB
Set-Cookie:, xrefs: 00007FF7C6B23433
Proxy-authenticate:, xrefs: 00007FF7C6B23561
Content-Range:, xrefs: 00007FF7C6B2336E
HTTP 1.0, assume close after body, xrefs: 00007FF7C6B22D07
Received 101, xrefs: 00007FF7C6B23D3B
close, xrefs: 00007FF7C6B23033, 00007FF7C6B231B3
WWW-Authenticate:, xrefs: 00007FF7C6B23536
Negotiate: noauthpersist -> %d, header part: %s, xrefs: 00007FF7C6B2362C
Invalid Content-Length: value, xrefs: 00007FF7C6B23D18
Persistent-Auth, xrefs: 00007FF7C6B235D2
HTTP/%1[23] %d, xrefs: 00007FF7C6B22A64
Content-Length:, xrefs: 00007FF7C6B22DAF
HTTP %3d, xrefs: 00007FF7C6B22B08
HTTP/1.0 proxy connection set to keep alive!, xrefs: 00007FF7C6B2322C
Connection closure while negotiating auth (HTTP 1.0?), xrefs: 00007FF7C6B238AC, 00007FF7C6B238F8
Proxy-Connection:, xrefs: 00007FF7C6B22ED3, 00007FF7C6B22FAC
Connection:, xrefs: 00007FF7C6B2306B, 00007FF7C6B23120
The requested URL returned error: %d, xrefs: 00007FF7C6B23E33
Location:, xrefs: 00007FF7C6B2366E
keep-alive, xrefs: 00007FF7C6B22F66, 00007FF7C6B230F6
Transfer-Encoding:, xrefs: 00007FF7C6B231EA
Got 417 while waiting for a 100, xrefs: 00007FF7C6B23A43
HTTP/1.0 connection set to keep alive!, xrefs: 00007FF7C6B2326B
false, xrefs: 00007FF7C6B23610
Retry-After:, xrefs: 00007FF7C6B232E3
Last-Modified:, xrefs: 00007FF7C6B234D7
HTTP, xrefs: 00007FF7C6B23C5E
Overflow Content-Length: value!, xrefs: 00007FF7C6B22E3B
, xrefs: 00007FF7C6B22C42
Mark bundle as not supporting multiuse, xrefs: 00007FF7C6B22ADF
HTTP/1.1 proxy connection set close!, xrefs: 00007FF7C6B2324D
RTSP/, xrefs: 00007FF7C6B22994
HTTP error before end of send, stop sending, xrefs: 00007FF7C6B23AAD
Unsupported HTTP version in response, xrefs: 00007FF7C6B23C41
HTTP/%1d.%1d%c%3d, xrefs: 00007FF7C6B22A39
Maximum file size exceeded, xrefs: 00007FF7C6B23CFF
Keep sending data to get tossed away!, xrefs: 00007FF7C6B23AFC
no chunk, no close, no size. Assume close to signal end, xrefs: 00007FF7C6B23856

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: strchr$fwrite$_strdupmemchrstrncmp
String ID: $ $ HTTP %3d$ HTTP/%1[23] %d$ HTTP/%1d.%1d%c%3d$ RTSP/%1d.%1d%c%3d$Connection closure while negotiating auth (HTTP 1.0?)$Connection:$Content-Encoding:$Content-Length:$Content-Range:$Content-Type:$Got 417 while waiting for a 100$HTTP$HTTP 1.0, assume close after body$HTTP error before end of send, keep sending$HTTP error before end of send, stop sending$HTTP/$HTTP/1.0 connection set to keep alive!$HTTP/1.0 proxy connection set to keep alive!$HTTP/1.1 proxy connection set close!$Invalid Content-Length: value$Keep sending data to get tossed away!$Last-Modified:$Location:$Lying server, not serving HTTP/2$Mark bundle as not supporting multiuse$Maximum file size exceeded$Negotiate: noauthpersist -> %d, header part: %s$Overflow Content-Length: value!$Persistent-Auth$Proxy-Connection:$Proxy-authenticate:$RTSP/$Received 101$Received HTTP/0.9 when not allowed$Retry-After:$Set-Cookie:$The requested URL returned error: %d$The requested URL returned error: %s$Transfer-Encoding:$Unsupported HTTP version in response$WWW-Authenticate:$close$false$keep-alive$no chunk, no close, no size. Assume close to signal end
API String ID: 3939785054-690044944
Opcode ID: f3370703a4f6bdc151d5847669bc0fe1394448bd8426a713a0401e71d96f227b
Instruction ID: 851c4d9241eb1d04737fe593356182966a213c2db0f6cbb44d1f336cd536d13d
Opcode Fuzzy Hash: f3370703a4f6bdc151d5847669bc0fe1394448bd8426a713a0401e71d96f227b
Instruction Fuzzy Hash: F7C29671A08AC344EB56AF259C943FAA7D2EF41BA8FA84135CE4D4B295DE3DE445C330

Function 00007FF7C6B3D230 Relevance: 102.1, APIs: 45, Strings: 13, Instructions: 581COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C6B15B00: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C6B15C25
Part of subcall function 00007FF7C6B15B00: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C6B15C40

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3D2BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3D2F2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3D2FC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3D319
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3D32C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3D335
#22.WLDAP32 ref: 00007FF7C6B3D346
#211.WLDAP32 ref: 00007FF7C6B3D3E0
#217.WLDAP32 ref: 00007FF7C6B3D3FC
#211.WLDAP32 ref: 00007FF7C6B3D415
#211.WLDAP32 ref: 00007FF7C6B3D427
#60.WLDAP32 ref: 00007FF7C6B3D457
#211.WLDAP32 ref: 00007FF7C6B3D572
#60.WLDAP32 ref: 00007FF7C6B3D597
#22.WLDAP32 ref: 00007FF7C6B3D63A
#41.WLDAP32 ref: 00007FF7C6B3DA56
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3DA7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3DA88
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3DAA8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3DABB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3DAC4
#46.WLDAP32 ref: 00007FF7C6B3DAD6

Strings

LDAP local: bind via ldap_win_bind %s, xrefs: 00007FF7C6B3D644
LDAP local: trying to establish %s connection, xrefs: 00007FF7C6B3D379
;binary, xrefs: 00007FF7C6B3D8C0
LDAP remote: %s, xrefs: 00007FF7C6B3D6B7
LDAP local: Cannot connect to %s:%ld, xrefs: 00007FF7C6B3D47B
DN: , xrefs: 00007FF7C6B3D732
LDAP local: LDAP Vendor = %s ; LDAP Version = %d, xrefs: 00007FF7C6B3D264
encrypted, xrefs: 00007FF7C6B3D38E
There are more than %d entries, xrefs: 00007FF7C6B3DA66
cleartext, xrefs: 00007FF7C6B3D36F
Microsoft Corporation., xrefs: 00007FF7C6B3D250
LDAP local: %s, xrefs: 00007FF7C6B3D2A7
LDAP local: %s, xrefs: 00007FF7C6B3D34C

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$#211$fwrite$#217calloc
String ID: ;binary$DN: $LDAP local: %s$LDAP local: %s$LDAP local: Cannot connect to %s:%ld$LDAP local: LDAP Vendor = %s ; LDAP Version = %d$LDAP local: bind via ldap_win_bind %s$LDAP local: trying to establish %s connection$LDAP remote: %s$Microsoft Corporation.$There are more than %d entries$cleartext$encrypted
API String ID: 2742731861-78870445
Opcode ID: 0689907ad93b2cbf2ea7b50545755726dc14f4228ac257b371c216153b9a9f79
Instruction ID: 404ef82968770486e1f60fb1531de7f72f78bc5a4723c1c6b2a1bb04b4ee6ac8
Opcode Fuzzy Hash: 0689907ad93b2cbf2ea7b50545755726dc14f4228ac257b371c216153b9a9f79
Instruction Fuzzy Hash: C4428475B09A4286E712EF6299942BBA3E1FF44BA8FA04535CE0E57B54DF3CE445C320

Function 00007FF7C6AF956D Relevance: 78.0, APIs: 39, Strings: 5, Instructions: 975COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF7C6AF9F6D
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF7C6AF9F74
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFA054
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C6AFA082
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C6AFA090
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFA0CB

Strings

object, xrefs: 00007FF7C6AFA319
array, xrefs: 00007FF7C6AFA18A
object key, xrefs: 00007FF7C6AF9DFF, 00007FF7C6AFA639
object separator, xrefs: 00007FF7C6AF9C73, 00007FF7C6AFA4AA
number overflow parsing ', xrefs: 00007FF7C6AF9F90

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: Xbad_function_call@std@@__std_exception_destroy_invalid_parameter_noinfo_noreturn
String ID: array$number overflow parsing '$object$object key$object separator
API String ID: 1664669839-85532522
Opcode ID: 7e7cc26f319cadff9e1914767a5c4f106141cde28b7ad3b04b6d79b4fb4fe506
Instruction ID: 2bc378f6ae9b08f536b21a309cccc626684284ff782ee561e94b6c0d8518e9f0
Opcode Fuzzy Hash: 7e7cc26f319cadff9e1914767a5c4f106141cde28b7ad3b04b6d79b4fb4fe506
Instruction Fuzzy Hash: 9EA2B572A18B8685EB11AF68D8847EEA361FB417B4F904232DB5D07AD9DF7CD085C312

Function 00007FF7C6B39530 Relevance: 77.4, APIs: 26, Strings: 18, Instructions: 435networkfilepipeCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3957F
WSAStartup.WS2_32 ref: 00007FF7C6B39620
FreeLibrary.KERNEL32 ref: 00007FF7C6B3980D
GetStdHandle.KERNEL32 ref: 00007FF7C6B3981C
GetFileType.KERNEL32 ref: 00007FF7C6B3983D
WaitForMultipleObjects.KERNEL32 ref: 00007FF7C6B39887
PeekNamedPipe.KERNEL32 ref: 00007FF7C6B3990C
ReadFile.KERNEL32 ref: 00007FF7C6B39933
ReadFile.KERNEL32 ref: 00007FF7C6B399ED
WSAGetLastError.WS2_32 ref: 00007FF7C6B39A4E
WSAGetLastError.WS2_32 ref: 00007FF7C6B39C4A
FreeLibrary.KERNEL32 ref: 00007FF7C6B39C6A
GetLastError.KERNEL32 ref: 00007FF7C6B39C74

Part of subcall function 00007FF7C6B3A4A0: send.WS2_32 ref: 00007FF7C6B3A4DD
Part of subcall function 00007FF7C6B3A4A0: WSAGetLastError.WS2_32 ref: 00007FF7C6B3A4E7

Strings

failed to find WSACloseEvent function (%u), xrefs: 00007FF7C6B396FC
insufficient winsock version to support telnet, xrefs: 00007FF7C6B39CAF
WSACreateEvent, xrefs: 00007FF7C6B396B5
FreeLibrary(wsock2) failed (%u), xrefs: 00007FF7C6B39C7A
failed to find WSAEnumNetworkEvents function (%u), xrefs: 00007FF7C6B39770
failed to find WSAEventSelect function (%u), xrefs: 00007FF7C6B39747
WSAEventSelect, xrefs: 00007FF7C6B39721
WS2_32.DLL, xrefs: 00007FF7C6B3966E
WSACreateEvent failed (%d), xrefs: 00007FF7C6B3978E
WSAStartup failed (%d), xrefs: 00007FF7C6B3962D
Time-out, xrefs: 00007FF7C6B39C27
WSACloseEvent failed (%d), xrefs: 00007FF7C6B39C50
failed to load WS2_32.DLL (%u), xrefs: 00007FF7C6B3969B
WSAEnumNetworkEvents failed (%d), xrefs: 00007FF7C6B39A62
WSAEnumNetworkEvents, xrefs: 00007FF7C6B39750
, xrefs: 00007FF7C6B39C12
failed to find WSACreateEvent function (%u), xrefs: 00007FF7C6B396D3
WSACloseEvent, xrefs: 00007FF7C6B396DC

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ErrorLast$File$FreeLibraryRead$HandleMultipleNamedObjectsPeekPipeStartupTypeWaitcallocsend
String ID: $FreeLibrary(wsock2) failed (%u)$Time-out$WS2_32.DLL$WSACloseEvent$WSACloseEvent failed (%d)$WSACreateEvent$WSACreateEvent failed (%d)$WSAEnumNetworkEvents$WSAEnumNetworkEvents failed (%d)$WSAEventSelect$WSAStartup failed (%d)$failed to find WSACloseEvent function (%u)$failed to find WSACreateEvent function (%u)$failed to find WSAEnumNetworkEvents function (%u)$failed to find WSAEventSelect function (%u)$failed to load WS2_32.DLL (%u)$insufficient winsock version to support telnet
API String ID: 1025660337-777782649
Opcode ID: b5036b9a465566e86daaf40098654b2e76120633f17a6724777efe78eb9c801c
Instruction ID: e254a362d279b351bd4f7ae3f97e403b979fe8f7661e9a7c8944181327050b14
Opcode Fuzzy Hash: b5036b9a465566e86daaf40098654b2e76120633f17a6724777efe78eb9c801c
Instruction Fuzzy Hash: 04128471B0CA8285EB66BF1598D43BBA3A0FB44BA4FA44135DA4D47B95EF3CE444C720

Function 00007FF7C6B0F0F0 Relevance: 52.8, APIs: 25, Strings: 5, Instructions: 254stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B0F156
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0F17D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0F1D8

Strings

-----END PUBLIC KEY-----, xrefs: 00007FF7C6B0F3DE
public key hash: sha256//%s, xrefs: 00007FF7C6B0F1EE
sha256//, xrefs: 00007FF7C6B0F14C, 00007FF7C6B0F29E
;sha256//, xrefs: 00007FF7C6B0F250
-----BEGIN PUBLIC KEY-----, xrefs: 00007FF7C6B0F3AA

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: freemallocstrncmp
String ID: public key hash: sha256//%s$-----END PUBLIC KEY-----$-----BEGIN PUBLIC KEY-----$;sha256//$sha256//
API String ID: 1436789207-471711153
Opcode ID: a0c307c9dc367ee8e75ada474a7e892f5db4ff3ed1ef738ebdd65c570ecd3a06
Instruction ID: 7893a95f5de24a73712f96b59f072a9fe8f00f9f1c0f0e417746965166bfbd79
Opcode Fuzzy Hash: a0c307c9dc367ee8e75ada474a7e892f5db4ff3ed1ef738ebdd65c570ecd3a06
Instruction Fuzzy Hash: 4EA18061B0DB4251FA56BF229E906BBEB94AF44BE0FE84431DD4E07795DE3CE4458320

Function 00007FF7C6B46400 Relevance: 52.8, APIs: 17, Strings: 13, Instructions: 253fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7C6B46446

Part of subcall function 00007FF7C6B02650: GetLastError.KERNEL32 ref: 00007FF7C6B0266C
Part of subcall function 00007FF7C6B02650: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B02674

CreateFileA.KERNEL32 ref: 00007FF7C6B464A0
GetLastError.KERNEL32 ref: 00007FF7C6B464B1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B467ED

Strings

schannel: failed to determine size of CA file '%s': %s, xrefs: 00007FF7C6B46512
schannel: did not add any certificates from CA file '%s', xrefs: 00007FF7C6B467B2
schannel: CA file '%s' is not correctly formatted, xrefs: 00007FF7C6B46791
schannel: invalid path name for CA file '%s': %s, xrefs: 00007FF7C6B46460
schannel: failed to extract certificate from CA file '%s': %s, xrefs: 00007FF7C6B46775
-----BEGIN CERTIFICATE-----, xrefs: 00007FF7C6B465EE
schannel: failed to open CA file '%s': %s, xrefs: 00007FF7C6B464CB
schannel: unexpected content type '%d' when extracting certificate from CA file '%s', xrefs: 00007FF7C6B46745
schannel: CA file exceeds max size of %u bytes, xrefs: 00007FF7C6B46549
schannel: added %d certificate(s) from CA file '%s', xrefs: 00007FF7C6B467C3
schannel: failed to add certificate from CA file '%s' to certificate store: %s, xrefs: 00007FF7C6B46726
-----END CERTIFICATE-----, xrefs: 00007FF7C6B46619
schannel: failed to read from CA file '%s': %s, xrefs: 00007FF7C6B466F0

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ErrorLast$CreateFile_errnofree
String ID: -----END CERTIFICATE-----$-----BEGIN CERTIFICATE-----$schannel: CA file '%s' is not correctly formatted$schannel: CA file exceeds max size of %u bytes$schannel: added %d certificate(s) from CA file '%s'$schannel: did not add any certificates from CA file '%s'$schannel: failed to add certificate from CA file '%s' to certificate store: %s$schannel: failed to determine size of CA file '%s': %s$schannel: failed to extract certificate from CA file '%s': %s$schannel: failed to open CA file '%s': %s$schannel: failed to read from CA file '%s': %s$schannel: invalid path name for CA file '%s': %s$schannel: unexpected content type '%d' when extracting certificate from CA file '%s'
API String ID: 1377488173-902404565
Opcode ID: f90c4ea1f86de480e42af28ee71ac03a4a534a8ded7cfb5d8ef4e43eb40f361a
Instruction ID: 16d0505acfae23780684340aa4c5335e96694c98c424d859c7dd2c5710c5a446
Opcode Fuzzy Hash: f90c4ea1f86de480e42af28ee71ac03a4a534a8ded7cfb5d8ef4e43eb40f361a
Instruction Fuzzy Hash: A9B1A571B0CB5282E712AF15EC906BBA7A1BB447A4FE00135DE4D47B99EE3CE905C720

Function 00007FF7C6B13340 Relevance: 51.2, APIs: 21, Strings: 8, Instructions: 401stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7C6B1339A
memset.VCRUNTIME140 ref: 00007FF7C6B133AF
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B133CB
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B133F2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B13469
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B1349C
strchr.VCRUNTIME140 ref: 00007FF7C6B13586
strchr.VCRUNTIME140 ref: 00007FF7C6B135CB
strchr.VCRUNTIME140 ref: 00007FF7C6B135FB
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B136A3

Part of subcall function 00007FF7C6B2BF50: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B104C9,?,?,?,?,00007FF7C6B0F86B), ref: 00007FF7C6B2BF78
Part of subcall function 00007FF7C6B2BF50: GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF7C6B104C9,?,?,?,?,00007FF7C6B0F86B), ref: 00007FF7C6B2BF9E
Part of subcall function 00007FF7C6B2BF50: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B104C9,?,?,?,?,00007FF7C6B0F86B), ref: 00007FF7C6B2BFBF
Part of subcall function 00007FF7C6B2BF50: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B104C9,?,?,?,?,00007FF7C6B0F86B), ref: 00007FF7C6B2BFD0

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B13776
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B137A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B137CB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B137F7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B13805
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B13817
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B139BA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B139C3

Strings

http_proxy, xrefs: 00007FF7C6B136ED
Uses proxy env variable %s == '%s', xrefs: 00007FF7C6B134FC, 00007FF7C6B1375A
NO_PROXY, xrefs: 00007FF7C6B134DD
_proxy, xrefs: 00007FF7C6B136B9
all_proxy, xrefs: 00007FF7C6B13729
ALL_PROXY, xrefs: 00007FF7C6B13740
no_proxy, xrefs: 00007FF7C6B134C1
memory shortage, xrefs: 00007FF7C6B13477

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$strchr$_strdupmemsetreallocstrncpy$EnvironmentVariabletolower
String ID: ALL_PROXY$NO_PROXY$Uses proxy env variable %s == '%s'$_proxy$all_proxy$http_proxy$memory shortage$no_proxy
API String ID: 1339443121-1021110354
Opcode ID: 0f4f60a4e22b7ba1918313b60e17b5f83c2bd4707fb2e44de1f6d5823e6e4a65
Instruction ID: db2e579d5a632e4d75840dd745487240218ebc7143fed17c554b596aec93ce30
Opcode Fuzzy Hash: 0f4f60a4e22b7ba1918313b60e17b5f83c2bd4707fb2e44de1f6d5823e6e4a65
Instruction Fuzzy Hash: ED0294A160DB8295EA52EF11A8947BBE795EF45BA8FA80035DF4D07785EF3CE444C320

Function 00007FF7C6B415C0 Relevance: 42.4, APIs: 21, Strings: 3, Instructions: 425COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B41676
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B41731
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4173F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B41751

Strings

digest_sspi: MakeSignature failed, error 0x%08lx, xrefs: 00007FF7C6B4196B
WDigest, xrefs: 00007FF7C6B41601, 00007FF7C6B41A35
realm, xrefs: 00007FF7C6B418D7

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$malloc
String ID: WDigest$digest_sspi: MakeSignature failed, error 0x%08lx$realm
API String ID: 2190258309-2223379150
Opcode ID: 6b1345334d9f564f0ff2bf6042fbe1b87bba77aa5a73fd6df107e902d6f85eff
Instruction ID: c3c6363f6cf379c925ca8f764f884bf319a8cb6ab546b12715afed75e979f9ec
Opcode Fuzzy Hash: 6b1345334d9f564f0ff2bf6042fbe1b87bba77aa5a73fd6df107e902d6f85eff
Instruction Fuzzy Hash: 0A126F72A09B4686EB16EF21E8942BAB7B4FB44BA4FA40135DE4D43B94DF3CD445C720

Function 00007FF7C6B17640 Relevance: 38.8, APIs: 14, Strings: 8, Instructions: 317stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7C6B17712
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B1772D
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B1776C

Strings

bind failed with errno %d: %s, xrefs: 00007FF7C6B17AF8
Local Interface %s is ip %s using address family %i, xrefs: 00007FF7C6B17827
Couldn't bind to interface '%s', xrefs: 00007FF7C6B178B0
Couldn't bind to '%s', xrefs: 00007FF7C6B17802
Bind to local port %hu failed, trying next, xrefs: 00007FF7C6B17A20
getsockname() failed with errno %d: %s, xrefs: 00007FF7C6B17ABC
Local port: %hu, xrefs: 00007FF7C6B17B15
Name '%s' family %i resolved to '%s' family %i, xrefs: 00007FF7C6B17938

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: strncmp$memset
String ID: Bind to local port %hu failed, trying next$Couldn't bind to '%s'$Couldn't bind to interface '%s'$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$getsockname() failed with errno %d: %s
API String ID: 3268688168-2769131373
Opcode ID: 02d9634179f9ea4199ae5f2a0e46bd02855cafff6c2a787807d4889c898b859b
Instruction ID: e80424094b8b5f51ce316890ddd3a9d7d3572c3a45e93fd09775918f5ea09824
Opcode Fuzzy Hash: 02d9634179f9ea4199ae5f2a0e46bd02855cafff6c2a787807d4889c898b859b
Instruction Fuzzy Hash: 0BE1F5A2A1868296E712EF25DC902FBA361FB857A8FA05132EE4E43755DF3CD544C710

Function 00007FF7C6B2A00C Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 203stringfileCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7C6B2A0A8
strchr.VCRUNTIME140 ref: 00007FF7C6B2A0D4
strchr.VCRUNTIME140 ref: 00007FF7C6B2A10E
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B2A132
strchr.VCRUNTIME140 ref: 00007FF7C6B2A242
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B2A25A
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C6B2A385
fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C6B2A3B1

Strings

CurrentUser, xrefs: 00007FF7C6B2A122
, xrefs: 00007FF7C6B2A00C
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF7C6B2A4E9

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: strchr$_strdupfopenfseekstrncmpstrtol
String ID: $CurrentUser$schannel: Failed to import cert file %s, password is bad
API String ID: 4221717217-4282655970
Opcode ID: d3ea7f085fe27b3ece239ea46b50a530bd08fa1fcbf8dc51fbfeb2fb95be520b
Instruction ID: acfbb08f58bb6b65a8fb06f41c096072c1058105024b8e14b5dedb06d6c0e71d
Opcode Fuzzy Hash: d3ea7f085fe27b3ece239ea46b50a530bd08fa1fcbf8dc51fbfeb2fb95be520b
Instruction Fuzzy Hash: 47817521B09A8281FB5BAF259C942BBA7D5BF45BB4FA54135CA1E463D4EF3CE4448320

Function 00007FF7C6AF974B Relevance: 37.3, APIs: 18, Strings: 3, Instructions: 509COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF7C6AF9F74
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFA054
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C6AFA082
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C6AFA090
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFA0CB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFA10A

Strings

object, xrefs: 00007FF7C6AFA319
array, xrefs: 00007FF7C6AFA18A
number overflow parsing ', xrefs: 00007FF7C6AF9F90

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$Xbad_function_call@std@@
String ID: array$number overflow parsing '$object
API String ID: 958247072-579821726
Opcode ID: 46e6e536bbcafd0d0000e6342fe15be09057148275ef035cd659927c89d41f32
Instruction ID: 43a9d40aea2bdfcf9222e371883d8ae5b4f8741fb3a8ebe613646e4bfa5eea31
Opcode Fuzzy Hash: 46e6e536bbcafd0d0000e6342fe15be09057148275ef035cd659927c89d41f32
Instruction Fuzzy Hash: 8932D672A18B8685EB11AF68D8847EEA361FB447B4F904232DB5D07AD9DF7CD181C312

Function 00007FF7C6B2A015 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202stringfileCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7C6B2A0A8
strchr.VCRUNTIME140 ref: 00007FF7C6B2A0D4
strchr.VCRUNTIME140 ref: 00007FF7C6B2A10E
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B2A132
strchr.VCRUNTIME140 ref: 00007FF7C6B2A242
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B2A25A
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C6B2A385
fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C6B2A3B1

Strings

CurrentUser, xrefs: 00007FF7C6B2A122
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF7C6B2A4E9

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: strchr$_strdupfopenfseekstrncmpstrtol
String ID: CurrentUser$schannel: Failed to import cert file %s, password is bad
API String ID: 4221717217-1887299029
Opcode ID: d7b5c7eb9ba5661f9baf3205433d265340fbabb6b9c56fd145ab9519cb2b58a5
Instruction ID: d5534976f4488e1ab1081cc9f671c7fc077a1c347b2bebc1579eea2ab203a48f
Opcode Fuzzy Hash: d7b5c7eb9ba5661f9baf3205433d265340fbabb6b9c56fd145ab9519cb2b58a5
Instruction Fuzzy Hash: 87818721B09B8281FB5BAF259C902BBA7D5BF45BB4FA54135CA1E463D4EF3CE4448320

Function 00007FF7C6B40590 Relevance: 28.3, APIs: 11, Strings: 5, Instructions: 252fileCOMMON

Download Yara Rule

APIs

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000468,00000470,00000000,?), ref: 00007FF7C6B40623
fgets.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C6B4064D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B40712
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B4071E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B40782
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B4078E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B40891
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4089F
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C6B408AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B408FF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4091E

Strings

password, xrefs: 00007FF7C6B407C9
login, xrefs: 00007FF7C6B407AE
machine, xrefs: 00007FF7C6B407E1, 00007FF7C6B40822
, xrefs: 00007FF7C6B40661, 00007FF7C6B40862
default, xrefs: 00007FF7C6B4083D

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$_strdup$fclosefgetsfopen
String ID: $default$login$machine$password
API String ID: 431015889-155862542
Opcode ID: cdb27248eb866d5918ac3bdb18f5cf2f562d920340b75766c489eb9e99405cde
Instruction ID: ffd3b03651f53d064c0f4f6adb0f67cdcd09819bcf60d8c4ba1fc15aa24872d2
Opcode Fuzzy Hash: cdb27248eb866d5918ac3bdb18f5cf2f562d920340b75766c489eb9e99405cde
Instruction Fuzzy Hash: 1BA17722A0D68285FA67BF119DD037BE7A0AF84764FA84035DE8E06695EE3CE4448770

Function 00007FF7C6B29310 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 78encryptionCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7C6B29350
CryptAcquireContextA.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7C6B292D9), ref: 00007FF7C6B2936F
CryptCreateHash.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7C6B292D9), ref: 00007FF7C6B29399
CryptHashData.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7C6B292D9), ref: 00007FF7C6B293B1
CryptGetHashParam.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7C6B292D9), ref: 00007FF7C6B293D6
CryptGetHashParam.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7C6B292D9), ref: 00007FF7C6B29402
CryptDestroyHash.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7C6B292D9), ref: 00007FF7C6B29412
CryptReleaseContext.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7C6B292D9), ref: 00007FF7C6B29424

Strings

@, xrefs: 00007FF7C6B29365

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyReleasememset
String ID: @
API String ID: 2041421932-2766056989
Opcode ID: 68f1511ba0895ca1697d9704a2837276214123c5548ada05cea98648419bd6b6
Instruction ID: 7cc883c486a91e41024c6d7f20bdd8280f67bc3abc723fecb152a52d3315550a
Opcode Fuzzy Hash: 68f1511ba0895ca1697d9704a2837276214123c5548ada05cea98648419bd6b6
Instruction Fuzzy Hash: 4B316032618A8186EB61EF12E8846ABB7A5FBC4BD0F944035DE9D53B18CF3CD4058B10

Function 00007FF7C6B02650 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7C6B0266C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B02674
FormatMessageA.KERNEL32 ref: 00007FF7C6B026AE
strchr.VCRUNTIME140 ref: 00007FF7C6B026C3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B0270C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B02716
GetLastError.KERNEL32 ref: 00007FF7C6B0271E
SetLastError.KERNEL32 ref: 00007FF7C6B0272A

Strings

Unknown error %u (0x%08X), xrefs: 00007FF7C6B026FA

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchr
String ID: Unknown error %u (0x%08X)
API String ID: 1897771742-1058733786
Opcode ID: 9fedb0d7d3af3a97e6891253ed75ae9845d6f050ae622156b17fff37caed82e4
Instruction ID: 93f0850e2facc3228d48a95b16b3c48c7d63e61e44f47e494d08be1516259939
Opcode Fuzzy Hash: 9fedb0d7d3af3a97e6891253ed75ae9845d6f050ae622156b17fff37caed82e4
Instruction Fuzzy Hash: AD215272A0CF4186EB227F21AC8466BBA91BF55BE0FA84134DE4E03755CE3CD8458760

Function 00007FF7C6B10610 Relevance: 14.3, Strings: 11, Instructions: 540COMMON

Download Yara Rule

Strings

Server doesn't support multiplex (yet), xrefs: 00007FF7C6B1077F
can multiplex, xrefs: 00007FF7C6B10712
Server doesn't support multiplex yet, wait, xrefs: 00007FF7C6B1075B
Found pending candidate for reuse and CURLOPT_PIPEWAIT is set, xrefs: 00007FF7C6B10EDA
Can not multiplex, even if we wanted to!, xrefs: 00007FF7C6B107CA
Could multiplex, but not asked to!, xrefs: 00007FF7C6B107AC
Found bundle for host %s: %p [%s], xrefs: 00007FF7C6B10729
Connection #%ld isn't open enough, can't reuse, xrefs: 00007FF7C6B10876
Multiplexed connection found!, xrefs: 00007FF7C6B10E81
Connection #%ld is still name resolving, can't reuse, xrefs: 00007FF7C6B10851
serially, xrefs: 00007FF7C6B1071E

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID:
String ID: Can not multiplex, even if we wanted to!$Connection #%ld is still name resolving, can't reuse$Connection #%ld isn't open enough, can't reuse$Could multiplex, but not asked to!$Found bundle for host %s: %p [%s]$Found pending candidate for reuse and CURLOPT_PIPEWAIT is set$Multiplexed connection found!$Server doesn't support multiplex (yet)$Server doesn't support multiplex yet, wait$can multiplex$serially
API String ID: 0-2774518510
Opcode ID: 108d231e9b0ecfd79eb15e73a70a1673643fa03d388e674c87f2bf1c4217fc22
Instruction ID: 91ea05cb0915fbd7140302656c852ef0cdc4a9fe5285b27e62d11719b53f1ac6
Opcode Fuzzy Hash: 108d231e9b0ecfd79eb15e73a70a1673643fa03d388e674c87f2bf1c4217fc22
Instruction Fuzzy Hash: 5742FCA2E0C7C665EB67AE2589D03BBB792EF42B64FA44035CE5C47285DF2CA550D320

Function 00007FF7C6B4EF40 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 69encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF7C6B4EF86
CryptCreateHash.ADVAPI32 ref: 00007FF7C6B4EFAA
CryptHashData.ADVAPI32 ref: 00007FF7C6B4EFC6
CryptGetHashParam.ADVAPI32 ref: 00007FF7C6B4EFE5
CryptGetHashParam.ADVAPI32 ref: 00007FF7C6B4F008
CryptDestroyHash.ADVAPI32 ref: 00007FF7C6B4F018
CryptReleaseContext.ADVAPI32 ref: 00007FF7C6B4F02A

Strings

@, xrefs: 00007FF7C6B4EF5D

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyRelease
String ID: @
API String ID: 3606780921-2766056989
Opcode ID: d16ad8696224893bb7e0ab2c235c4043c56a8e101c5a545bdb7ef488e0241bb8
Instruction ID: 1417fee0da3c15aac383cbf5db3c43810aaf70d63236cc1afa91cc5249b994d3
Opcode Fuzzy Hash: d16ad8696224893bb7e0ab2c235c4043c56a8e101c5a545bdb7ef488e0241bb8
Instruction Fuzzy Hash: FE217132618A8186EB619F21F89066BF361FBC9BD4F945136EB8E03A18CF3CD4058B10

Function 00007FF7C6B4FD5C Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7C6B4FD78
memset.VCRUNTIME140 ref: 00007FF7C6B4FD9C
RtlCaptureContext.KERNEL32 ref: 00007FF7C6B4FDA5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7C6B4FDBF
RtlVirtualUnwind.KERNEL32 ref: 00007FF7C6B4FE00
memset.VCRUNTIME140 ref: 00007FF7C6B4FE33
IsDebuggerPresent.KERNEL32 ref: 00007FF7C6B4FE54
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7C6B4FE71
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7C6B4FE7C

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: c01983e5c481f9f09547503f55b265c951c74e6b50128f1ec2919b567a825b7c
Instruction ID: ef6d3a255a4de6d8a8331e6eb8bebdd8fc7188ecd5fed344575540e5b9b5ccce
Opcode Fuzzy Hash: c01983e5c481f9f09547503f55b265c951c74e6b50128f1ec2919b567a825b7c
Instruction Fuzzy Hash: 47313272609B818AEB619F60E8807FE7364FB94754F94403ADA4E47B99DF38D548C720

Function 00007FF7C6B2C5E0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 223COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000021C,-00000008,00000000,?,?,00007FF7C6B2C5D8,?,?,?,?,?,?,00007FF7C6B4381E), ref: 00007FF7C6B2C656
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000021C,-00000008,00000000,?,?,00007FF7C6B2C5D8,?,?,?,?,?,?,00007FF7C6B4381E), ref: 00007FF7C6B2C7BD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B2C91C

Strings

%c%c==, xrefs: 00007FF7C6B2C783
%c%c%c%c, xrefs: 00007FF7C6B2C713
%c%c%c=, xrefs: 00007FF7C6B2C751

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: %c%c%c%c$%c%c%c=$%c%c==
API String ID: 3985033223-3943651191
Opcode ID: 8604cd3025ad8619ec1566aff844c2ae1ecd49f4ce1b17339d39387d1522ed6c
Instruction ID: d1f3ef3cf76f42cb83cdcfc34b2a27a52b340e18177d3ea68a1fa128019feca6
Opcode Fuzzy Hash: 8604cd3025ad8619ec1566aff844c2ae1ecd49f4ce1b17339d39387d1522ed6c
Instruction Fuzzy Hash: 0391DA725086D145E766AF25A8803BBBBE1EB857A4FA84231DA9D477D6CF3CE401C710

Function 00007FF7C6B3B500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3B57E
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3B5DB
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3B603
bind.WS2_32 ref: 00007FF7C6B3B682
WSAGetLastError.WS2_32 ref: 00007FF7C6B3B68C

Strings

bind() failed; %s, xrefs: 00007FF7C6B3B6A7

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: calloc$ErrorLastbind
String ID: bind() failed; %s
API String ID: 2604820300-1141498939
Opcode ID: 0a99961293db57946acbb2008ca3ffa6439d6ceae66a4bfcb54e58bdee2cc82c
Instruction ID: bc2a7243f92005eb2d982eea93e537778f08aa91c5252ee37199b69677e13f82
Opcode Fuzzy Hash: 0a99961293db57946acbb2008ca3ffa6439d6ceae66a4bfcb54e58bdee2cc82c
Instruction Fuzzy Hash: E351E3B2B0978186FB169F21D8A03AAA7A0FB58B54F544039CB4D4B786DF3CE465C720

Function 00007FF7C6B3B760 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 127networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3B7AF
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3B80C
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3B830
bind.WS2_32 ref: 00007FF7C6B3B8AB
WSAGetLastError.WS2_32 ref: 00007FF7C6B3B8B5

Strings

bind() failed; %s, xrefs: 00007FF7C6B3B8D0

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: calloc$ErrorLastbind
String ID: bind() failed; %s
API String ID: 2604820300-1141498939
Opcode ID: 4546c9c1741221ab70847181b3854b762f2d9f92da2a2c3748763456d8589ce7
Instruction ID: e71c8e6485afe843d27fa05a53d965d1f9bee56ff6ce639fd3677c5bcacf08a0
Opcode Fuzzy Hash: 4546c9c1741221ab70847181b3854b762f2d9f92da2a2c3748763456d8589ce7
Instruction Fuzzy Hash: 72518572B0978685EB16AF25D8903BAA3A0FB54BA4F944435CA4D47B89DF3CE4518720

Function 00007FF7C6B253F0 Relevance: 10.1, Strings: 8, Instructions: 72COMMON

Download Yara Rule

Strings

%4I64dk, xrefs: 00007FF7C6B2541E
%4I64dP, xrefs: 00007FF7C6B2550D
%5I64d, xrefs: 00007FF7C6B25405
%2I64d.%0I64dG, xrefs: 00007FF7C6B254AA
%4I64dG, xrefs: 00007FF7C6B254E4
%4I64dT, xrefs: 00007FF7C6B25500
%2I64d.%0I64dM, xrefs: 00007FF7C6B25439
%4I64dM, xrefs: 00007FF7C6B2548C

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID:
String ID: %2I64d.%0I64dG$%2I64d.%0I64dM$%4I64dG$%4I64dM$%4I64dP$%4I64dT$%4I64dk$%5I64d
API String ID: 0-2102732564
Opcode ID: 3a7ffcf822d3cb3019e57f72d68d88a68cde148d5d756179d02c5e660a8321a3
Instruction ID: eaa631bbf0c59c3c80931480336a30e4bd9bcd951f0d7f2caf1dbe50be5506a9
Opcode Fuzzy Hash: 3a7ffcf822d3cb3019e57f72d68d88a68cde148d5d756179d02c5e660a8321a3
Instruction Fuzzy Hash: 4021F942E2998743FE16EF95ED507F6C3A35B447A0FE05032E90E06395EEAC6551C170

Function 00007FF7C6B500F8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,00007FF7C6AF1880), ref: 00007FF7C6B5010E
GetLastError.KERNEL32 ref: 00007FF7C6B50159
IsDebuggerPresent.KERNEL32 ref: 00007FF7C6B50171
OutputDebugStringW.KERNEL32 ref: 00007FF7C6B50182

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF7C6B5017B

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentStringmemset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 1848478996-631824599
Opcode ID: a37a507a167cabab26cb625910c1aa3d311269efda2a165790c6798d0610f60b
Instruction ID: 8957ea190d8b93e08e17dc99cc690e7ca92cff286b1c95b45053325ae8a07486
Opcode Fuzzy Hash: a37a507a167cabab26cb625910c1aa3d311269efda2a165790c6798d0610f60b
Instruction Fuzzy Hash: 14119432618B51A3F745AF22DD813BA72A0FF08364F904139D64D42954DF3CE874C721

Function 00007FF7C6B29240 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF7C6B29271
CryptGenRandom.ADVAPI32 ref: 00007FF7C6B29285
CryptReleaseContext.ADVAPI32 ref: 00007FF7C6B29296
CryptReleaseContext.ADVAPI32 ref: 00007FF7C6B292AC

Strings

@, xrefs: 00007FF7C6B29259

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireRandom
String ID: @
API String ID: 2916321625-2766056989
Opcode ID: 22afdd4626b10894201b54d2bfbd447257d675d4b4211b3f411c4d30c41ff847
Instruction ID: 57655a5f85079ee184fe6a83d6fee18ea3bc275b7f539834df7584909e91be61
Opcode Fuzzy Hash: 22afdd4626b10894201b54d2bfbd447257d675d4b4211b3f411c4d30c41ff847
Instruction Fuzzy Hash: 49F08661B08A8182E7119F52FC94367F360EF887E4FA44031DE8C46668DE7CC4958710

Function 00007FF7C6B19850 Relevance: 8.2, Strings: 6, Instructions: 693COMMON

Download Yara Rule

Strings

(nil), xrefs: 00007FF7C6B1A0B6
.%ld, xrefs: 00007FF7C6B19BB9
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00007FF7C6B19D6B, 00007FF7C6B19DD6
(nil), xrefs: 00007FF7C6B1A034
%ld, xrefs: 00007FF7C6B19B60
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00007FF7C6B19893, 00007FF7C6B19D64, 00007FF7C6B19DCB

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID:
String ID: %ld$(nil)$(nil)$.%ld$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 0-1379995092
Opcode ID: 3426c58fe8f2bcc38a66c58bb7bf67659207d5ddea42e7189d2e36ee902e95c2
Instruction ID: 7f7549c4148feb5e31b3268d418fc4337e8249e30dba6417a52ca363adec8cd5
Opcode Fuzzy Hash: 3426c58fe8f2bcc38a66c58bb7bf67659207d5ddea42e7189d2e36ee902e95c2
Instruction Fuzzy Hash: C84226B3A18AD295E626BE149C8437BE792FF417B4FE00230DE5E476C4DE3CE9458620

Function 00007FF7C6AF1000 Relevance: 6.7, Strings: 5, Instructions: 439COMMON

Download Yara Rule

Strings

loader principal, xrefs: 00007FF7C6AF1569
8117cf7ad254a9a5d0d88f66a496a899a0f91b99fcda9b68c5bcd64eda7e1913, xrefs: 00007FF7C6AF1313
9WIvTVJa9m, xrefs: 00007FF7C6AF154B
https://keyauth.win/api/1.2/, xrefs: 00007FF7C6AF1037
8.3, xrefs: 00007FF7C6AF1205

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID:
String ID: 8.3$8117cf7ad254a9a5d0d88f66a496a899a0f91b99fcda9b68c5bcd64eda7e1913$9WIvTVJa9m$https://keyauth.win/api/1.2/$loader principal
API String ID: 0-3127548271
Opcode ID: 51d82f2a7ed3cc36855e40f17d4037a3cd0e1dbd6b592a9dcfbe4977d79c2e94
Instruction ID: 5a49b211f29b51f4b772a9d09294cf22d7d970ba0b846c153ea94a4ff0cd3896
Opcode Fuzzy Hash: 51d82f2a7ed3cc36855e40f17d4037a3cd0e1dbd6b592a9dcfbe4977d79c2e94
Instruction Fuzzy Hash: 7B123D66D2DB824AF703AF359C411A9E7245FA3794F90D337FD4C31966EF29A281C214

Function 00007FF7C6B4FF74 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7C6B4FFA0
GetCurrentThreadId.KERNEL32 ref: 00007FF7C6B4FFAE
GetCurrentProcessId.KERNEL32 ref: 00007FF7C6B4FFBA
QueryPerformanceCounter.KERNEL32 ref: 00007FF7C6B4FFCA

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: ca13dbfdc0aed70f2debee62da28025ac805b0db45dc3538919d403f8db0eb30
Instruction ID: 239e8ddd1103ab60033d7981ad4a51d187444862f32a25ca4c3c932d64e2c685
Opcode Fuzzy Hash: ca13dbfdc0aed70f2debee62da28025ac805b0db45dc3538919d403f8db0eb30
Instruction Fuzzy Hash: 32117022B15F0189EB00DF60EC942B973B4F719768F840E31DA2D827A8DF38D5548350

Function 00007FF7C6B2C230 Relevance: 6.0, APIs: 4, Instructions: 33encryptionCOMMON

Download Yara Rule

APIs

CryptGetHashParam.ADVAPI32 ref: 00007FF7C6B2C260
CryptGetHashParam.ADVAPI32 ref: 00007FF7C6B2C286
CryptDestroyHash.ADVAPI32 ref: 00007FF7C6B2C295
CryptReleaseContext.ADVAPI32 ref: 00007FF7C6B2C2A5

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: Crypt$Hash$Param$ContextDestroyRelease
String ID:
API String ID: 2110207923-0
Opcode ID: 98c73e5eecba97232b35dfc2bd577e8dbad88d1953aa6f3fea3185f1868f4a8a
Instruction ID: fbe1b930eb087073a6b4f2730941f18dd18135bfc39fbd37275766c2bfe1aac4
Opcode Fuzzy Hash: 98c73e5eecba97232b35dfc2bd577e8dbad88d1953aa6f3fea3185f1868f4a8a
Instruction Fuzzy Hash: 5201757550598182EB51DF60E89436BF371FB84BD4F684532DA4D06A5CCF3CD444CB10

Function 00007FF7C6B2C1D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF7C6B2C1EC
CryptCreateHash.ADVAPI32 ref: 00007FF7C6B2C20D

Strings

@, xrefs: 00007FF7C6B2C1DC

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: Crypt$AcquireContextCreateHash
String ID: @
API String ID: 1914063823-2766056989
Opcode ID: 7ff75605130c25098d949f373cbff0543f7f45f6254b2b0cf2dbdcd9b23ba120
Instruction ID: bd3e1ed14c2cfbcedc7b138bbf7cf9df252be64bb0eba36cce2c2caadf033728
Opcode Fuzzy Hash: 7ff75605130c25098d949f373cbff0543f7f45f6254b2b0cf2dbdcd9b23ba120
Instruction Fuzzy Hash: C3E0D861B14A9243F7715F61E801B57A351FB84788F985031CE4C47A18DF3CC0518B14

Function 00007FF7C6AFDDF0 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF7C6AFDEF4

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: Xbad_function_call@std@@
String ID:
API String ID: 1029415015-0
Opcode ID: 9abcdab0c9bf7d658c3d6ac41191454ed31fc7ea0e1346c092f78b3859dcc7ec
Instruction ID: d24a718ce9b94faf2511fd7553cbab8b6b7edefcc1e088580ca8fe2014978e51
Opcode Fuzzy Hash: 9abcdab0c9bf7d658c3d6ac41191454ed31fc7ea0e1346c092f78b3859dcc7ec
Instruction Fuzzy Hash: 5B81DE62B09B9988EB02DF69D8C4BAD77B0EB15B98F944026DF4D47785DF38D081C362

Function 00007FF7C6AFD260 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25ca6de128e55fb6ce216344201d591ed70013569d8b0f4d9d2315b49ebf49f1
Instruction ID: 2706bb9567ba387f330e24baf76a5e234709d44a4e47e4db38861cd3e0b88d08
Opcode Fuzzy Hash: 25ca6de128e55fb6ce216344201d591ed70013569d8b0f4d9d2315b49ebf49f1
Instruction Fuzzy Hash: B6610472B09B8842DA12EF19E88066EE2A1E7497E4F909336DF5D47788EF3DE0418301

Function 00007FF7C6B4EED0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9bc956564b332abba12e54d0044448655734ddf9d44365f360b093ba55ae5c6
Instruction ID: 5d406a23d55c60adc804c74f64cfd59397caeda6102a7862d6a63abe5d541a2e
Opcode Fuzzy Hash: a9bc956564b332abba12e54d0044448655734ddf9d44365f360b093ba55ae5c6
Instruction Fuzzy Hash: 5BF08C25325767BEFE41893B4624FBD5E419BD0740FB3A874DC84024CB869E5493D714

Function 00007FF7C6B2C220 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5185b321dd6afbbac75ce529b0ea910f156ff02475b330181a162185d0901a5f
Instruction ID: 44e0e4112d89e0cf3bf5feb870d7677613cb5d3d20c1c4decfa31f9e17e642fd
Opcode Fuzzy Hash: 5185b321dd6afbbac75ce529b0ea910f156ff02475b330181a162185d0901a5f
Instruction Fuzzy Hash: 36A02431F05C45C0D3014F00F5D0D115350F7CC7343544033C40C01410CD34C441C300

Function 00007FF7C6B4FF04 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e20d41cd358cfd0be9ac4f11105812a02b3ff54f57f2c67d93f463eba19006a
Instruction ID: e170663dda43fe45bbceaf864d3a9e0be1b494b2f41403a3c71e2ae0cba6ab37
Opcode Fuzzy Hash: 8e20d41cd358cfd0be9ac4f11105812a02b3ff54f57f2c67d93f463eba19006a
Instruction Fuzzy Hash: 99A0012190EC1291E606AF10AE90172A228ABA6360BA100B1D11D420649E2CA900C621

Function 00007FF7C6B29440 Relevance: 145.9, APIs: 50, Strings: 47, Instructions: 399stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7C6B29473
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B294C3
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B294E4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B294FA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B29518
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B29536
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B29554
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B2956C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B29584

Strings

CALG_HMAC, xrefs: 00007FF7C6B298C5
CALG_TLS1PRF, xrefs: 00007FF7C6B298E3
CALG_CYLINK_MEK, xrefs: 00007FF7C6B29799
CALG_DES, xrefs: 00007FF7C6B29613
CALG_SSL3_SHAMD5, xrefs: 00007FF7C6B297B7
CALG_3DES_112, xrefs: 00007FF7C6B29631
CALG_HUGHES_MD5, xrefs: 00007FF7C6B2973F
CALG_RC2, xrefs: 00007FF7C6B2968B
CALG_DH_EPHEM, xrefs: 00007FF7C6B29703
CALG_SHA_256, xrefs: 00007FF7C6B29997
CALG_SHA_512, xrefs: 00007FF7C6B299D3
CALG_TEK, xrefs: 00007FF7C6B2977B
CALG_SCHANNEL_ENC_KEY, xrefs: 00007FF7C6B2982F
CALG_DESX, xrefs: 00007FF7C6B2966D
CALG_AES, xrefs: 00007FF7C6B29979
CALG_SHA1, xrefs: 00007FF7C6B29565
CALG_DSS_SIGN, xrefs: 00007FF7C6B295B9
CALG_DH_SF, xrefs: 00007FF7C6B296E5
CALG_ECDSA, xrefs: 00007FF7C6B29A24
CALG_MD2, xrefs: 00007FF7C6B294F3
CALG_NO_SIGN, xrefs: 00007FF7C6B295D7
CALG_SKIPJACK, xrefs: 00007FF7C6B2975D
CALG_MD5, xrefs: 00007FF7C6B2952F
CALG_AES_192, xrefs: 00007FF7C6B2993D
CALG_SCHANNEL_MASTER_HASH, xrefs: 00007FF7C6B297F3
CALG_TLS1_MASTER, xrefs: 00007FF7C6B29889
CALG_RC4, xrefs: 00007FF7C6B296A9
CALG_SSL2_MASTER, xrefs: 00007FF7C6B2986B
CALG_RSA_KEYX, xrefs: 00007FF7C6B295F5
CALG_AGREEDKEY_ANY, xrefs: 00007FF7C6B29721
CALG_AES_128, xrefs: 00007FF7C6B2991F
CALG_SEAL, xrefs: 00007FF7C6B296C7
CALG_SHA_384, xrefs: 00007FF7C6B299B5
CALG_RC5, xrefs: 00007FF7C6B298A7
CALG_ECDH, xrefs: 00007FF7C6B299EE
CALG_SCHANNEL_MAC_KEY, xrefs: 00007FF7C6B29811
CALG_SSL3_MASTER, xrefs: 00007FF7C6B297D5
CALG_AES_256, xrefs: 00007FF7C6B2995B
CALG_MAC, xrefs: 00007FF7C6B2957D
CALG_ECMQV, xrefs: 00007FF7C6B29A09
CALG_PCT1_MASTER, xrefs: 00007FF7C6B2984D
CALG_ECDH_EPHEM, xrefs: 00007FF7C6B29A3F
CALG_MD4, xrefs: 00007FF7C6B29511
CALG_HASH_REPLACE_OWF, xrefs: 00007FF7C6B29901
CALG_3DES, xrefs: 00007FF7C6B2964F
CALG_RSA_SIGN, xrefs: 00007FF7C6B2959B
CALG_SHA, xrefs: 00007FF7C6B2954D

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: strcmp$strncpy$strchr
String ID: CALG_3DES$CALG_3DES_112$CALG_AES$CALG_AES_128$CALG_AES_192$CALG_AES_256$CALG_AGREEDKEY_ANY$CALG_CYLINK_MEK$CALG_DES$CALG_DESX$CALG_DH_EPHEM$CALG_DH_SF$CALG_DSS_SIGN$CALG_ECDH$CALG_ECDH_EPHEM$CALG_ECDSA$CALG_ECMQV$CALG_HASH_REPLACE_OWF$CALG_HMAC$CALG_HUGHES_MD5$CALG_MAC$CALG_MD2$CALG_MD4$CALG_MD5$CALG_NO_SIGN$CALG_PCT1_MASTER$CALG_RC2$CALG_RC4$CALG_RC5$CALG_RSA_KEYX$CALG_RSA_SIGN$CALG_SCHANNEL_ENC_KEY$CALG_SCHANNEL_MAC_KEY$CALG_SCHANNEL_MASTER_HASH$CALG_SEAL$CALG_SHA$CALG_SHA1$CALG_SHA_256$CALG_SHA_384$CALG_SHA_512$CALG_SKIPJACK$CALG_SSL2_MASTER$CALG_SSL3_MASTER$CALG_SSL3_SHAMD5$CALG_TEK$CALG_TLS1PRF$CALG_TLS1_MASTER
API String ID: 1395212091-3550120021
Opcode ID: c6638b226083fbc1d40d2aaecd0d61c9a3d288133e1ba66680e460eed7e8c79a
Instruction ID: 84325bcd1d0d3eca6ee13746c63d1a15a0052af0f809f11fe053953e6665d7f2
Opcode Fuzzy Hash: c6638b226083fbc1d40d2aaecd0d61c9a3d288133e1ba66680e460eed7e8c79a
Instruction Fuzzy Hash: CB021F10F18A6790FB12BF26DCC11FB939AAF15364FE05032E91E861D9EE5DE945C321

Function 00007FF7C6B36EA0 Relevance: 49.9, APIs: 6, Strings: 27, Instructions: 385COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B36F9D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3709E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B37111
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3718B

Strings

Accept: application/sdp, xrefs: 00007FF7C6B3700A
Transport: %s, xrefs: 00007FF7C6B36FAA
Session: %s, xrefs: 00007FF7C6B3726D
CSeq cannot be set as a custom header., xrefs: 00007FF7C6B371D0
Range, xrefs: 00007FF7C6B37167
%s%s%s%s%s%s%s%s, xrefs: 00007FF7C6B372F6
Accept-Encoding: %s, xrefs: 00007FF7C6B37049
Range: %s, xrefs: 00007FF7C6B37193
Referer: %s, xrefs: 00007FF7C6B37142
Accept, xrefs: 00007FF7C6B36FF8
Referer, xrefs: 00007FF7C6B37127
User-Agent, xrefs: 00007FF7C6B3707E, 00007FF7C6B370AD
%s %s RTSP/1.0CSeq: %ld, xrefs: 00007FF7C6B37237
Content-Type: text/parameters, xrefs: 00007FF7C6B37437
Content-Length: %I64d, xrefs: 00007FF7C6B373F7
Refusing to issue an RTSP request [%s] without a session ID., xrefs: 00007FF7C6B36F23
Accept-Encoding, xrefs: 00007FF7C6B37014
Session, xrefs: 00007FF7C6B371E9
Session ID cannot be set as a custom header., xrefs: 00007FF7C6B371FD
OPTIONS, xrefs: 00007FF7C6B36EA0
Content-Type: application/sdp, xrefs: 00007FF7C6B3746D
CSeq, xrefs: 00007FF7C6B371BC
Content-Length, xrefs: 00007FF7C6B373DC
Failed sending RTSP request, xrefs: 00007FF7C6B37501
Refusing to issue an RTSP SETUP without a Transport: header., xrefs: 00007FF7C6B36FD5
Transport, xrefs: 00007FF7C6B36F4E
Content-Type, xrefs: 00007FF7C6B37423, 00007FF7C6B37459

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: %s %s RTSP/1.0CSeq: %ld$%s%s%s%s%s%s%s%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: application/sdp$CSeq$CSeq cannot be set as a custom header.$Content-Length$Content-Length: %I64d$Content-Type$Content-Type: application/sdp$Content-Type: text/parameters$Failed sending RTSP request$OPTIONS$Range$Range: %s$Referer$Referer: %s$Refusing to issue an RTSP SETUP without a Transport: header.$Refusing to issue an RTSP request [%s] without a session ID.$Session$Session ID cannot be set as a custom header.$Session: %s$Transport$Transport: %s$User-Agent
API String ID: 1294909896-2200874227
Opcode ID: 1460516944042bb9308227133cd4cc98b234a08b6abce689fdae88cd8e3f50c9
Instruction ID: 603ecce7c64eb873d65ceac0e14bd204bfcd27773b575fc87c0840b35561b04b
Opcode Fuzzy Hash: 1460516944042bb9308227133cd4cc98b234a08b6abce689fdae88cd8e3f50c9
Instruction Fuzzy Hash: CA025061B09B8381EA66BF11AD903FBA391EF447A4FA40035DE4D47B99EF3CE5458324

Function 00007FF7C6B125C0 Relevance: 42.6, APIs: 34, Instructions: 121COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B125DD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B125F3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B12607
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1261B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1262F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B12643
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B12657
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1266B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1267F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B12693
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B126A7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B126BB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B126CF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B126E3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B126F7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1270B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1271F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B12733
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B12747
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1275B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1276F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B12783
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B12797
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B127AB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B127BF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B127D3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B127E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B127FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1280F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B12823

Part of subcall function 00007FF7C6B128B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12838), ref: 00007FF7C6B128CB
Part of subcall function 00007FF7C6B128B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12838), ref: 00007FF7C6B128F9

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1284D

Part of subcall function 00007FF7C6B0F060: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12866), ref: 00007FF7C6B0F071
Part of subcall function 00007FF7C6B0F060: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12866), ref: 00007FF7C6B0F081
Part of subcall function 00007FF7C6B0F060: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12866), ref: 00007FF7C6B0F08F
Part of subcall function 00007FF7C6B0F060: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12866), ref: 00007FF7C6B0F09D
Part of subcall function 00007FF7C6B0F060: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12866), ref: 00007FF7C6B0F0AB
Part of subcall function 00007FF7C6B0F060: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12866), ref: 00007FF7C6B0F0B9
Part of subcall function 00007FF7C6B0F060: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12866), ref: 00007FF7C6B0F0C7
Part of subcall function 00007FF7C6B0F060: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12866), ref: 00007FF7C6B0F0D5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B12879
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1288D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1289D

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 7f23fb8e50bdb289686480f1db98f78ad1217920479bba6ddc913f33b4b38986
Instruction ID: 7e0d08749b3cdca4e22ff387691c0167b670aeb583985edf99f9ad91d235dff0
Opcode Fuzzy Hash: 7f23fb8e50bdb289686480f1db98f78ad1217920479bba6ddc913f33b4b38986
Instruction Fuzzy Hash: 7C71DA36549B8181D745AF21ECE42BD73B8FB88FA9F580435CE8E4A718CF3891998331

Function 00007FF7C6AFAE1F Relevance: 37.2, APIs: 18, Strings: 3, Instructions: 459COMMON

Download Yara Rule

APIs

_dclass.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF7C6AFAE27
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFB8E3
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C6AFB911
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C6AFB91F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFB95A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFB999

Strings

object, xrefs: 00007FF7C6AFBBA8
array, xrefs: 00007FF7C6AFBA19
number overflow parsing ', xrefs: 00007FF7C6AFB81F

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$_dclass
String ID: array$number overflow parsing '$object
API String ID: 1391767211-579821726
Opcode ID: b2493920efc5f74b4eb0c064cc97eaf235235165e43134c9cecb89965650008a
Instruction ID: c077ad198bcc8b7fed7bedf09f51620dc7771d1c3b936898f5000447a47995c6
Opcode Fuzzy Hash: b2493920efc5f74b4eb0c064cc97eaf235235165e43134c9cecb89965650008a
Instruction Fuzzy Hash: 0D22B662A18B8585EB12AF68DC847EEA361FB457B4F904332DA5D07AD9DF7CD081C312

Function 00007FF7C6AF98F8 Relevance: 35.4, APIs: 17, Strings: 3, Instructions: 423COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFA054
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C6AFA082
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C6AFA090
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFA0CB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFA10A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFAAFE

Strings

object, xrefs: 00007FF7C6AFA319
array, xrefs: 00007FF7C6AFA18A
number overflow parsing ', xrefs: 00007FF7C6AF9F90

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: array$number overflow parsing '$object
API String ID: 1346393832-579821726
Opcode ID: 1f4ed7fad88823adc4d431026d7ce1f2b5fd20c7b20a39fa217d3ab1924272f7
Instruction ID: a9b0f29ed2c731e79f3cd581e0cc1de1756d875b265e4e763b631eb41f176bf6
Opcode Fuzzy Hash: 1f4ed7fad88823adc4d431026d7ce1f2b5fd20c7b20a39fa217d3ab1924272f7
Instruction Fuzzy Hash: 9812A772A18B8585FB02AF68D8847EEA361EB457B4F905232DB5D03AD9DF7CD481C312

Function 00007FF7C6B0BE10 Relevance: 34.9, APIs: 6, Strings: 17, Instructions: 352COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C6B05740: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B0FD40,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C6B01B71), ref: 00007FF7C6B05767
Part of subcall function 00007FF7C6B05740: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B0FD40,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C6B01B71), ref: 00007FF7C6B05773

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0C0A4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0C0AC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0C0D3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0C0DC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0C160
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0C169

Strings

multipart/form-data, xrefs: 00007FF7C6B0C267
8bit, xrefs: 00007FF7C6B0C2EA
form-data, xrefs: 00007FF7C6B0C316
Content-Disposition: %s%s%s%s%s%s%s, xrefs: 00007FF7C6B0C129
; filename=", xrefs: 00007FF7C6B0C0F1
application/octet-stream, xrefs: 00007FF7C6B0BF36
Content-Type: %s%s%s, xrefs: 00007FF7C6B0C18D
multipart/mixed, xrefs: 00007FF7C6B0BF05
text/plain, xrefs: 00007FF7C6B0BF7C
Content-Transfer-Encoding, xrefs: 00007FF7C6B0C1D1
Content-Transfer-Encoding: %s, xrefs: 00007FF7C6B0C2F1
; name=", xrefs: 00007FF7C6B0C0FF
multipart/, xrefs: 00007FF7C6B0C047
; boundary=, xrefs: 00007FF7C6B0C183
attachment, xrefs: 00007FF7C6B0C05B, 00007FF7C6B0C062
Content-Type, xrefs: 00007FF7C6B0BE98
Content-Disposition, xrefs: 00007FF7C6B0BFD1

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: 8bit$; boundary=$; filename="$; name="$Content-Disposition$Content-Disposition: %s%s%s%s%s%s%s$Content-Transfer-Encoding$Content-Transfer-Encoding: %s$Content-Type$Content-Type: %s%s%s$application/octet-stream$attachment$form-data$multipart/$multipart/form-data$multipart/mixed$text/plain
API String ID: 1294909896-1595554923
Opcode ID: 76973c5dbf1f2b1594ce240694f05987f0450269a87469ae42a615ea591b62f5
Instruction ID: 767a15f95ffa553027100724b7da0ede7a8cc7414e4d99c37a389adc3be911d9
Opcode Fuzzy Hash: 76973c5dbf1f2b1594ce240694f05987f0450269a87469ae42a615ea591b62f5
Instruction Fuzzy Hash: F2E1B7A1B0865291EA66BF119D80ABBEB94FF04BA4FE84435CE4D47691DF3CF855C320

Function 00007FF7C6B24490 Relevance: 33.2, APIs: 6, Strings: 16, Instructions: 206COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B24607

Strings

Authorization: Bearer %s, xrefs: 00007FF7C6B24610
Negotiate, xrefs: 00007FF7C6B244CA
NTLM, xrefs: 00007FF7C6B244EC
%s auth using %s with user '%s', xrefs: 00007FF7C6B247A6
Proxy, xrefs: 00007FF7C6B247B4
Basic, xrefs: 00007FF7C6B24767
Authorization, xrefs: 00007FF7C6B2464A
%s:%s, xrefs: 00007FF7C6B24699
Authorization:, xrefs: 00007FF7C6B245E1
Digest, xrefs: 00007FF7C6B2450E
Proxy-authorization, xrefs: 00007FF7C6B24573
CONNECT, xrefs: 00007FF7C6B2449E
Bearer, xrefs: 00007FF7C6B24600
Proxy-, xrefs: 00007FF7C6B24716
%sAuthorization: Basic %s, xrefs: 00007FF7C6B24720
Server, xrefs: 00007FF7C6B2479C

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: %s auth using %s with user '%s'$%s:%s$%sAuthorization: Basic %s$Authorization$Authorization:$Authorization: Bearer %s$Basic$Bearer$CONNECT$Digest$NTLM$Negotiate$Proxy$Proxy-$Proxy-authorization$Server
API String ID: 1294909896-115817326
Opcode ID: 1a87b3a4d0daf9f280c67c9d4620bcfef2d84e075ff74cb2647e67a9a2055a84
Instruction ID: 24ed7040787f805ab834649decc31d00c4ac695338d28b547433b44c297c3b7f
Opcode Fuzzy Hash: 1a87b3a4d0daf9f280c67c9d4620bcfef2d84e075ff74cb2647e67a9a2055a84
Instruction Fuzzy Hash: DD918361E0DA9381FA62AF15DC803BBE3D1AF417A4FA44031DB5C46AA5EF2CE815C720

Function 00007FF7C6AF6320 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 463COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C6AF4320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7C6AF1B59), ref: 00007FF7C6AF4351

memcpy.VCRUNTIME140 ref: 00007FF7C6AF6496
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7C6AF6528
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7C6AF6569
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF66B3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF66F2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF6740
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF6781
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF67DE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF6898

Part of subcall function 00007FF7C6B4F200: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7C6AF43FE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7C6AF1B59), ref: 00007FF7C6B4F21A

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF68D9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF69A6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF69E7
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C6AF6A0A

Strings

; expected , xrefs: 00007FF7C6AF6930
unexpected , xrefs: 00007FF7C6AF6823
; last read: ', xrefs: 00007FF7C6AF65EC
syntax error , xrefs: 00007FF7C6AF636D
rsing , xrefs: 00007FF7C6AF6478

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$Concurrency::cancel_current_taskmalloc
String ID: ; expected $; last read: '$rsing $syntax error $unexpected
API String ID: 264867259-3075834232
Opcode ID: 681569e9110f3cf91533021d3209a9b5d86d722e2020deb0847d8accf7f25b47
Instruction ID: 12ca016b0c0bcb29b11b5f3cf0bdf0c6dedea1fb6323225dff74d95f756a526e
Opcode Fuzzy Hash: 681569e9110f3cf91533021d3209a9b5d86d722e2020deb0847d8accf7f25b47
Instruction Fuzzy Hash: 4C12E662E08A4241FB12AF64E8803AEA361EB457F8F905731DA6D137E9DF7CD485C312

Function 00007FF7C6B3E250 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 214stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B3E260
strstr.VCRUNTIME140 ref: 00007FF7C6B3E28F
strchr.VCRUNTIME140 ref: 00007FF7C6B3E2BB
strrchr.VCRUNTIME140 ref: 00007FF7C6B3E2D5
strchr.VCRUNTIME140 ref: 00007FF7C6B3E2EA
strrchr.VCRUNTIME140 ref: 00007FF7C6B3E34A

Strings

/, xrefs: 00007FF7C6B3E31E
., xrefs: 00007FF7C6B3E32A
?, xrefs: 00007FF7C6B3E2C8
/, xrefs: 00007FF7C6B3E363
/, xrefs: 00007FF7C6B3E2A5

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: strchrstrrchr$_strdupstrstr
String ID: .$/$/$/$?
API String ID: 2325335452-1821401756
Opcode ID: b967782f6c31181acdf6b71666dafc3d86aa1b8523b8a31ba228f6400cfe0863
Instruction ID: 92a511506e17f2354bfe668539ae4166fad54691ff0b605e5276bb9dd819e1ed
Opcode Fuzzy Hash: b967782f6c31181acdf6b71666dafc3d86aa1b8523b8a31ba228f6400cfe0863
Instruction Fuzzy Hash: 8B818212B0C68645FB676F11998037BDA91AF457A4FE84033EB4D06BD6DE3CE8478321

Function 00007FF7C6B39150 Relevance: 31.7, APIs: 9, Strings: 12, Instructions: 208stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7C6B39223
strchr.VCRUNTIME140 ref: 00007FF7C6B3927A
strchr.VCRUNTIME140 ref: 00007FF7C6B39292
strchr.VCRUNTIME140 ref: 00007FF7C6B392AD
strchr.VCRUNTIME140 ref: 00007FF7C6B39329
strchr.VCRUNTIME140 ref: 00007FF7C6B39341
strchr.VCRUNTIME140 ref: 00007FF7C6B3935C
strchr.VCRUNTIME140 ref: 00007FF7C6B39377
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B39404

Strings

lookup word is missing, xrefs: 00007FF7C6B392C4, 00007FF7C6B3938E
/MATCH:, xrefs: 00007FF7C6B3918A
CLIENT libcurl 7.70.0%sQUIT, xrefs: 00007FF7C6B3925A
/LOOKUP:, xrefs: 00007FF7C6B3920D
/FIND:, xrefs: 00007FF7C6B391C0
/DEFINE:, xrefs: 00007FF7C6B391DB
CLIENT libcurl 7.70.0DEFINE %s %sQUIT, xrefs: 00007FF7C6B3930A
Failed sending DICT request, xrefs: 00007FF7C6B39411
CLIENT libcurl 7.70.0MATCH %s %s %sQUIT, xrefs: 00007FF7C6B393E5
/M:, xrefs: 00007FF7C6B391A5
default, xrefs: 00007FF7C6B392D3, 00007FF7C6B3939D
/D:, xrefs: 00007FF7C6B391F6

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: strchr$free
String ID: /D:$/DEFINE:$/FIND:$/LOOKUP:$/M:$/MATCH:$CLIENT libcurl 7.70.0%sQUIT$CLIENT libcurl 7.70.0DEFINE %s %sQUIT$CLIENT libcurl 7.70.0MATCH %s %s %sQUIT$Failed sending DICT request$default$lookup word is missing
API String ID: 3578582447-31095704
Opcode ID: 5041c680276df84f778b95b197504964f48ae625f4fa473d0a3f368ed1412fd0
Instruction ID: 1b5222fe81232de174239a28b2677417c7324c14e515aa30e7d2218932ac6401
Opcode Fuzzy Hash: 5041c680276df84f778b95b197504964f48ae625f4fa473d0a3f368ed1412fd0
Instruction Fuzzy Hash: 55816051B09A8255FB23BF169DD02BBE295AF45BE4FE84031DD4D07B89EE2CE905C230

Function 00007FF7C6B15180 Relevance: 30.1, APIs: 24, Instructions: 137COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1519C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B151B2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B151C6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B151D3

Part of subcall function 00007FF7C6B0F060: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12866), ref: 00007FF7C6B0F071
Part of subcall function 00007FF7C6B0F060: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12866), ref: 00007FF7C6B0F081
Part of subcall function 00007FF7C6B0F060: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12866), ref: 00007FF7C6B0F08F
Part of subcall function 00007FF7C6B0F060: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12866), ref: 00007FF7C6B0F09D
Part of subcall function 00007FF7C6B0F060: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12866), ref: 00007FF7C6B0F0AB
Part of subcall function 00007FF7C6B0F060: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12866), ref: 00007FF7C6B0F0B9
Part of subcall function 00007FF7C6B0F060: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12866), ref: 00007FF7C6B0F0C7
Part of subcall function 00007FF7C6B0F060: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12866), ref: 00007FF7C6B0F0D5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1520F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B15223
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B15276
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1528A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1529E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B152B2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1531A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1532E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B15342
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B15356
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B153BA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B153FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1540E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B15422
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B15436
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1544A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1545E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B15472
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B15486
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B154A8

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 63d68a645119eee5a229e6f72f9ac658184427547dd01d52b85055deb14d770b
Instruction ID: 1ab8152141fa6dc9b6f9a8fa16deb2bed5780658a85c413b007f29c65cc425e1
Opcode Fuzzy Hash: 63d68a645119eee5a229e6f72f9ac658184427547dd01d52b85055deb14d770b
Instruction Fuzzy Hash: AC91C336619B8193E74A9F31E9A02ADB368FB49F58F540135EF9D47354CF34A2A5C320

Function 00007FF7C6B1E5E0 Relevance: 30.1, APIs: 7, Strings: 10, Instructions: 312stringCOMMON

Download Yara Rule

APIs

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B1E6D5
strchr.VCRUNTIME140 ref: 00007FF7C6B1E775
memcpy.VCRUNTIME140 ref: 00007FF7C6B1E7A5
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7C6B1E7D1
strchr.VCRUNTIME140 ref: 00007FF7C6B1E81C
memcpy.VCRUNTIME140 ref: 00007FF7C6B1E87B

Part of subcall function 00007FF7C6B0AB30: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C6B0AB74

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B1E994

Strings

%255[^:]:%d, xrefs: 00007FF7C6B1E661
:%u, xrefs: 00007FF7C6B1E6E9, 00007FF7C6B1E9A8
RESOLVE %s:%d is wildcard, enabling wildcard checks, xrefs: 00007FF7C6B1EABE
RESOLVE %s:%d is - old addresses discarded!, xrefs: 00007FF7C6B1EA1B
Added %s:%d:%s to DNS cache, xrefs: 00007FF7C6B1EA8D
], xrefs: 00007FF7C6B1E855
@, xrefs: 00007FF7C6B1E866
Couldn't parse CURLOPT_RESOLVE entry '%s'!, xrefs: 00007FF7C6B1E90A
Couldn't parse CURLOPT_RESOLVE removal entry '%s'!, xrefs: 00007FF7C6B1E677
Resolve address '%s' found illegal!, xrefs: 00007FF7C6B1E8FB

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: memcpystrchrtolower$__stdio_common_vsscanfstrtoul
String ID: %255[^:]:%d$:%u$@$Added %s:%d:%s to DNS cache$Couldn't parse CURLOPT_RESOLVE entry '%s'!$Couldn't parse CURLOPT_RESOLVE removal entry '%s'!$RESOLVE %s:%d is - old addresses discarded!$RESOLVE %s:%d is wildcard, enabling wildcard checks$Resolve address '%s' found illegal!$]
API String ID: 1094891576-1753329177
Opcode ID: 9855cb2c72511a74cf4667219b0032907f0413a1880eb49a57276ab234392fc9
Instruction ID: 49e15d460ad084d79a5af792a9f9013e0e8c18dab417d1b44a85b60d5485f11b
Opcode Fuzzy Hash: 9855cb2c72511a74cf4667219b0032907f0413a1880eb49a57276ab234392fc9
Instruction Fuzzy Hash: 0DD1C6A2A1868655EF52AF20D8903FBA7A1FB447A8FE45131EA5D076C5DF3CE403C320

Function 00007FF7C6B14250 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 219COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B14572

Strings

Unsupported proxy scheme for '%s', xrefs: 00007FF7C6B14381
https, xrefs: 00007FF7C6B142D4
socks4a, xrefs: 00007FF7C6B1432B
Unsupported proxy syntax in '%s', xrefs: 00007FF7C6B1455A
http, xrefs: 00007FF7C6B1436E
socks5, xrefs: 00007FF7C6B14310
Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support., xrefs: 00007FF7C6B143B4
socks, xrefs: 00007FF7C6B1435A
socks5h, xrefs: 00007FF7C6B142F2
socks4, xrefs: 00007FF7C6B14346

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support.$Unsupported proxy scheme for '%s'$Unsupported proxy syntax in '%s'$http$https$socks$socks4$socks4a$socks5$socks5h
API String ID: 1294909896-874090715
Opcode ID: 75e85c079a58ae997a5b69c1ed0ff52f4f282083b7077a02fdb8c99a2a87ffe8
Instruction ID: 9cb5e4abaf42d0c9a496656da6e66cfded2a4a1a0589ee57180c9b7c99ff588a
Opcode Fuzzy Hash: 75e85c079a58ae997a5b69c1ed0ff52f4f282083b7077a02fdb8c99a2a87ffe8
Instruction Fuzzy Hash: 39A1B0A2E08A4295FB52EF11EC806BFE7A2AF447B4FA40531DE0E57685DF3CE5458320

Function 00007FF7C6B32E70 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 208stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C6B2C090: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF7C6B1341F), ref: 00007FF7C6B2C0BE

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B32F46
strchr.VCRUNTIME140 ref: 00007FF7C6B32F64
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B32F94
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B32FAF
strchr.VCRUNTIME140 ref: 00007FF7C6B32FD9
strrchr.VCRUNTIME140 ref: 00007FF7C6B32FF5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3301F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3303A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3305E
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B33076
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B330B5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B330F0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B3318C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B331B1

Strings

Request has same path as previous transfer, xrefs: 00007FF7C6B33196
Uploading to a URL without a file name!, xrefs: 00007FF7C6B330DC

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: calloc$free$strchrstrncpy$_strdupmallocstrncmpstrrchr
String ID: Request has same path as previous transfer$Uploading to a URL without a file name!
API String ID: 2243338858-131330169
Opcode ID: b3a4ac8b09e4e9a5b233de32a32e6d3ac76a885cfe56ea72e1d857ff5453744a
Instruction ID: 8010479d3ce8ce667a4393679336fc6613883914fc64255ae51f5de116758bb3
Opcode Fuzzy Hash: b3a4ac8b09e4e9a5b233de32a32e6d3ac76a885cfe56ea72e1d857ff5453744a
Instruction Fuzzy Hash: C691B221B0CBC282EA56AF259C943BBA7A1FF45BA0FA44035DB4D03B94DF3CE4458721

Function 00007FF7C6B0A3B0 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C6B110C9,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B0A413
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C6B110C9,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B0A48D
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C6B110C9,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B0A4B1
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C6B110C9,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B0A500
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C6B110C9,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B0A53A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C6B110C9,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B0A54C
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C6B110C9,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B0A55F
_unlink.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C6B110C9,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B0A57A
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C6B110C9,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B0A590
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C6B110C9,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B0A599

Strings

%s.%s.tmp, xrefs: 00007FF7C6B0A44A
## Fatal libcurl error, xrefs: 00007FF7C6B0A5C7
# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk., xrefs: 00007FF7C6B0A486
%s, xrefs: 00007FF7C6B0A52B

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$fclose$__acrt_iob_func_unlinkcallocfputsqsort
String ID: ## Fatal libcurl error$# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.$%s$%s.%s.tmp
API String ID: 1368378007-4087121635
Opcode ID: 8a75164203880f7a9736100b70e4e29d132958f098c18296687a011a1d238422
Instruction ID: 2e94eb661b55ad5ffc395e1c4c2527ec04bbaeea76686e469dfc5fe563b7ff70
Opcode Fuzzy Hash: 8a75164203880f7a9736100b70e4e29d132958f098c18296687a011a1d238422
Instruction Fuzzy Hash: 0C519695A0D64245FE67BF259C945BBA7A0BF45BE4FE44832CE0E47395EE3CE8058320

Function 00007FF7C6B01D20 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 134COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7C6B01D48
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B01D50

Strings

No error, xrefs: 00007FF7C6B021A0
CRYPT_E_REVOKED, xrefs: 00007FF7C6B02182
SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log., xrefs: 00007FF7C6B02259
Unknown error, xrefs: 00007FF7C6B02240
%s - %s, xrefs: 00007FF7C6B022A9
%s (0x%08X), xrefs: 00007FF7C6B01DA5
SEC_I_CONTINUE_NEEDED, xrefs: 00007FF7C6B021AC

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X)$%s - %s$CRYPT_E_REVOKED$No error$SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.$SEC_I_CONTINUE_NEEDED$Unknown error
API String ID: 3939687465-1752685260
Opcode ID: 996476a16fdb7b757634cd92fc0324816bbaa6d74c777c4711c300f7cad16cd4
Instruction ID: 1a41f683997aad45c8e6b9644823104d07bba04ec3b38c4a387ade183347b17e
Opcode Fuzzy Hash: 996476a16fdb7b757634cd92fc0324816bbaa6d74c777c4711c300f7cad16cd4
Instruction Fuzzy Hash: 6A5196B2A1CA8185F766BF60AC847FBBB54BF44760FE44135DA4D02799DF3CE5448620

Function 00007FF7C6B26450 Relevance: 27.3, APIs: 1, Strings: 17, Instructions: 341COMMON

Download Yara Rule

Strings

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client., xrefs: 00007FF7C6B269BD
SOCKS4 connection to %s not supported, xrefs: 00007FF7C6B2671C
SOCKS4 reply has wrong version, version should be 0., xrefs: 00007FF7C6B268F1
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids., xrefs: 00007FF7C6B26983
SOCKS4 non-blocking resolve of %s, xrefs: 00007FF7C6B265BB
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed., xrefs: 00007FF7C6B269F4
[, xrefs: 00007FF7C6B269E4
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown., xrefs: 00007FF7C6B26956
SOCKS4 communication to %s:%d, xrefs: 00007FF7C6B2652F
SOCKS4%s request granted., xrefs: 00007FF7C6B26A16
SOCKS4: Failed receiving connect request ack: %s, xrefs: 00007FF7C6B268AA
SOCKS4%s: connecting to HTTP proxy %s port %d, xrefs: 00007FF7C6B26516
Failed to send SOCKS4 connect request., xrefs: 00007FF7C6B267FD
SOCKS4 connect to IPv4 %s (locally resolved), xrefs: 00007FF7C6B266BA
SOCKS4: too long host name, xrefs: 00007FF7C6B26816
Too long SOCKS proxy name, can't use!, xrefs: 00007FF7C6B26617
Failed to resolve "%s" for SOCKS4 connect., xrefs: 00007FF7C6B2673B

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID:
String ID: Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.$Failed to resolve "%s" for SOCKS4 connect.$Failed to send SOCKS4 connect request.$SOCKS4 communication to %s:%d$SOCKS4 connect to IPv4 %s (locally resolved)$SOCKS4 connection to %s not supported$SOCKS4 non-blocking resolve of %s$SOCKS4 reply has wrong version, version should be 0.$SOCKS4%s request granted.$SOCKS4%s: connecting to HTTP proxy %s port %d$SOCKS4: Failed receiving connect request ack: %s$SOCKS4: too long host name$Too long SOCKS proxy name, can't use!$[
API String ID: 0-3760664348
Opcode ID: 5104825338d0cdea13c01cd4bdbe34f1d0d79774103135f047a496fccebd302e
Instruction ID: ace0e428a56acb304ff8e477c59af33fc8444f6d0af50acdbe8aae890adc457f
Opcode Fuzzy Hash: 5104825338d0cdea13c01cd4bdbe34f1d0d79774103135f047a496fccebd302e
Instruction Fuzzy Hash: 38E106A2A0C6C28AE716AF14D8903BAF791EB457A4FE44036DA4D4779ADF3CE445C720

Function 00007FF7C6AF5480 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 364COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF55DE
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C6AF560C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C6AF561A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF5654
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF56A5
memset.VCRUNTIME140 ref: 00007FF7C6AF54D3

Part of subcall function 00007FF7C6AF4320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7C6AF1B59), ref: 00007FF7C6AF4351

Part of subcall function 00007FF7C6AF6320: memcpy.VCRUNTIME140 ref: 00007FF7C6AF6496

Part of subcall function 00007FF7C6AF1FC0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2131

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF5812
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C6AF583E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C6AF584C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF5887
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF58DA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF59C1
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF7C6AF59D9
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF7C6AF59E6

Strings

value, xrefs: 00007FF7C6AF5546, 00007FF7C6AF577E

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy$?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@U?$char_traits@memset
String ID: value
API String ID: 2102519606-494360628
Opcode ID: 212eaa806b408234beea592c696e162d7d58ef07ed93274ac4811775d32c4503
Instruction ID: b783da0b6e0e22a407dea060c35f473a2619d50900a7f4f92316d8cdebff1dfb
Opcode Fuzzy Hash: 212eaa806b408234beea592c696e162d7d58ef07ed93274ac4811775d32c4503
Instruction Fuzzy Hash: 0FF10C22A18B8145EB11EF74D8C03AEA760EB557B4F945332EAAD03AE9DF3CD185C711

Function 00007FF7C6B2B1F0 Relevance: 26.5, APIs: 4, Strings: 11, Instructions: 241encryptionCOMMON

Download Yara Rule

APIs

CertEnumCertificatesInStore.CRYPT32 ref: 00007FF7C6B2B4D7
CertEnumCertificatesInStore.CRYPT32 ref: 00007FF7C6B2B547
CertFreeCertificateContext.CRYPT32 ref: 00007FF7C6B2B585
CertFreeCertificateContext.CRYPT32 ref: 00007FF7C6B2B598

Strings

schannel: failed to retrieve remote cert context, xrefs: 00007FF7C6B2B5B7
schannel: ALPN, server accepted to use %.*s, xrefs: 00007FF7C6B2B338
schannel: failed to retrieve ALPN result, xrefs: 00007FF7C6B2B30B
schannel: failed to store credential handle, xrefs: 00007FF7C6B2B43C
http/1.1, xrefs: 00007FF7C6B2B34B
ALPN, server did not agree to a protocol, xrefs: 00007FF7C6B2B365
schannel: failed to setup replay detection, xrefs: 00007FF7C6B2B266
schannel: failed to setup memory allocation, xrefs: 00007FF7C6B2B2A1
schannel: failed to setup confidentiality, xrefs: 00007FF7C6B2B282
schannel: failed to setup stream orientation, xrefs: 00007FF7C6B2B2C0
schannel: failed to setup sequence detection, xrefs: 00007FF7C6B2B24A

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: Cert$CertificateCertificatesContextEnumFreeStore
String ID: ALPN, server did not agree to a protocol$http/1.1$schannel: ALPN, server accepted to use %.*s$schannel: failed to retrieve ALPN result$schannel: failed to retrieve remote cert context$schannel: failed to setup confidentiality$schannel: failed to setup memory allocation$schannel: failed to setup replay detection$schannel: failed to setup sequence detection$schannel: failed to setup stream orientation$schannel: failed to store credential handle
API String ID: 2572311694-3353508759
Opcode ID: be51b479731baa59df06fcb17954e5d96151e4cbd4409d62adb9ebc0cc2fb318
Instruction ID: 7c714bc9df8d79395d50315ee1f34d57e561d4e6153e57dd4183ec95eeb8a2f1
Opcode Fuzzy Hash: be51b479731baa59df06fcb17954e5d96151e4cbd4409d62adb9ebc0cc2fb318
Instruction Fuzzy Hash: B6B1A661A08A8785EB22AF15DC903BBA3A2FB84BA8FE45131D94D47795DF3CD445C720

Function 00007FF7C6B4D010 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF7C6B3FD3F), ref: 00007FF7C6B4D03D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,0000000100000000,?,00007FF7C6B3FD3F), ref: 00007FF7C6B4D05F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF7C6B3FD3F), ref: 00007FF7C6B4D070
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF7C6B3FD3F), ref: 00007FF7C6B4D09E

Strings

/./, xrefs: 00007FF7C6B4D12C
/.., xrefs: 00007FF7C6B4D1A2
/../, xrefs: 00007FF7C6B4D16B
../, xrefs: 00007FF7C6B4D109

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: ../$/..$/../$/./
API String ID: 111713529-456519384
Opcode ID: 25aba189d591fad9c09b359039caed4889bc1031a689abac331ba899d59c98a5
Instruction ID: d788d24ec8fda2d36a84047277d2e17bf93f5a5e813e51be2d122f7840e5e8d2
Opcode Fuzzy Hash: 25aba189d591fad9c09b359039caed4889bc1031a689abac331ba899d59c98a5
Instruction Fuzzy Hash: 5D71A421E0DA9241FB23AF11999027FEBE0AB56BB4FA44131DE9D076D5DE3CE452C321

Function 00007FF7C6B0F4E0 Relevance: 25.7, APIs: 17, Instructions: 236COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B0F544
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B0F578
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0F589
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0F65F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0F66C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0F6A7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0F6B1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B0F72F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B0F750
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B0F771
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B0F792
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0F829
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0F832

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$_strdup
String ID:
API String ID: 2653869212-0
Opcode ID: ae6858fb2bc527840b5c47873fc601b7387336615e4aa4b393686c4a92e7ad02
Instruction ID: 8e09fc3053f0b2db173c230027742823c1ef5a0ef2687fb8787c9e624fdc91e7
Opcode Fuzzy Hash: ae6858fb2bc527840b5c47873fc601b7387336615e4aa4b393686c4a92e7ad02
Instruction Fuzzy Hash: 2EB19076B0AB4186EA56EF15EA9077AB7A8FB44B64FA44535CF8D03750DF3CE0648320

Function 00007FF7C6B3EDAC Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3EEFD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B3EF4E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F00A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B3F018
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B3F070
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B3F07D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F0FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F10B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F171
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F17F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F1CE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F1E6

Strings

%%%02x, xrefs: 00007FF7C6B3EFB3

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$_strdupmalloctolower
String ID: %%%02x
API String ID: 1244608590-4020994737
Opcode ID: 9a51fdc22e7649cb4e37cca42ccbba968de429cf8ce6afeec69dd974948d042c
Instruction ID: a2e9a6786be290b2d9d710da417059082645abd680b0ac07e457bce5ec78f4e2
Opcode Fuzzy Hash: 9a51fdc22e7649cb4e37cca42ccbba968de429cf8ce6afeec69dd974948d042c
Instruction Fuzzy Hash: 2DA1F751B0D69245FB636F25AC9037BEBE49F45BA4FA84432EE8D06AC5DE3DE4058330

Function 00007FF7C6B2D090 Relevance: 22.8, APIs: 1, Strings: 14, Instructions: 321COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF7C6B2D0E8

Strings

LIST, xrefs: 00007FF7C6B2D2CC
FETCH, xrefs: 00007FF7C6B2D25C, 00007FF7C6B2D372
Unexpected continuation response, xrefs: 00007FF7C6B2D52E
SEARCH, xrefs: 00007FF7C6B2D1FC, 00007FF7C6B2D3CF
UID, xrefs: 00007FF7C6B2D417
LSUB, xrefs: 00007FF7C6B2D3FF
SELECT, xrefs: 00007FF7C6B2D39F
NOOP, xrefs: 00007FF7C6B2D42F
EXAMINE, xrefs: 00007FF7C6B2D3B7
STORE, xrefs: 00007FF7C6B2D31A
PREA, xrefs: 00007FF7C6B2D124
CAPABILITY, xrefs: 00007FF7C6B2D4B0
EXPUNGE, xrefs: 00007FF7C6B2D3E7
, xrefs: 00007FF7C6B2D0F1

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: memcmp
String ID: $CAPABILITY$EXAMINE$EXPUNGE$FETCH$LIST$LSUB$NOOP$PREA$SEARCH$SELECT$STORE$UID$Unexpected continuation response
API String ID: 1475443563-555813803
Opcode ID: 43d4a7d53fc91c344c6fb80503302cc3e45757a2c26751e674f420fc26e1f43e
Instruction ID: 127d4dc254363ad472f3947db04267cb879d8ebba2b5e5c465b1821ff9ec6f38
Opcode Fuzzy Hash: 43d4a7d53fc91c344c6fb80503302cc3e45757a2c26751e674f420fc26e1f43e
Instruction Fuzzy Hash: ECD16C61A0C2D281FB23BF21DDD42BAE7D2AF41B74FE44031DA6D465C9EE6CF9418221

Function 00007FF7C6B288C0 Relevance: 22.7, APIs: 15, Instructions: 160COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00000000,?,00007FF7C6B28B76), ref: 00007FF7C6B288DB
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B288FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B2891C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B28925

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$_strdupmalloc
String ID:
API String ID: 111713529-0
Opcode ID: 33e32469901d868d54f0742555583773a0ee8b0c23115a78cd45b38b0365ed59
Instruction ID: 37339cddfd8e95ebef7a789172c8f0975b3f331fc5818c91f05f54f90d167a31
Opcode Fuzzy Hash: 33e32469901d868d54f0742555583773a0ee8b0c23115a78cd45b38b0365ed59
Instruction Fuzzy Hash: 2F616F76A05B4182E72ADF16E89452AB3B5FB48BA0F954435CF8D43750EF3CE499C320

Function 00007FF7C6AFA7B2 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C6AF4320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7C6AF1B59), ref: 00007FF7C6AF4351

Part of subcall function 00007FF7C6AF6320: memcpy.VCRUNTIME140 ref: 00007FF7C6AF6496

Part of subcall function 00007FF7C6AF1FC0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2131

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFA861
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C6AFA88F
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C6AFA89D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFA8D7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFA934
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFA9ED
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C6AFAA1B
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C6AFAA29
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFAA63
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFAAB4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFAAFE

Strings

value, xrefs: 00007FF7C6AFA7D0, 00007FF7C6AFA959

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy
String ID: value
API String ID: 3212548336-494360628
Opcode ID: ca1a7c664972658af4e72ecff27744bafd40ca8814dd7ba25f4a0be1551a9646
Instruction ID: 56d83a489df45d72b781fd3f946833a24e8b8225c3984b062a3e19a3e32ba580
Opcode Fuzzy Hash: ca1a7c664972658af4e72ecff27744bafd40ca8814dd7ba25f4a0be1551a9646
Instruction Fuzzy Hash: 4EA18562A18A8585FB02AF68D8843EEA361FB417B4F905332D76D03AD9DF7CD485C711

Function 00007FF7C6AFC041 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C6AF4320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7C6AF1B59), ref: 00007FF7C6AF4351

Part of subcall function 00007FF7C6AF6320: memcpy.VCRUNTIME140 ref: 00007FF7C6AF6496

Part of subcall function 00007FF7C6AF1FC0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2131

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFC0F0
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C6AFC11E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C6AFC12C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFC166
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFC1C3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFC27C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C6AFC2AA
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C6AFC2B8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFC2F2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFC343
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFC38D

Strings

value, xrefs: 00007FF7C6AFC05F, 00007FF7C6AFC1E8

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy
String ID: value
API String ID: 3212548336-494360628
Opcode ID: 2ae01c7248f21c85381e2bc165409ee9508d7d72018b3a13af0be01f97419271
Instruction ID: 2dade0875ca81ae2bb9ce371d69fad1a04079b7710ee52c464297bf82bfc6f2e
Opcode Fuzzy Hash: 2ae01c7248f21c85381e2bc165409ee9508d7d72018b3a13af0be01f97419271
Instruction Fuzzy Hash: 92A19662A18A4591EB12AF79D8843AFA361FB457F4F901332EA6D03AD9DF7CD081C711

Function 00007FF7C6B0A020 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 161fileCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0A08D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B0A0AD
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C6B0A0E1
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C6B0A102
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0A125
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0A136
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C6B0A158
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0A20F
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C6B0A224

Strings

ignoring failed cookie_init for %s, xrefs: 00007FF7C6B0A162
Set-Cookie:, xrefs: 00007FF7C6B0A196
none, xrefs: 00007FF7C6B0A0A2

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: fclosefree$__acrt_iob_func_strdupcallocfopenmalloc
String ID: Set-Cookie:$ignoring failed cookie_init for %s$none
API String ID: 4109794434-4095489131
Opcode ID: bd0c26f5ce277e0cb1565db72479c5a29d2517adef0a962083b71e4b91484b1f
Instruction ID: 76e51014fad5d70ab7ddb07e388f23764cb7d18f1c3da147eaaa4e4a41bc1d50
Opcode Fuzzy Hash: bd0c26f5ce277e0cb1565db72479c5a29d2517adef0a962083b71e4b91484b1f
Instruction Fuzzy Hash: 2D61E861A0C79281EA56BF119C946BBAB94BF46BA4FE44835DE8D07786DF3DE4018320

Function 00007FF7C6B02510 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 88stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7C6B02532
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B0253A
__sys_nerr.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B02559
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B02565
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B02574
strrchr.VCRUNTIME140 ref: 00007FF7C6B025C5
strrchr.VCRUNTIME140 ref: 00007FF7C6B025E6
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B025FF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B0260A
GetLastError.KERNEL32 ref: 00007FF7C6B02613
SetLastError.KERNEL32 ref: 00007FF7C6B0261F

Strings

Unknown error %d (%#x), xrefs: 00007FF7C6B025A7

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ErrorLast_errno$strrchr$__sys_nerrstrerrorstrncpy
String ID: Unknown error %d (%#x)
API String ID: 4262108436-2414550090
Opcode ID: 1b6d7002f8ec9be3989094d60eb279298e085d666b44f39d5629790a2a2cc6c3
Instruction ID: 4c4f67caa5d5774a3d2b1dbb801cb225032e13b0b3db4b0aa12b43e8bf79572f
Opcode Fuzzy Hash: 1b6d7002f8ec9be3989094d60eb279298e085d666b44f39d5629790a2a2cc6c3
Instruction Fuzzy Hash: 1D316775A0CF4285EA177F11AC5027BE691AF84BA0FE84035DE4E47799DE3CE8458724

Function 00007FF7C6B46820 Relevance: 19.7, APIs: 5, Strings: 8, Instructions: 165COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B468D3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B46939
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4695C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B469BC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B46A2C

Strings

%2d Subject: %s, xrefs: 00007FF7C6B46924
Version: %lu (0x%lx), xrefs: 00007FF7C6B46A3E
Issuer, xrefs: 00007FF7C6B46990
TRUE, xrefs: 00007FF7C6B46A91
Issuer: %s, xrefs: 00007FF7C6B469AA
%lx, xrefs: 00007FF7C6B469FC
Subject, xrefs: 00007FF7C6B4690A
Version, xrefs: 00007FF7C6B46A17

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$malloc
String ID: Issuer: %s$ Version: %lu (0x%lx)$%2d Subject: %s$%lx$Issuer$Subject$TRUE$Version
API String ID: 2190258309-1457932261
Opcode ID: 679274a64fabadd1525217bb7a819fc24d39843eadd0618bb0cd5e037560db0f
Instruction ID: d016b0f55b0034cac6b3bb4afb2b5bd20416ee8c1b9984dc6b2ffcf67748d64a
Opcode Fuzzy Hash: 679274a64fabadd1525217bb7a819fc24d39843eadd0618bb0cd5e037560db0f
Instruction Fuzzy Hash: D961DF61A08B8295EB17AF25AC843FBA3A1BB497A4FD40536DE5D07395EF3CE145C320

Function 00007FF7C6B39D30 Relevance: 19.7, APIs: 4, Strings: 9, Instructions: 151stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7C6B39D9B
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B39EC5

Part of subcall function 00007FF7C6B05740: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B0FD40,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C6B01B71), ref: 00007FF7C6B05767
Part of subcall function 00007FF7C6B05740: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B0FD40,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C6B01B71), ref: 00007FF7C6B05773

strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B39E7F

Part of subcall function 00007FF7C6B056A0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B056B0

Strings

XDISPLOC, xrefs: 00007FF7C6B39E9B
%127[^= ]%*[ =]%255s, xrefs: 00007FF7C6B39E40
BINARY, xrefs: 00007FF7C6B39F6E
Syntax error in telnet option: %s, xrefs: 00007FF7C6B39FD6
Unknown telnet option %s, xrefs: 00007FF7C6B39FBD
NEW_ENV, xrefs: 00007FF7C6B39EE1
%hu%*[xX]%hu, xrefs: 00007FF7C6B39F49
USER,%s, xrefs: 00007FF7C6B39DC0
TTYPE, xrefs: 00007FF7C6B39E55

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: freestrncpy$_strdupmemset
String ID: %127[^= ]%*[ =]%255s$%hu%*[xX]%hu$BINARY$NEW_ENV$Syntax error in telnet option: %s$TTYPE$USER,%s$Unknown telnet option %s$XDISPLOC
API String ID: 3826632026-748038847
Opcode ID: 674dc07791ba67edafa3c176e3fcb0c64f3425ca4b7d81903a291a38ec61196b
Instruction ID: 6075c4ddd41c6033435fcad89144cb1a68d39aa55c50a5575a745d41cb4f739a
Opcode Fuzzy Hash: 674dc07791ba67edafa3c176e3fcb0c64f3425ca4b7d81903a291a38ec61196b
Instruction Fuzzy Hash: FB717272A08AC690FB22BF14D8917EAA361FF447A4FE44032EA4C47659EF7CE545C760

Function 00007FF7C6B3C5B3 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 290COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3C6B3

Strings

TFTP file name too long, xrefs: 00007FF7C6B3C69F
blksize, xrefs: 00007FF7C6B3C888
%I64d, xrefs: 00007FF7C6B3C746
%s%c%s%c, xrefs: 00007FF7C6B3C6CA
TFTP buffer too small for options, xrefs: 00007FF7C6B3C7AF, 00007FF7C6B3C8F8
tsize, xrefs: 00007FF7C6B3C7C2
timeout, xrefs: 00007FF7C6B3C975

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: %I64d$%s%c%s%c$TFTP buffer too small for options$TFTP file name too long$blksize$timeout$tsize
API String ID: 1294909896-3837278924
Opcode ID: c2a8d9bc3566ba6658ec7e9e16decf70996880172bc91a59586f4cc2d88ccd36
Instruction ID: 8968163c14b5519e6be292ee089dac2d575c62ce4279f0227bd7c5e53b4a98ed
Opcode Fuzzy Hash: c2a8d9bc3566ba6658ec7e9e16decf70996880172bc91a59586f4cc2d88ccd36
Instruction Fuzzy Hash: 02D1A3B2A08A8595EB12DF54D8803FAB7A1FB45BA8FD58132CA4D47789DF3CE505C320

Function 00007FF7C6B3A860 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 180networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF7C6B3AA5C
WSAGetLastError.WS2_32 ref: 00007FF7C6B3AA6E
send.WS2_32 ref: 00007FF7C6B3AB66
WSAGetLastError.WS2_32 ref: 00007FF7C6B3AB70

Strings

%c%s%c%s, xrefs: 00007FF7C6B3AA00
Sending data failed (%d), xrefs: 00007FF7C6B3AA74, 00007FF7C6B3AB76
%c%c, xrefs: 00007FF7C6B3AA38
%127[^,],%127s, xrefs: 00007FF7C6B3A9C8
%c%c%c%c, xrefs: 00007FF7C6B3A93D
#, xrefs: 00007FF7C6B3AADE
%c%c%c%c%s%c%c, xrefs: 00007FF7C6B3AB3F

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ErrorLastsend
String ID: #$%127[^,],%127s$%c%c$%c%c%c%c$%c%c%c%c%s%c%c$%c%s%c%s$Sending data failed (%d)
API String ID: 1802528911-931584821
Opcode ID: 3f3c0e14104c9c455343b1e5a6a9cc495e61addf1ec5cb99437c4972f1cd1d42
Instruction ID: d2f9049f24812cb7da29d377306a0c20486221e4a5a90984abae11df729ca7d2
Opcode Fuzzy Hash: 3f3c0e14104c9c455343b1e5a6a9cc495e61addf1ec5cb99437c4972f1cd1d42
Instruction Fuzzy Hash: 1191A032A08AC595F722AF14E8857EAB3A1FB447A8FA40231EE4D07B99DF3DD145C750

Function 00007FF7C6B3C210 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

sendto.WS2_32 ref: 00007FF7C6B3C388
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7C6B3C3A3
sendto.WS2_32 ref: 00007FF7C6B3C40A
sendto.WS2_32 ref: 00007FF7C6B3C4C1
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7C6B3C4F9

Strings

Received unexpected DATA packet block %d, expecting block %d, xrefs: 00007FF7C6B3C501
tftp_rx: internal error, xrefs: 00007FF7C6B3C25E
Timeout waiting for block %d ACK. Retries = %d, xrefs: 00007FF7C6B3C282
Received last DATA packet block %d again., xrefs: 00007FF7C6B3C455

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: sendto$_time64
String ID: Received last DATA packet block %d again.$Received unexpected DATA packet block %d, expecting block %d$Timeout waiting for block %d ACK. Retries = %d$tftp_rx: internal error
API String ID: 2327272419-1785996722
Opcode ID: e3732d0b93bb19e09cf262a8cad43c4f17ebab75b872b84d052a19873f4a98a7
Instruction ID: de13c6bcfae1cfcb54fa493c7e732ca9f22d334412a27209bd68c872189ef3e3
Opcode Fuzzy Hash: e3732d0b93bb19e09cf262a8cad43c4f17ebab75b872b84d052a19873f4a98a7
Instruction Fuzzy Hash: 2F917F76608B91C5D752DF69D8903AA7BB0FB88F98FA48132CA4C87758DF39E405C720

Function 00007FF7C6B13E00 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 151stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B13E3D
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B13EBF
strchr.VCRUNTIME140 ref: 00007FF7C6B13F3E
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7C6B13F6C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B13F8D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B13F9F

Strings

Invalid IPv6 address format, xrefs: 00007FF7C6B13F27
Please URL encode %% as %%25, see RFC 6874., xrefs: 00007FF7C6B13EC9
No valid port number in connect to host string (%s), xrefs: 00007FF7C6B13FCB
%25, xrefs: 00007FF7C6B13EB5

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdup$freestrchrstrncmpstrtol
String ID: %25$Invalid IPv6 address format$No valid port number in connect to host string (%s)$Please URL encode %% as %%25, see RFC 6874.
API String ID: 2070079882-2404041592
Opcode ID: debb9cbe67e4ce08a2adc9a87cbca493d478b4be1e97d8ad2dbd124df42e0210
Instruction ID: 5b4a3491cc834d7ccb49ca19252f3078a3fd38b81d21f5df4b227f521a0a2e82
Opcode Fuzzy Hash: debb9cbe67e4ce08a2adc9a87cbca493d478b4be1e97d8ad2dbd124df42e0210
Instruction Fuzzy Hash: 4A51D7A2A0CA8255FB17AF159CE037BE7E29F017B4FE84031DB5D46285EE2CD9498330

Function 00007FF7C6B09E10 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 143fileCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B09E4E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B09E6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C6B09EA0
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C6B09EBD
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B09EDB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B09EEC
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C6B09F0C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C6B04060), ref: 00007FF7C6B09FBF
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C6B04060), ref: 00007FF7C6B09FD5

Strings

Set-Cookie:, xrefs: 00007FF7C6B09F46
none, xrefs: 00007FF7C6B09E63

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: fclosefree$__acrt_iob_func_strdupcallocfopenmalloc
String ID: Set-Cookie:$none
API String ID: 4109794434-3629594122
Opcode ID: 2559565615f75e872a23b3981e19a338178d3ae41847a2ca8639f390b78a122e
Instruction ID: 980af20b0d60fd7c2c43844b04fc5b9df1c70d52f28d84fb0af5d1639d3bb55c
Opcode Fuzzy Hash: 2559565615f75e872a23b3981e19a338178d3ae41847a2ca8639f390b78a122e
Instruction Fuzzy Hash: 7951C571A0D78241EA57BF216C906BBEA94BF45BA0FA85434EE8E02795DF3CF4458360

Function 00007FF7C6B145A0 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 280stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C6B15580: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B15594
Part of subcall function 00007FF7C6B15580: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B155AA
Part of subcall function 00007FF7C6B15580: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B155BE
Part of subcall function 00007FF7C6B15580: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B155D2
Part of subcall function 00007FF7C6B15580: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B155E6
Part of subcall function 00007FF7C6B15580: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B155FA
Part of subcall function 00007FF7C6B15580: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B1560E
Part of subcall function 00007FF7C6B15580: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B15622

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B14622

Part of subcall function 00007FF7C6B3E550: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B145C5,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B3E565
Part of subcall function 00007FF7C6B3E550: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C6B145C5,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B3E57F
Part of subcall function 00007FF7C6B3E550: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C6B145C5,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B3E59A
Part of subcall function 00007FF7C6B3E550: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C6B145C5,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B3E5B6
Part of subcall function 00007FF7C6B3E550: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C6B145C5,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B3E5D2
Part of subcall function 00007FF7C6B3E550: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C6B145C5,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B3E5EA
Part of subcall function 00007FF7C6B3E550: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C6B145C5,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B3E602
Part of subcall function 00007FF7C6B3E550: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C6B145C5,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B3E61A
Part of subcall function 00007FF7C6B3E550: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C6B145C5,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B3E632
Part of subcall function 00007FF7C6B3E550: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C6B145C5,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B3E64A
Part of subcall function 00007FF7C6B3E550: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B145C5,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B3E664

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B14826
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B14869
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7C6B149AE
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B14A2B

Strings

%s://%s, xrefs: 00007FF7C6B1462F
file, xrefs: 00007FF7C6B14913, 00007FF7C6B1498C
Protocol "%s" not supported or disabled in libcurl, xrefs: 00007FF7C6B1476F

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdup$free$callocstrtoul
String ID: %s://%s$Protocol "%s" not supported or disabled in libcurl$file
API String ID: 954404409-4150109901
Opcode ID: 004503c188ee4edbed2bd51cd85fcc3ed88f1461e75f2590a85f4103d467888a
Instruction ID: 57ca2415a2a1bdd96339d482e9826afa8b8acb187c0c2b2368c66d7993d8aea0
Opcode Fuzzy Hash: 004503c188ee4edbed2bd51cd85fcc3ed88f1461e75f2590a85f4103d467888a
Instruction Fuzzy Hash: ACC1B571B08A82A6E76AAF219D903FBE392FF41764FA40031DB0E47685DF3CE5158360

Function 00007FF7C6AF1FC0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C6AF2380: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2479
Part of subcall function 00007FF7C6AF2380: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF24B8

Part of subcall function 00007FF7C6AF4320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7C6AF1B59), ref: 00007FF7C6AF4351

Part of subcall function 00007FF7C6AF3BC0: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF7C6AF1D9B), ref: 00007FF7C6AF3C06

Part of subcall function 00007FF7C6AF5DE0: memcpy.VCRUNTIME140(?,?,?,00007FF7C6AF1DCA), ref: 00007FF7C6AF5E71

Part of subcall function 00007FF7C6AF3C40: memcpy.VCRUNTIME140 ref: 00007FF7C6AF3C93

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2131
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2181
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF21D2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2212
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2264
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF22A3
__std_exception_copy.VCRUNTIME140 ref: 00007FF7C6AF22F6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2347

Strings

parse_error, xrefs: 00007FF7C6AF2021
parse error, xrefs: 00007FF7C6AF204B

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$__std_exception_copy
String ID: parse error$parse_error
API String ID: 2484256320-1820534363
Opcode ID: f6db5a2a85e65c04b4e6264418e38fc3126cec19b6e4bffa546920b7765f5f69
Instruction ID: 2470d1f9dddc68a270f0b64ebf873391086568807d6171aa9d3aa37cb8dc9cf7
Opcode Fuzzy Hash: f6db5a2a85e65c04b4e6264418e38fc3126cec19b6e4bffa546920b7765f5f69
Instruction Fuzzy Hash: 3BB1A472A18B4585FB01DFA4E8843AEB761EB447B8F904631DA6D03AD9DF78D4C1C315

Function 00007FF7C6B1E170 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 178COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1E201
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1E248
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1E2E4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1E2FA
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1E31B
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B1E36A
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7C6B1E3BA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1E3EF

Strings

:%u, xrefs: 00007FF7C6B1E37E
Shuffling %i addresses, xrefs: 00007FF7C6B1E1EA

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$malloc$_time64calloctolower
String ID: :%u$Shuffling %i addresses
API String ID: 133842801-338667637
Opcode ID: 0702af2af3f196c8d20e00abf42593937647d18646336b64643bf238862f3385
Instruction ID: 9ac51b0a1882bef00f3abd58d7fd49800fd86d887dad5bc95323b2f052255bfc
Opcode Fuzzy Hash: 0702af2af3f196c8d20e00abf42593937647d18646336b64643bf238862f3385
Instruction Fuzzy Hash: 7771C7B2609A4291EB269F15E9907BAB3A1FB48BA4FA44531DE4D07794DF3CD447C320

Function 00007FF7C6B1BDE0 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 162COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1BE5A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B1BE75
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B1BEF2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1BF7C

Strings

Issue another request to this URL: '%s', xrefs: 00007FF7C6B1BF87
Switch to %s, xrefs: 00007FF7C6B1C007
GET, xrefs: 00007FF7C6B1BFEE
Switch from POST to GET, xrefs: 00007FF7C6B1C046
HEAD, xrefs: 00007FF7C6B1BFE7
Maximum (%ld) redirects followed, xrefs: 00007FF7C6B1BF47

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdupfree
String ID: GET$HEAD$Issue another request to this URL: '%s'$Maximum (%ld) redirects followed$Switch from POST to GET$Switch to %s
API String ID: 1865132094-1312055526
Opcode ID: 6760984aca948949d66b32f5f9485da7c0c849f7fe45f1c064fdaf187ec0f9f0
Instruction ID: 3508cf9daaa750a7177a8e59eab916abbf0b56a27ec38be3646c953e2ef46d3f
Opcode Fuzzy Hash: 6760984aca948949d66b32f5f9485da7c0c849f7fe45f1c064fdaf187ec0f9f0
Instruction Fuzzy Hash: FE71CBA2A0878291E762AF249CC43BFB792EB45764FB80531DE4D476A9CF3DE4418370

Function 00007FF7C6B10F80 Relevance: 17.6, APIs: 14, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B10FFD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B1101A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B1102E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B1104A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B11067
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B1108A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B1109E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B110B2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B110D8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B110EC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B11100
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B1114F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B1115C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B11185

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b125c0dcb1cced1098072d61f7b2a99d18854b559aceea61bf68af76a93310ed
Instruction ID: c12ba4fca1ff55a818f11a28bc6d8a148c7c7e871f25ed675e9eb7d977540a64
Opcode Fuzzy Hash: b125c0dcb1cced1098072d61f7b2a99d18854b559aceea61bf68af76a93310ed
Instruction Fuzzy Hash: B1510072949A8291EB05BF21DDD02FEA3A1FF84FA4F984431DE4E4B655CE39D0558330

Function 00007FF7C6B4B690 Relevance: 16.8, APIs: 2, Strings: 9, Instructions: 279COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4BB5B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4BBB3

Strings

NTLM, xrefs: 00007FF7C6B4B919
DIGEST-MD5, xrefs: 00007FF7C6B4B8C3
LOGIN, xrefs: 00007FF7C6B4BAD3
CRAM-MD5, xrefs: 00007FF7C6B4B8E2
EXTERNAL, xrefs: 00007FF7C6B4B7AB
XOAUTH2, xrefs: 00007FF7C6B4BA15
PLAIN, xrefs: 00007FF7C6B4BA6A
GSSAPI, xrefs: 00007FF7C6B4B826
OAUTHBEARER, xrefs: 00007FF7C6B4B9A2

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: CRAM-MD5$DIGEST-MD5$EXTERNAL$GSSAPI$LOGIN$NTLM$OAUTHBEARER$PLAIN$XOAUTH2
API String ID: 1294909896-1896214517
Opcode ID: 088b1764f1675d027530671198399332db7741212e8d5f4d33ad60c77c110d88
Instruction ID: fd9390facb98b9d5421d2379c743f7301621da5645e51fdf80752a2c2ed5ff0f
Opcode Fuzzy Hash: 088b1764f1675d027530671198399332db7741212e8d5f4d33ad60c77c110d88
Instruction Fuzzy Hash: 52D14F62A09B8285EB629F14E8803BAB7A0FB84764FA40135EF8D07799DF3CD545C724

Function 00007FF7C6B2D6C0 Relevance: 16.7, APIs: 5, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C6B2C090: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF7C6B1341F), ref: 00007FF7C6B2C0BE

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B2D95E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B2D968
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B2D9C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B2D9CD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B2D9DA

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_, xrefs: 00007FF7C6B2D6C8
PARTIAL, xrefs: 00007FF7C6B2D916
MAILINDEX, xrefs: 00007FF7C6B2D897
UID, xrefs: 00007FF7C6B2D856
UIDVALIDITY, xrefs: 00007FF7C6B2D815
SECTION, xrefs: 00007FF7C6B2D8D8

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$malloc
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_$MAILINDEX$PARTIAL$SECTION$UID$UIDVALIDITY
API String ID: 2190258309-1670639106
Opcode ID: dd336f9b21a50bfe83e251d22c4f888fa1fa7a1fd64b3b8a709d42049e239f78
Instruction ID: 7b75e5ca51beac790eddabec72c6a20d98b07619c36266cf30b4ef625449850e
Opcode Fuzzy Hash: dd336f9b21a50bfe83e251d22c4f888fa1fa7a1fd64b3b8a709d42049e239f78
Instruction Fuzzy Hash: 52A19922909AC285EB56AF21DC903BAABD1FF447A8FA41031EF4E47695DF3CD494C360

Function 00007FF7C6B3F201 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F10B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F171
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F17F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F27D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F2E6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F2FE

Part of subcall function 00007FF7C6B3E250: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B3E260

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F326
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F33D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F362
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F3AF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F3C4

Part of subcall function 00007FF7C6B3F500: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B3E532,?,?,00000000,00007FF7C6B1563B,?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B3F50C
Part of subcall function 00007FF7C6B3F500: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B3E532,?,?,00000000,00007FF7C6B1563B,?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B3F516
Part of subcall function 00007FF7C6B3F500: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B3E532,?,?,00000000,00007FF7C6B1563B,?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B3F520
Part of subcall function 00007FF7C6B3F500: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B3E532,?,?,00000000,00007FF7C6B1563B,?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B3F52A
Part of subcall function 00007FF7C6B3F500: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B3E532,?,?,00000000,00007FF7C6B1563B,?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B3F534
Part of subcall function 00007FF7C6B3F500: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B3E532,?,?,00000000,00007FF7C6B1563B,?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B3F53E
Part of subcall function 00007FF7C6B3F500: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B3E532,?,?,00000000,00007FF7C6B1563B,?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B3F548
Part of subcall function 00007FF7C6B3F500: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B3E532,?,?,00000000,00007FF7C6B1563B,?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B3F552
Part of subcall function 00007FF7C6B3F500: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B3E532,?,?,00000000,00007FF7C6B1563B,?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B3F55C
Part of subcall function 00007FF7C6B3F500: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B3E532,?,?,00000000,00007FF7C6B1563B,?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B3F566
Part of subcall function 00007FF7C6B3F500: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B3E532,?,?,00000000,00007FF7C6B1563B,?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B3F570

Strings

,, xrefs: 00007FF7C6B3F244
:, xrefs: 00007FF7C6B3F227

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$calloc$_strdup
String ID: ,$:
API String ID: 2460172880-4193410690
Opcode ID: a9cb188337b75a0d8002d0befce217b96f21f835fd8d67b6d5d8bd556de6835e
Instruction ID: 6651863798b0686151f4645cad2ec8ef681f025bedfabe349e5bf59af911b68a
Opcode Fuzzy Hash: a9cb188337b75a0d8002d0befce217b96f21f835fd8d67b6d5d8bd556de6835e
Instruction Fuzzy Hash: 22519512F0CB8682F722AF359D512BAA364BF55B98F549231DE8D02A52EF7CF5C48310

Function 00007FF7C6B3E550 Relevance: 16.6, APIs: 11, Instructions: 89COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B145C5,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B3E565
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C6B145C5,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B3E57F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C6B145C5,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B3E59A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C6B145C5,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B3E5B6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C6B145C5,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B3E5D2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C6B145C5,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B3E5EA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C6B145C5,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B3E602
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C6B145C5,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B3E61A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C6B145C5,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B3E632
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C6B145C5,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B3E64A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B145C5,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B3E664

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdup$callocfree
String ID:
API String ID: 1183638330-0
Opcode ID: 4f546bfc0f45f73248b767b21d7e2ba0d5fd4c55c77560dae1898e45a6adef0b
Instruction ID: f581fa4cda7d634273d53526b05d5a4cbdebb768ddaf30063038d9e53f119bbf
Opcode Fuzzy Hash: 4f546bfc0f45f73248b767b21d7e2ba0d5fd4c55c77560dae1898e45a6adef0b
Instruction Fuzzy Hash: 1831C365B07B0282EE5BEF55A99023563A0FF44B60B680537DB5D06B84EF3CE4668370

Function 00007FF7C6B345A0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 117COMMON

Download Yara Rule

Strings

LIST, xrefs: 00007FF7C6B346A2
%s%s%s, xrefs: 00007FF7C6B346C5
Got a %03d response code instead of the assumed 200, xrefs: 00007FF7C6B345E0
NLST, xrefs: 00007FF7C6B3469B
Couldn't set desired mode, xrefs: 00007FF7C6B345BE

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID:
String ID: %s%s%s$Couldn't set desired mode$Got a %03d response code instead of the assumed 200$LIST$NLST
API String ID: 0-1262176364
Opcode ID: f167d171461c8f7548907506495cdfe2ff8bdf8577a3a8452fcccba9e155b09d
Instruction ID: 5dd330c3c37c64454349ab89b6b7cfe280a39c782fd22b727a67ce499014ee23
Opcode Fuzzy Hash: f167d171461c8f7548907506495cdfe2ff8bdf8577a3a8452fcccba9e155b09d
Instruction Fuzzy Hash: 7E41B262B08692C5EA26BF55ECD02BBF361EF45BA0FE40031DA4D07A55DF7CE8488720

Function 00007FF7C6B184B0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 112stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF7C6B2451A), ref: 00007FF7C6B1852F
strchr.VCRUNTIME140(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF7C6B2451A), ref: 00007FF7C6B18581
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF7C6B2451A), ref: 00007FF7C6B185A5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF7C6B2451A), ref: 00007FF7C6B185F5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF7C6B2451A), ref: 00007FF7C6B18638

Strings

%sAuthorization: Digest %s, xrefs: 00007FF7C6B18615
Digest, xrefs: 00007FF7C6B184BB
%.*s, xrefs: 00007FF7C6B1858E
Proxy-, xrefs: 00007FF7C6B1860B

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$_strdupstrchr
String ID: %.*s$%sAuthorization: Digest %s$Digest$Proxy-
API String ID: 153040452-3976116069
Opcode ID: af563775dae173b5eda1726b76d9899620c6e50140443a5ea409bdbaa995f40f
Instruction ID: 6c6321b07f6e58cba3d772ca33aac7e572ef6072e544e5ed7382f0196054c342
Opcode Fuzzy Hash: af563775dae173b5eda1726b76d9899620c6e50140443a5ea409bdbaa995f40f
Instruction Fuzzy Hash: 2641A222608B8592E626AF01EC843EBB7A1FB45BA4FA40435DE8D47794DF3CD556C320

Function 00007FF7C6B475DE Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 103COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B47612
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47B09
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47BD2

Strings

TRUE, xrefs: 00007FF7C6B47600
Expire Date, xrefs: 00007FF7C6B47ADD
FALSE, xrefs: 00007FF7C6B47607
Public Key Algorithm, xrefs: 00007FF7C6B47B88
Public Key Algorithm: %s, xrefs: 00007FF7C6B47BA2
Expire Date: %s, xrefs: 00007FF7C6B47AF7

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$_strdup
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$FALSE$Public Key Algorithm$TRUE
API String ID: 2653869212-571364039
Opcode ID: 4bee1d14d20f14659009e7b503d95a7d589d47a1eb9661179bde68ceda9f2995
Instruction ID: c1a06dc2ca29c9a1b0ecb97fca784992a071f00126cc7b67a222705858bbef82
Opcode Fuzzy Hash: 4bee1d14d20f14659009e7b503d95a7d589d47a1eb9661179bde68ceda9f2995
Instruction Fuzzy Hash: 5441B561A08B8299EB13AF659C941FBA761BF097A8FD40432DE4D17359DF3CE545C320

Function 00007FF7C6B01E9A Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7C6B01DF9
strchr.VCRUNTIME140 ref: 00007FF7C6B01E20
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B022BF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B022CA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B022D5
GetLastError.KERNEL32 ref: 00007FF7C6B022DE
SetLastError.KERNEL32 ref: 00007FF7C6B022EA

Strings

SEC_E_CERT_UNKNOWN, xrefs: 00007FF7C6B01E9A
%s - %s, xrefs: 00007FF7C6B022A9
%s (0x%08X), xrefs: 00007FF7C6B01DA5

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CERT_UNKNOWN
API String ID: 600764987-1381340633
Opcode ID: 4d5d58b4797318de8e31fe63f63c0defbb14bb1eef9867fbca58c728e94aa3f3
Instruction ID: a945456cd8ea20fc324cf7ee3101ddc51eb70bd54385731b6766211974db0423
Opcode Fuzzy Hash: 4d5d58b4797318de8e31fe63f63c0defbb14bb1eef9867fbca58c728e94aa3f3
Instruction Fuzzy Hash: 96315072A1CBC185E762AF60A8847EBF7A4FB84750FD40535DA8D02A99DF3CD548C720

Function 00007FF7C6B01E52 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7C6B01DF9
strchr.VCRUNTIME140 ref: 00007FF7C6B01E20
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B022BF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B022CA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B022D5
GetLastError.KERNEL32 ref: 00007FF7C6B022DE
SetLastError.KERNEL32 ref: 00007FF7C6B022EA

Strings

SEC_E_BAD_BINDINGS, xrefs: 00007FF7C6B01E52
%s - %s, xrefs: 00007FF7C6B022A9
%s (0x%08X), xrefs: 00007FF7C6B01DA5

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BAD_BINDINGS
API String ID: 600764987-2710416593
Opcode ID: 92d10316be32a5829c3cbf56bc01aed1e14150d39f769f291ac9b2730cea536f
Instruction ID: 844917127ac409ac6a0c9a7258eaf805b57499b477310ac2d81b86bf289418b6
Opcode Fuzzy Hash: 92d10316be32a5829c3cbf56bc01aed1e14150d39f769f291ac9b2730cea536f
Instruction Fuzzy Hash: 20315072A1CBC185E762AF60A8847EBB7A4FB84750FD40535DA9D02A99DF3CD548C720

Function 00007FF7C6B01D9E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 69stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7C6B01DF9
strchr.VCRUNTIME140 ref: 00007FF7C6B01E20
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B022BF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B022CA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B022D5
GetLastError.KERNEL32 ref: 00007FF7C6B022DE
SetLastError.KERNEL32 ref: 00007FF7C6B022EA

Strings

SEC_E_ALGORITHM_MISMATCH, xrefs: 00007FF7C6B01D9E
%s - %s, xrefs: 00007FF7C6B022A9
%s (0x%08X), xrefs: 00007FF7C6B01DA5

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_ALGORITHM_MISMATCH
API String ID: 600764987-618797061
Opcode ID: 58401fb4617b5da9bb1c3176d9fd143e54ef5645a1d96d77b2671eb36125a02d
Instruction ID: 2ffa2540e89d83bb2514c50f820e169ae511bb2458642f022819d5f30f8c97bb
Opcode Fuzzy Hash: 58401fb4617b5da9bb1c3176d9fd143e54ef5645a1d96d77b2671eb36125a02d
Instruction Fuzzy Hash: 70316072A1CBC185EB22AF60A8847EBB7A0FB84750F940535DA8D02A99DF3CD548C720

Function 00007FF7C6B377C0 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 168COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B37A18

Part of subcall function 00007FF7C6B15850: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,FFFFFFFF,00007FF7C6B21665,?,?,00000000,00007FF7C6B219C5), ref: 00007FF7C6B15865
Part of subcall function 00007FF7C6B15850: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,FFFFFFFF,00007FF7C6B21665,?,?,00000000,00007FF7C6B219C5), ref: 00007FF7C6B1587B

memcpy.VCRUNTIME140 ref: 00007FF7C6B37838
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B37989
memcpy.VCRUNTIME140 ref: 00007FF7C6B37A52
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B37A5E

Strings

Cannot pause RTP, xrefs: 00007FF7C6B3795C
Got an error writing an RTP packet, xrefs: 00007FF7C6B3796B
Failed writing RTP data, xrefs: 00007FF7C6B37953

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$memcpy$realloc
String ID: Cannot pause RTP$Failed writing RTP data$Got an error writing an RTP packet
API String ID: 657767516-1165944077
Opcode ID: 26fe400beb3e9e83a4688baf9b32cedffa00cab4403fb91f9c12d8844b60f580
Instruction ID: 90f9333c8d8418c7697a20814a32446fa3c24dbfa24d58dbc45b7bb5ebb1f6e8
Opcode Fuzzy Hash: 26fe400beb3e9e83a4688baf9b32cedffa00cab4403fb91f9c12d8844b60f580
Instruction Fuzzy Hash: A0719332B09B8596E64AEF25D8803AAB7A4FB49BA0FA44135DF5D47B41DF3CE460C310

Function 00007FF7C6AF7409 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

invalid number; expected '+', '-', or digit after exponent, xrefs: 00007FF7C6AF7957
invalid number; expected digit after '.', xrefs: 00007FF7C6AF77A7

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID:
String ID: invalid number; expected '+', '-', or digit after exponent$invalid number; expected digit after '.'
API String ID: 0-808606891
Opcode ID: 518a1156ab026f808f693d747ab388ca07ff88a2534ac0a06eb909e01f5d2ffc
Instruction ID: 938ebbd4a5d6b33827a4960938292b55842337ee3deefadc9285ce32b1ae73f7
Opcode Fuzzy Hash: 518a1156ab026f808f693d747ab388ca07ff88a2534ac0a06eb909e01f5d2ffc
Instruction Fuzzy Hash: BAB18062508A4185E7269F68E8C0A7EB761FB15B68FE44537C64E032D9DF3CE885C363

Function 00007FF7C6B4E250 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4E31A
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4E368
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4E3CB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4E509

Part of subcall function 00007FF7C6B422B0: strchr.VCRUNTIME140(00000000,?,?,00007FF7C6B4186F), ref: 00007FF7C6B422F6
Part of subcall function 00007FF7C6B422B0: strchr.VCRUNTIME140(00000000,?,?,00007FF7C6B4186F), ref: 00007FF7C6B42306
Part of subcall function 00007FF7C6B422B0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,00007FF7C6B4186F), ref: 00007FF7C6B42330
Part of subcall function 00007FF7C6B422B0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B42365
Part of subcall function 00007FF7C6B422B0: strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B4238A
Part of subcall function 00007FF7C6B422B0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B423AC

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B4E594

Strings

GSSAPI handshake failure (empty challenge message), xrefs: 00007FF7C6B4E413
GSSAPI, xrefs: 00007FF7C6B4E253
Kerberos, xrefs: 00007FF7C6B4E2E3, 00007FF7C6B4E385

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdup$callocmallocstrchr$freestrncpy
String ID: GSSAPI$GSSAPI handshake failure (empty challenge message)$Kerberos
API String ID: 370574955-353107822
Opcode ID: 9bb4d793e5eaa775d78e86a631eb1e9d5001f65624e3e00223488ee9ff0131b1
Instruction ID: b9829269cf8c529e0258d4e481993dd872ab4143bbb41da34a125e70d9b691cf
Opcode Fuzzy Hash: 9bb4d793e5eaa775d78e86a631eb1e9d5001f65624e3e00223488ee9ff0131b1
Instruction Fuzzy Hash: 72A17232A09B4586EB52DF65E8802BEB3B5FB44B98F904036EE4D47754EF38E446C760

Function 00007FF7C6B091C5 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 206COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B0920A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B0922A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B0927B

Part of subcall function 00007FF7C6B0AA90: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B0AA96

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B09381

Strings

Replaced, xrefs: 00007FF7C6B09611
FALSE, xrefs: 00007FF7C6B0935B
Added, xrefs: 00007FF7C6B0961D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7C6B09627

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 1169197092-2292467869
Opcode ID: ca514d7e7305119d2165da9e796f0d34b6f904de589da82d96b4f030833b869d
Instruction ID: e3539cd3ccca753b80948e74f282ba16c5af13f4a695d065b81c83a1952f2b95
Opcode Fuzzy Hash: ca514d7e7305119d2165da9e796f0d34b6f904de589da82d96b4f030833b869d
Instruction Fuzzy Hash: F29153B190D78655FF77BF2198C47BBABA0AF05764FA45035CA8E42691EE2CE444C320

Function 00007FF7C6B224C0 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 181COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B2258C

Strings

Authentication problem. Ignoring this., xrefs: 00007FF7C6B226CD
Negotiate, xrefs: 00007FF7C6B22536
NTLM, xrefs: 00007FF7C6B225BC
Digest, xrefs: 00007FF7C6B22624
Ignoring duplicate digest auth header., xrefs: 00007FF7C6B2263D
Basic, xrefs: 00007FF7C6B22681
Bearer, xrefs: 00007FF7C6B226A8

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdup
String ID: Authentication problem. Ignoring this.$Basic$Bearer$Digest$Ignoring duplicate digest auth header.$NTLM$Negotiate
API String ID: 1169197092-907567932
Opcode ID: 730da2a12ebb48a9055ed21ed303a69c2415e4fdf515be8dd001584b0cb10862
Instruction ID: ed040204ca550af65854d29e01129fa29066a09e27f3d283905ea2bb45e5f839
Opcode Fuzzy Hash: 730da2a12ebb48a9055ed21ed303a69c2415e4fdf515be8dd001584b0cb10862
Instruction Fuzzy Hash: C971C46290CAC256F727AE119DD12B7FBD2AF017A4FE48035DE4E8A295DF3CE5158320

Function 00007FF7C6B092D3 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 169COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B092D6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B09381

Strings

__Host-, xrefs: 00007FF7C6B0930D
__Secure-, xrefs: 00007FF7C6B092F0
Replaced, xrefs: 00007FF7C6B09611
FALSE, xrefs: 00007FF7C6B0935B
Added, xrefs: 00007FF7C6B0961D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7C6B09627

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced$__Host-$__Secure-
API String ID: 1169197092-978722393
Opcode ID: adeeaa5add69311c42b8281e9d9b77c9075357651fd6f58e087f2d4938403f26
Instruction ID: 8a4f53a40c1fb011cd85bc4b2c6c7f4800278fab16e311b523cbf052c496a95e
Opcode Fuzzy Hash: adeeaa5add69311c42b8281e9d9b77c9075357651fd6f58e087f2d4938403f26
Instruction Fuzzy Hash: 727141B1A0D78655FB73BF2598C47BBAB90AF05764FA45035CA9D42691EF2CE484C320

Function 00007FF7C6B14000 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 142stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B140DC
strchr.VCRUNTIME140 ref: 00007FF7C6B14110
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7C6B14130
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B141B4

Strings

Connecting to hostname: %s, xrefs: 00007FF7C6B1418B
%s%s%s, xrefs: 00007FF7C6B1409F
Connecting to port: %d, xrefs: 00007FF7C6B141D0
anonymous, xrefs: 00007FF7C6B14010

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$strchrstrtol
String ID: %s%s%s$Connecting to hostname: %s$Connecting to port: %d$anonymous
API String ID: 137861075-1224060940
Opcode ID: 685afc41f017c0330751de696eec2f31b1e2ff7f86675851716eea62eb8583b3
Instruction ID: 79dc19292210566c87602fe3ae2fc03c407ddae9e53fe79c8eb00878a15d6ecc
Opcode Fuzzy Hash: 685afc41f017c0330751de696eec2f31b1e2ff7f86675851716eea62eb8583b3
Instruction Fuzzy Hash: 3E51B4A2608AD254EA32AF15AC803ABEB95FF45BB4FA44135DE9D07688CF3CD555C320

Function 00007FF7C6B306B0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 135stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B3076F
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B307B4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B30870

Strings

SMTPUTF8, xrefs: 00007FF7C6B3071D, 00007FF7C6B30825
VRFY %s%s%s%s, xrefs: 00007FF7C6B3083E
HELP, xrefs: 00007FF7C6B308A5
EXPN, xrefs: 00007FF7C6B306F7
%s %s%s, xrefs: 00007FF7C6B30739

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdupfreestrpbrk
String ID: SMTPUTF8$%s %s%s$EXPN$HELP$VRFY %s%s%s%s
API String ID: 1812939018-2300960079
Opcode ID: a6bfebe09bdea796368d56e05069b0667edcb3e16480c17a63920d3b67b5cb8c
Instruction ID: 4976264c87248a6cf8a47743cea80b3dd84c50f5feb6fd27c85c7466d57b38f6
Opcode Fuzzy Hash: a6bfebe09bdea796368d56e05069b0667edcb3e16480c17a63920d3b67b5cb8c
Instruction Fuzzy Hash: 54519322F08F8181EB16EF15E8907BAA7A1EF85BA4FA44131DA4D03B95DF2CE945C750

Function 00007FF7C6B04077 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 109COMMON

Download Yara Rule

Strings

FLUSH, xrefs: 00007FF7C6B04103
RELOAD, xrefs: 00007FF7C6B04125
SESS, xrefs: 00007FF7C6B040C3
Set-Cookie:, xrefs: 00007FF7C6B04198
ALL, xrefs: 00007FF7C6B04083

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: ALL$FLUSH$RELOAD$SESS$Set-Cookie:
API String ID: 1294909896-1147549499
Opcode ID: f5a77041e9b8cb132f87f1688a52ad841aacc8332d561af83b2daa6ae1d6c702
Instruction ID: 263573d0cf58396bcbfb24fd2239eba958e9a08053c2abf9f4fb649489f52e84
Opcode Fuzzy Hash: f5a77041e9b8cb132f87f1688a52ad841aacc8332d561af83b2daa6ae1d6c702
Instruction Fuzzy Hash: AC4151A1B1C51292E91AFF269ED05BBD692AF84BE0FA45031DE0E47786DE2DF4118360

Function 00007FF7C6B36381 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 108stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140 ref: 00007FF7C6B36393
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B363AE
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B363DA
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B363FF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B364DC

Strings

Wildcard - Parsing started, xrefs: 00007FF7C6B36477

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdup$callocfreestrrchr
String ID: Wildcard - Parsing started
API String ID: 2641349667-2274641867
Opcode ID: cb9ca2c25c8fda5299ec63de61614194ed89a65231989d75ea55bc002a74f84b
Instruction ID: 739ab0ea84f1013b6aa7b49645774ba46c755c6a48e140fc404839f56233f3e4
Opcode Fuzzy Hash: cb9ca2c25c8fda5299ec63de61614194ed89a65231989d75ea55bc002a74f84b
Instruction Fuzzy Hash: 7D515B32B09B4281EB16EF15E8901BAB7A5EB84B70FA94435CA4E0B755EF38E445C320

Function 00007FF7C6B096B0 Relevance: 13.8, APIs: 11, Instructions: 52COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7C6B110C9,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B096DD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7C6B110C9,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B09707
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7C6B110C9,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B09711
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7C6B110C9,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B0971B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7C6B110C9,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B09725
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7C6B110C9,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B0972F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7C6B110C9,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B09739
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7C6B110C9,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B09743
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7C6B110C9,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B0974D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7C6B110C9,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B09756
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7C6B110C9,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B09771

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c749a82d12265e7ec16eddb8e20f6f6fa6d4b57361dcb1c1af5a20f07e69a0f1
Instruction ID: 1e8ef8b36a91b0c8ce84a0192ff92beb843b10cb542e61c9aeb4de9680414806
Opcode Fuzzy Hash: c749a82d12265e7ec16eddb8e20f6f6fa6d4b57361dcb1c1af5a20f07e69a0f1
Instruction Fuzzy Hash: A421CA36A59A4182DB55AF21ECA413AB770FB88FA5F641431DE8E43724CF3CD889C720

Function 00007FF7C6B3F500 Relevance: 13.8, APIs: 11, Instructions: 29COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B3E532,?,?,00000000,00007FF7C6B1563B,?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B3F50C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B3E532,?,?,00000000,00007FF7C6B1563B,?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B3F516
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B3E532,?,?,00000000,00007FF7C6B1563B,?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B3F520
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B3E532,?,?,00000000,00007FF7C6B1563B,?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B3F52A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B3E532,?,?,00000000,00007FF7C6B1563B,?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B3F534
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B3E532,?,?,00000000,00007FF7C6B1563B,?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B3F53E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B3E532,?,?,00000000,00007FF7C6B1563B,?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B3F548
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B3E532,?,?,00000000,00007FF7C6B1563B,?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B3F552
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B3E532,?,?,00000000,00007FF7C6B1563B,?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B3F55C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B3E532,?,?,00000000,00007FF7C6B1563B,?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B3F566
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B3E532,?,?,00000000,00007FF7C6B1563B,?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B3F570

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c393e2909bfc8f93e2b42ee5a4deae49287b5baffc689fe6c12f6123f8ae73f7
Instruction ID: 2d07b8f7db479920156e70c6da704bf28cb83f4003684fbb30d34056764a2111
Opcode Fuzzy Hash: c393e2909bfc8f93e2b42ee5a4deae49287b5baffc689fe6c12f6123f8ae73f7
Instruction Fuzzy Hash: 1001C826A55901C2D719AF26ECE40396330FF88F69B641431CE4E47324DE3CD899C360

Function 00007FF7C6B3E8F0 Relevance: 13.7, APIs: 3, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3EA45
memcpy.VCRUNTIME140 ref: 00007FF7C6B3EA62

Strings

https, xrefs: 00007FF7C6B3E980
file, xrefs: 00007FF7C6B3E90B
%%25%s], xrefs: 00007FF7C6B3EA72
%ld, xrefs: 00007FF7C6B3E9AE
file://%s%s%s, xrefs: 00007FF7C6B3E93E
%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF7C6B3EC32

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: mallocmemcpy
String ID: %%25%s]$%ld$%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$file$file://%s%s%s$https
API String ID: 4276657696-1832275178
Opcode ID: 474e420f765d06e5b49a35f3b8a22088648058fab8f40627cb3dd0f611fd6dc1
Instruction ID: 4e17171f78d24da7a726c9f3873e25894c6250a537696bbb6a19f6c13c507e3c
Opcode Fuzzy Hash: 474e420f765d06e5b49a35f3b8a22088648058fab8f40627cb3dd0f611fd6dc1
Instruction Fuzzy Hash: DFA18861709B8685EA66AF11A8803ABB3A5FF447A4FA44137DF4D07B59DF3CE442C710

Function 00007FF7C6B4A510 Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 211COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7C6B4A5B8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4A5C9
memcpy.VCRUNTIME140 ref: 00007FF7C6B4A709
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4A764
memcpy.VCRUNTIME140 ref: 00007FF7C6B4A781

Strings

cached response data too big to handle, xrefs: 00007FF7C6B4A801
8, xrefs: 00007FF7C6B4A7B3
response reading failed, xrefs: 00007FF7C6B4A7A1
Excessive server response line length received, %zd bytes. Stripping, xrefs: 00007FF7C6B4A6E1

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: memcpy$freemalloc
String ID: 8$Excessive server response line length received, %zd bytes. Stripping$cached response data too big to handle$response reading failed
API String ID: 3313557100-1003742340
Opcode ID: 040ce556d5c18bc4a6b63754f871f5ec386c206d5279338e2b36491221b78782
Instruction ID: 25dc74247f8926b0a63439337329222780afac279986aaf3be9d5c04af6796b3
Opcode Fuzzy Hash: 040ce556d5c18bc4a6b63754f871f5ec386c206d5279338e2b36491221b78782
Instruction Fuzzy Hash: ED81F46260DB8182EA52AF16E8903BBB760FB44790FA45431DF4E57749DF3CD491C350

Function 00007FF7C6B46DE6 Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 169COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B46E1F
memcpy.VCRUNTIME140 ref: 00007FF7C6B46E4A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B46F8E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47033

Strings

Signature Algorithm, xrefs: 00007FF7C6B47007
Signature Algorithm: %s, xrefs: 00007FF7C6B47021
Serial Number, xrefs: 00007FF7C6B46F62
Serial Number: %s, xrefs: 00007FF7C6B46F7C

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3401966785-517259162
Opcode ID: 50ef5e3568ff0dea3124d16294d1965ac2e9456bd4473011d0f0c2a6461d9fa4
Instruction ID: a637652e2b99a9f1aab9d48ef4a02be607b8ac1f5bbb42ab63151e9a76b8ef9a
Opcode Fuzzy Hash: 50ef5e3568ff0dea3124d16294d1965ac2e9456bd4473011d0f0c2a6461d9fa4
Instruction Fuzzy Hash: 07615951A0979345FB1BAF258CD42BBA792AF057E4FA44436DE4F0B785EE3CE0458321

Function 00007FF7C6B40E90 Relevance: 13.6, APIs: 5, Strings: 4, Instructions: 148COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF7C6B244F8), ref: 00007FF7C6B41020
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF7C6B244F8), ref: 00007FF7C6B41057
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF7C6B244F8), ref: 00007FF7C6B4107E

Strings

NTLM, xrefs: 00007FF7C6B40E96
HTTP, xrefs: 00007FF7C6B40EA6
%sAuthorization: NTLM %s, xrefs: 00007FF7C6B41038, 00007FF7C6B410E4
Proxy-, xrefs: 00007FF7C6B4102E, 00007FF7C6B410DA

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: %sAuthorization: NTLM %s$HTTP$NTLM$Proxy-
API String ID: 1294909896-3948863929
Opcode ID: eba3bc0e4f513d373c3a1549945715289ba2cbcff6a926267fb2df30d9069441
Instruction ID: 605dd5dc9de8a9e9200db58998b39a122b6841364aa31ab5aa2331570148e53f
Opcode Fuzzy Hash: eba3bc0e4f513d373c3a1549945715289ba2cbcff6a926267fb2df30d9069441
Instruction Fuzzy Hash: 5A616C32A09B8681EB629F15EC843BBB3A5FB44BA4FA00036DA8D47754DF3CD545C721

Function 00007FF7C6B3659E Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 261COMMON

Download Yara Rule

APIs

_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF7C6B36627

Part of subcall function 00007FF7C6B36BD0: strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7C6B36C06
Part of subcall function 00007FF7C6B36BD0: _open.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7C6B36C5B

Strings

Content-Length: %I64d, xrefs: 00007FF7C6B36683
Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT%s, xrefs: 00007FF7C6B3678B
Accept-ranges: bytes, xrefs: 00007FF7C6B366BE
failed to resume file:// transfer, xrefs: 00007FF7C6B36986
Can't get the size of file., xrefs: 00007FF7C6B36809

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _fstat64_openstrchr
String ID: Accept-ranges: bytes$Can't get the size of file.$Content-Length: %I64d$Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT%s$failed to resume file:// transfer
API String ID: 3410096895-1509146019
Opcode ID: fb90213a21ae9de58ff9056381cb602e58aad51a39e75d42268f52a69b9f3f45
Instruction ID: daced16a64e351b058480583b9d7607502d6f8af5757c516bc23880f10cf898c
Opcode Fuzzy Hash: fb90213a21ae9de58ff9056381cb602e58aad51a39e75d42268f52a69b9f3f45
Instruction Fuzzy Hash: 4EB15472B0868385EB22AF259D903FBA391FB897A4FA44131DE4D47B55FE3CE4058760

Function 00007FF7C6B1D380 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 227networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1D3DA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1D4DE
WSAIoctl.WS2_32 ref: 00007FF7C6B1D637
setsockopt.WS2_32 ref: 00007FF7C6B1D65F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1D756

Strings

Failed to alloc scratch buffer!, xrefs: 00007FF7C6B1D4F0
We are completely uploaded and fine, xrefs: 00007FF7C6B1D6CA

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: malloc$Ioctlsetsockopt
String ID: Failed to alloc scratch buffer!$We are completely uploaded and fine
API String ID: 3352517165-607151321
Opcode ID: f4163445e0e99ab7693f9d5b310e1b6f847d4ea6b24d192c27af222052680696
Instruction ID: 6824c9f273d1b74511ea6124a746b4f3f456d0fa71f5543802aaaea9afac380e
Opcode Fuzzy Hash: f4163445e0e99ab7693f9d5b310e1b6f847d4ea6b24d192c27af222052680696
Instruction Fuzzy Hash: 55B17572A08B8695EF66AF24D8843FA73D1EB44B68FA80135CF4C06785DF3C9455C720

Function 00007FF7C6B3DF00 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B3DF47
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3DFAB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3E0DF

Part of subcall function 00007FF7C6B2C090: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF7C6B1341F), ref: 00007FF7C6B2C0BE

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3DFDE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3E11D

Strings

Failed sending Gopher request, xrefs: 00007FF7C6B3E0E5
%s?%s, xrefs: 00007FF7C6B3DF39

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: %s?%s$Failed sending Gopher request
API String ID: 111713529-132698833
Opcode ID: 0647873ee4945d98ea00dd97d869e89dd5de779078cd42339673a8683d92e996
Instruction ID: 8452d2f06e75756e4c863e1c38f4c5d971eafacc91fcb163e1f5d2a85731ce8e
Opcode Fuzzy Hash: 0647873ee4945d98ea00dd97d869e89dd5de779078cd42339673a8683d92e996
Instruction Fuzzy Hash: 33518862B09A8281E612AF65AC911ABE790BF45BF4FA40232EF5D47BD5DF3CD4438710

Function 00007FF7C6B497C5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B49808
memcpy.VCRUNTIME140 ref: 00007FF7C6B4982D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B498FF
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B49943
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B49957
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B499BE

Strings

TRUE, xrefs: 00007FF7C6B4991D

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: freeisupper$mallocmemcpy
String ID: TRUE
API String ID: 3511497317-3412697401
Opcode ID: 05ca358fefc153e4919695bf037aa20636906852b0a8b3b73fa8da4a6161c6fd
Instruction ID: 94d75bae15543e7691ffaaf43a96a1eb3114011ce6c931839288691ed974de49
Opcode Fuzzy Hash: 05ca358fefc153e4919695bf037aa20636906852b0a8b3b73fa8da4a6161c6fd
Instruction Fuzzy Hash: AB517B11E0D69249FF1BBE298D9437AEB91EB127B0FA44635C69F426C6CE2E9045C334

Function 00007FF7C6AF94E0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFA9ED
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C6AFAA1B
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C6AFAA29
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFAA63
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFAAB4

Strings

value, xrefs: 00007FF7C6AFA959

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: 5403d7da4d46fb13fc5ddccb1100cede1cc053cdc18209e1585e2130f7cb75b3
Instruction ID: 630ac9b51f47d33ab7f1566a8542df1dfbdbc87639e9978244ac480f12daedd6
Opcode Fuzzy Hash: 5403d7da4d46fb13fc5ddccb1100cede1cc053cdc18209e1585e2130f7cb75b3
Instruction Fuzzy Hash: A1619572A18A8585EB12AF78D8843EEA361EB457B4F904731EB6D03AD9DF7CD085C311

Function 00007FF7C6B3EE16 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3EE23
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3EEFD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B3EF4E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F00A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F0FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F10B

Strings

%%%02x, xrefs: 00007FF7C6B3EFB3

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$malloc$_strdup
String ID: %%%02x
API String ID: 1496848336-4020994737
Opcode ID: 5ec7c6ae40d2c7131917872dd59d9bf56c6952a585ef41de78b4447e98d348e7
Instruction ID: e91706f4cf3c1422d7c15095932f15b8175792f263c0c40b9514787b16549009
Opcode Fuzzy Hash: 5ec7c6ae40d2c7131917872dd59d9bf56c6952a585ef41de78b4447e98d348e7
Instruction Fuzzy Hash: 3041F611B0D69245FA63AF15689037BABD19F05774FA80572EA9E07BC1DE3DE446C330

Function 00007FF7C6B3A6B0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF7C6B3A71C
htons.WS2_32 ref: 00007FF7C6B3A732
send.WS2_32 ref: 00007FF7C6B3A7D8
WSAGetLastError.WS2_32 ref: 00007FF7C6B3A7EC
send.WS2_32 ref: 00007FF7C6B3A82E
WSAGetLastError.WS2_32 ref: 00007FF7C6B3A838

Strings

Sending data failed (%d), xrefs: 00007FF7C6B3A7F2, 00007FF7C6B3A83E

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ErrorLasthtonssend
String ID: Sending data failed (%d)
API String ID: 2027122571-2319402659
Opcode ID: c83ea612977417f586173557f6ea6d2341eca23a0797cff038ac544236a14d21
Instruction ID: 3aa1ef7103b3c848887d9ef0eefcce2308070d1413f9502f22a527cf7b22029b
Opcode Fuzzy Hash: c83ea612977417f586173557f6ea6d2341eca23a0797cff038ac544236a14d21
Instruction Fuzzy Hash: 4241BF32708A86C4E7066F65D890AAAB720F754FA9FA44532DB8E03B58DF7CD416C321

Function 00007FF7C6B476CE Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 82COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B476D8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47B09
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47BD2

Part of subcall function 00007FF7C6B10250: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B102A2

Strings

Expire Date, xrefs: 00007FF7C6B47ADD
Public Key Algorithm, xrefs: 00007FF7C6B47B88
Public Key Algorithm: %s, xrefs: 00007FF7C6B47BA2
Expire Date: %s, xrefs: 00007FF7C6B47AF7

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 111713529-2901970132
Opcode ID: 14ad7033dc6a88650bd118e579ebc25d4700cebb073d8ea0ca9eb4d77c57622d
Instruction ID: 0c4315e772f31733068ce521a3b4cf05385025c9d57c20afc07a04db886b47a4
Opcode Fuzzy Hash: 14ad7033dc6a88650bd118e579ebc25d4700cebb073d8ea0ca9eb4d77c57622d
Instruction Fuzzy Hash: 9B319361A0878245EB16AF659C940FBA7A2BF097A8FD40836DE4D1B35ADF3CE505C320

Function 00007FF7C6B477CD Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 173COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47B09
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47BD2

Strings

Public Key Algorithm, xrefs: 00007FF7C6B47B88
Expire Date, xrefs: 00007FF7C6B47ADD
GMT, xrefs: 00007FF7C6B4788E
Public Key Algorithm: %s, xrefs: 00007FF7C6B47BA2
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7C6B47901
Expire Date: %s, xrefs: 00007FF7C6B47AF7

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Expire Date$Public Key Algorithm
API String ID: 1294909896-3805148269
Opcode ID: 65398783ec6a5472b89e6f5ba08aaed86e85792e299655dc793c3e997cf9b11f
Instruction ID: 22bb7f2d391224a0465c982e03f44e09baae817a2aa470ad2a26d25d77bf6d1b
Opcode Fuzzy Hash: 65398783ec6a5472b89e6f5ba08aaed86e85792e299655dc793c3e997cf9b11f
Instruction Fuzzy Hash: D671DE71A0CB9284EB12AF259C841FBABA1FB057A4FE44436DA8D17749DF3CE546C720

Function 00007FF7C6B47F65 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47FA8
memcpy.VCRUNTIME140 ref: 00007FF7C6B47FCE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B480A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B48109
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B48149
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4815C

Strings

Signature: %s, xrefs: 00007FF7C6B480F7
Signature, xrefs: 00007FF7C6B480DF

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$malloc$memcpy
String ID: Signature: %s$Signature
API String ID: 901724546-1663925961
Opcode ID: 0dbdbe24162aaa8beb8d3e886bbb4eed00369c5c2f35c19f4766fe3ec79354e0
Instruction ID: 6860c53f5425b6fbd32115a9aac72b67edc037fd2018519551ae3237f030b3c3
Opcode Fuzzy Hash: 0dbdbe24162aaa8beb8d3e886bbb4eed00369c5c2f35c19f4766fe3ec79354e0
Instruction Fuzzy Hash: E6512611A0A6C246EE1AAF159C943BBA7A1EF45BF0FA40636DA5F077D5DE3CE045C320

Function 00007FF7C6B47704 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 130COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47B09
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47BD2

Strings

%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7C6B477B9
GMT, xrefs: 00007FF7C6B47766
Public Key Algorithm, xrefs: 00007FF7C6B47B88
Expire Date, xrefs: 00007FF7C6B47ADD
Public Key Algorithm: %s, xrefs: 00007FF7C6B47BA2
Expire Date: %s, xrefs: 00007FF7C6B47AF7

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$Expire Date$GMT$Public Key Algorithm
API String ID: 1294909896-1642401773
Opcode ID: 0b0f14f1690a1982eaf9d3330274c6b63d18404df48be34babd8f1768d13894c
Instruction ID: d0ba55a80c028b36e7e237bd256b21ac647be622f62d1587eb1e439ab8134423
Opcode Fuzzy Hash: 0b0f14f1690a1982eaf9d3330274c6b63d18404df48be34babd8f1768d13894c
Instruction Fuzzy Hash: 02518361A0CB8295EB12AF649C801FBA7A2FF057A4FE84436DA4D1B359DF3CE545C720

Function 00007FF7C6B0EEB0 Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B0EEF6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B0EF22
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B0EF4E

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdup
String ID:
API String ID: 1169197092-0
Opcode ID: 70f71758403a8148c4ab42a7351240e65b208214f831332b0b4382ebec0677f5
Instruction ID: bc95ac8f39ce1a948da75b4b1566618db1561a81ce03e1a2098619a92907714e
Opcode Fuzzy Hash: 70f71758403a8148c4ab42a7351240e65b208214f831332b0b4382ebec0677f5
Instruction Fuzzy Hash: 97518362B1AB4082EB56DF55F480029B7A4FF48FA4B581535EF8D03B49EF38D4E28720

Function 00007FF7C6B357C6 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B357ED
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B358A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B358B1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B358E8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3595C

Strings

Entry path is '%s', xrefs: 00007FF7C6B358BE, 00007FF7C6B358F5
SYST, xrefs: 00007FF7C6B35886
Failed to figure out path, xrefs: 00007FF7C6B35962

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$malloc
String ID: Entry path is '%s'$Failed to figure out path$SYST
API String ID: 2190258309-1780565354
Opcode ID: d3230620498b22f8e8930f7ec4c32a765319a829da0923355f1ea4ed1f7368a3
Instruction ID: e4a67a7279a8d97c1e077f473cbeb8dcbf2ae76d058f85377315cd5237570026
Opcode Fuzzy Hash: d3230620498b22f8e8930f7ec4c32a765319a829da0923355f1ea4ed1f7368a3
Instruction Fuzzy Hash: D6419762B196C281EB26AF25ED902BAA7A4FB457A4FA04431CA8D03B56DE3CD555C320

Function 00007FF7C6B09880 Relevance: 11.3, APIs: 9, Instructions: 68COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B098FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B09904
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0990E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B09918
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B09922
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0992C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B09936
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B09940
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B09949

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2d53ea177bd5fcb9ef5d4a5565eec44617586cef10dbd9edadaa4e2a8245def9
Instruction ID: a711b2c85ab319fe890b9bb1b1117c6a5b2fbf531c0b435399913ead1e9aea73
Opcode Fuzzy Hash: 2d53ea177bd5fcb9ef5d4a5565eec44617586cef10dbd9edadaa4e2a8245def9
Instruction Fuzzy Hash: 7D31F836A09A5186DB15BF12EC9462AA774FB84FE4F681431DE8D07B58CF3CD445C720

Function 00007FF7C6B097A0 Relevance: 11.3, APIs: 9, Instructions: 52COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B097E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B097F1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B097FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B09805
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0980F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B09819
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B09823
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0982D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B09836

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: be728e198520c75c4111fbfd21dd9ed9d72ac757bd80a4e97b8261e50558d5be
Instruction ID: 42e5aeaf66d682015474baa9b75250c0da5789f285c23b83c2d0fb86c576bb3e
Opcode Fuzzy Hash: be728e198520c75c4111fbfd21dd9ed9d72ac757bd80a4e97b8261e50558d5be
Instruction Fuzzy Hash: A921DB76649A4182D715AF21EC9402AB774FB88FE4F641531DE8E43728CF3CD899C720

Function 00007FF7C6B436B0 Relevance: 10.9, APIs: 5, Strings: 2, Instructions: 424stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,00007FF7C6B42AC3), ref: 00007FF7C6B43758
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,00007FF7C6B42AC3), ref: 00007FF7C6B4379A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00007FF7C6B42AC3), ref: 00007FF7C6B4383F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00007FF7C6B42AC3), ref: 00007FF7C6B43852
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B43D37

Strings

%s?dns=%s, xrefs: 00007FF7C6B43828
Failed to encode DOH packet [%d], xrefs: 00007FF7C6B43891

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$memcpystrchr
String ID: %s?dns=%s$Failed to encode DOH packet [%d]
API String ID: 1438451818-3030351490
Opcode ID: deb42500f018067ff0e1fe256a940960f35ab27a02b8ba4a7228973b58f2e619
Instruction ID: 4bd278d51112f3f4a8d67279f021a781fc843243a5334aa3c68de94581e8fdfd
Opcode Fuzzy Hash: deb42500f018067ff0e1fe256a940960f35ab27a02b8ba4a7228973b58f2e619
Instruction Fuzzy Hash: E402D851B0879345F752BE628C847BBA795EF547A8FE84435DF0C87B86DF68E4448320

Function 00007FF7C6B43F30 Relevance: 10.7, APIs: 7, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C6B0BC10: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0BC46
Part of subcall function 00007FF7C6B0BC10: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0BC56
Part of subcall function 00007FF7C6B0BC10: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0BC64
Part of subcall function 00007FF7C6B0BC10: memset.VCRUNTIME140 ref: 00007FF7C6B0BC9F

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B43FF9
memcpy.VCRUNTIME140 ref: 00007FF7C6B44014
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4402E

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$mallocmemcpymemset
String ID:
API String ID: 1579693990-0
Opcode ID: 4b1a5abe18f9916cbbbd679f672e97edb3f062d473b07aea611d78d8c18efa5d
Instruction ID: 00f310e068398079baa058f31b5b33d0e4179cd4c15b5ac325c2975000697026
Opcode Fuzzy Hash: 4b1a5abe18f9916cbbbd679f672e97edb3f062d473b07aea611d78d8c18efa5d
Instruction Fuzzy Hash: B591AE61B0974242FA66BE669CD077BE690EF94BE4FA84434DE4D87785DF3CE4608320

Function 00007FF7C6B18FF0 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 217stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7C6B18FB8), ref: 00007FF7C6B19105
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7C6B18FB8), ref: 00007FF7C6B1911F

Strings

I32, xrefs: 00007FF7C6B190F5, 00007FF7C6B19155
Internal error removing splay node = %d, xrefs: 00007FF7C6B19002
I64, xrefs: 00007FF7C6B19115, 00007FF7C6B1917F

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: strncmp
String ID: I32$I64$Internal error removing splay node = %d
API String ID: 1114863663-13178787
Opcode ID: 5466c32271cc5cb7e7e9f088a5ee41c63a7e9db11b8cdfd0923fe3b4927f0a9f
Instruction ID: 053af654bf32f916b0290be821c603b0b76470409534de5cb793a409ab05e850
Opcode Fuzzy Hash: 5466c32271cc5cb7e7e9f088a5ee41c63a7e9db11b8cdfd0923fe3b4927f0a9f
Instruction Fuzzy Hash: 5AA1E773A08A8196EB21EF14D89477EBBA4FB49B68F964136CB9D43254DF3CD208C710

Function 00007FF7C6B27910 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 165stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7C6B0A93A,?,?,?,?,?,?,?,00007FF7C6B0A707), ref: 00007FF7C6B27921
strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF7C6B27AC3
strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF7C6B27AE0

Strings

TRUE, xrefs: 00007FF7C6B27A4C
0123456789ABCDEF, xrefs: 00007FF7C6B27AD2, 00007FF7C6B27AD9
0123456789abcdef, xrefs: 00007FF7C6B27AB2, 00007FF7C6B27ABC

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: strchr$_errno
String ID: 0123456789ABCDEF$0123456789abcdef$TRUE
API String ID: 2644425738-1191287149
Opcode ID: 35261560fc4ececf390de24db81dc6704b5c2518f59f0b12bbb14efd26ba6ab4
Instruction ID: f02e5bffcca4cc4558ce8b30265c626e6b8fba5d7ae62b5b13b870dcfe423a10
Opcode Fuzzy Hash: 35261560fc4ececf390de24db81dc6704b5c2518f59f0b12bbb14efd26ba6ab4
Instruction Fuzzy Hash: A551F322B0D7C641EE27AF2598941BBE3D2AB95BA8FF44131DA4D06785EE3CE541C324

Function 00007FF7C6B4963A Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 154COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B49943
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B49957
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B499BE

Strings

TRUE, xrefs: 00007FF7C6B4991D
GMT, xrefs: 00007FF7C6B496EE
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7C6B49761

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: isupper$free
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$TRUE
API String ID: 573759493-910067264
Opcode ID: 7b50913eba02dc6e3c570be33cfabcbce56a5233ae9f37dac75efdd75a45a4fd
Instruction ID: de96bde4e2be2bfcfdcfde64bafce0a7b7d11acb02c3c7fb73d3e79ac5916989
Opcode Fuzzy Hash: 7b50913eba02dc6e3c570be33cfabcbce56a5233ae9f37dac75efdd75a45a4fd
Instruction Fuzzy Hash: DA61D661A0C69644FB13BF249D842BBFBA5EB017A4FE44032D68D42699CF3DD542C724

Function 00007FF7C6B0918C Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B09192
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B09381

Strings

Replaced, xrefs: 00007FF7C6B09611
FALSE, xrefs: 00007FF7C6B0935B
Added, xrefs: 00007FF7C6B0961D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7C6B09627

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 1169197092-2292467869
Opcode ID: 4eb25c6b6d2f9f7cbe27d5f76c0accb182da69888ee7bab4799874894cd47cd5
Instruction ID: 52c3c5ca2ef1d199a9d891cf10e54f44092c6919054262cb2ecbac1d1730ba77
Opcode Fuzzy Hash: 4eb25c6b6d2f9f7cbe27d5f76c0accb182da69888ee7bab4799874894cd47cd5
Instruction Fuzzy Hash: BC6142B190D78655FB73BF2598C477BABA0AF04764FA45035CB9D42691EF2CE884C320

Function 00007FF7C6B09329 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B0932C

Part of subcall function 00007FF7C6B27700: strchr.VCRUNTIME140 ref: 00007FF7C6B27736

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B09381

Strings

Replaced, xrefs: 00007FF7C6B09611
FALSE, xrefs: 00007FF7C6B0935B
Added, xrefs: 00007FF7C6B0961D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7C6B09627

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdup$strchr
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 3404610657-2292467869
Opcode ID: 636d889a6d2b56b227808792362747b7803e4d741001d9d55bc0b60c0973817a
Instruction ID: c29b6b4a33414c886e257c0efc4012f3028988393490e3d826551a0e0d9efd99
Opcode Fuzzy Hash: 636d889a6d2b56b227808792362747b7803e4d741001d9d55bc0b60c0973817a
Instruction Fuzzy Hash: E96151B1A0D78655FB73BF25988477BABA0AF04764FA41035DB9E42691DF2CE884C320

Function 00007FF7C6AF5DE0 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,00007FF7C6AF1DCA), ref: 00007FF7C6AF5E71
memcpy.VCRUNTIME140(?,?,?,00007FF7C6AF1DCA), ref: 00007FF7C6AF5EB5
memcpy.VCRUNTIME140(?,?,?,00007FF7C6AF1DCA), ref: 00007FF7C6AF5ECD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF7C6AF1DCA), ref: 00007FF7C6AF5F52

Part of subcall function 00007FF7C6B4F200: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7C6AF43FE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7C6AF1B59), ref: 00007FF7C6B4F21A

memcpy.VCRUNTIME140(?,?,?,00007FF7C6AF1DCA), ref: 00007FF7C6AF5F84
memcpy.VCRUNTIME140(?,?,?,00007FF7C6AF1DCA), ref: 00007FF7C6AF5F9F
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C6AF5FBC

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 50dd8ada50efe606ccea5ed8145b47d3a2961d7aacb5bc2892054fbc091ac715
Instruction ID: 3629e9f970f96f6d6814010757d7a729a1833b79f71770803c5cf1228184d786
Opcode Fuzzy Hash: 50dd8ada50efe606ccea5ed8145b47d3a2961d7aacb5bc2892054fbc091ac715
Instruction Fuzzy Hash: E7510732A04B8182EB06EF25D9841AEA361FB25BE4F944632DF2D033D5CF38E195C352

Function 00007FF7C6B33410 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 146stringCOMMON

Download Yara Rule

APIs

strstr.VCRUNTIME140 ref: 00007FF7C6B334D3

Strings

Maxdownload = %I64d, xrefs: 00007FF7C6B3356C, 00007FF7C6B3360B
, xrefs: 00007FF7C6B33477
bytes, xrefs: 00007FF7C6B334C9
Getting file with size: %I64d, xrefs: 00007FF7C6B33585
RETR response: %03d, xrefs: 00007FF7C6B33468
Data conn was not available immediately, xrefs: 00007FF7C6B335C7

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: strstr
String ID: $ bytes$Data conn was not available immediately$Getting file with size: %I64d$Maxdownload = %I64d$RETR response: %03d
API String ID: 1392478783-2096918210
Opcode ID: a6fcd927616a26db4376b7ee4daf2ee288544fde8e32deab8938f0e85007eea4
Instruction ID: ae52314466b8803fbd3aedd387ea8f15a546ab0af95a1161f4ec65b0de60b56f
Opcode Fuzzy Hash: a6fcd927616a26db4376b7ee4daf2ee288544fde8e32deab8938f0e85007eea4
Instruction Fuzzy Hash: 7A51C5A2B087C545EA26AF18A8C42BBE391EF45774FE50231DB5C42AD5DF7CE4868720

Function 00007FF7C6B302D0 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3031A
memcpy.VCRUNTIME140 ref: 00007FF7C6B30431
memcpy.VCRUNTIME140 ref: 00007FF7C6B304A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B304CE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B304E0

Strings

Failed to alloc scratch buffer!, xrefs: 00007FF7C6B30330

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: freememcpy$malloc
String ID: Failed to alloc scratch buffer!
API String ID: 169112436-1446904845
Opcode ID: bbd9ac57b16b44647c82b15b3af1e37caee980dee6847e315b167e7847fe7af0
Instruction ID: 66638b41e1694f17d2cdd664914c8bca56ba49d4b7c335b126cd585c55689ad3
Opcode Fuzzy Hash: bbd9ac57b16b44647c82b15b3af1e37caee980dee6847e315b167e7847fe7af0
Instruction Fuzzy Hash: F7519D72719B819AE726DF65A9806ABB7A0FB18794F940035DF8E07B55CF3CE254C320

Function 00007FF7C6B331E0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 145networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF7C6B33386

Part of subcall function 00007FF7C6B4A510: memcpy.VCRUNTIME140 ref: 00007FF7C6B4A5B8
Part of subcall function 00007FF7C6B4A510: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4A5C9

Strings

QUOT string not accepted: %s, xrefs: 00007FF7C6B333AF
*, xrefs: 00007FF7C6B33354
FTP response aborted due to select/poll error: %d, xrefs: 00007FF7C6B33394
We got a 421 - timeout!, xrefs: 00007FF7C6B333C5
FTP response timeout, xrefs: 00007FF7C6B333F3

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ErrorLastfreememcpy
String ID: *$FTP response aborted due to select/poll error: %d$FTP response timeout$QUOT string not accepted: %s$We got a 421 - timeout!
API String ID: 1248052217-2335292235
Opcode ID: 8144cd7e17a2af2eb4d3b1c636aca67309724875353194c6041363a1c669ad14
Instruction ID: 342bab421b77d0bc8cebcb2f8ea8532f17dfbeb2e22c4cfbe6a78f0a31a25dac
Opcode Fuzzy Hash: 8144cd7e17a2af2eb4d3b1c636aca67309724875353194c6041363a1c669ad14
Instruction Fuzzy Hash: 4C51D462B086C295FB66BE259D803FB9390BF457A4FA48131DF4D87AD5EE2CE4458310

Function 00007FF7C6B47DDB Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B48109
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B48149
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4815C

Strings

Signature: %s, xrefs: 00007FF7C6B480F7
Signature, xrefs: 00007FF7C6B480DF
GMT, xrefs: 00007FF7C6B47E8E
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7C6B47EFF

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Signature
API String ID: 2190258309-3231818857
Opcode ID: 765436fe69dbb91c10815e5d5da3cb3e89e3bea046772148126cd8ec49338a8e
Instruction ID: 6acd3826849e4c2b5a7bfed63f96bf8bacb8944452d295da1fa363e4cb132920
Opcode Fuzzy Hash: 765436fe69dbb91c10815e5d5da3cb3e89e3bea046772148126cd8ec49338a8e
Instruction Fuzzy Hash: 5951B462A5C6D285EA129F24ACC42FBF7A5FB457A0FA40532DA8D03754CF3CD946C710

Function 00007FF7C6B18430 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 144COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B42154
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4217A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B42188

Strings

Digest, xrefs: 00007FF7C6B18458
stale, xrefs: 00007FF7C6B420DF
true, xrefs: 00007FF7C6B420F4

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: Digest$stale$true
API String ID: 1294909896-2487968700
Opcode ID: b6515b32f05cb0051d56e42f416dd78d3d7bb7fc6255b4e5043b08569634ffa4
Instruction ID: 32800126de8e66c0487221d030639a0ccaaedd929753238bb9bb072960480ef1
Opcode Fuzzy Hash: b6515b32f05cb0051d56e42f416dd78d3d7bb7fc6255b4e5043b08569634ffa4
Instruction Fuzzy Hash: 59518262A0CA4281EB26AF25EC903BAA3A1FF447A4FA44031DB9D476C5DF3CE555D720

Function 00007FF7C6B3BFC0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

recvfrom.WS2_32 ref: 00007FF7C6B3C020
memcpy.VCRUNTIME140 ref: 00007FF7C6B3C046
memchr.VCRUNTIME140 ref: 00007FF7C6B3C143

Strings

Received too short packet, xrefs: 00007FF7C6B3C072
Internal error: Unexpected packet, xrefs: 00007FF7C6B3C0E8
TFTP error: %s, xrefs: 00007FF7C6B3C160

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: memchrmemcpyrecvfrom
String ID: Internal error: Unexpected packet$Received too short packet$TFTP error: %s
API String ID: 3107918033-477593554
Opcode ID: ee2287052399e300cb811f1afb470e41081beb95bdb52e3600248cf7cf20d59e
Instruction ID: 6cd0bef1353294ec50c989b888896d98806dce3622855a6a836924c91f6b870f
Opcode Fuzzy Hash: ee2287052399e300cb811f1afb470e41081beb95bdb52e3600248cf7cf20d59e
Instruction Fuzzy Hash: 155116B2B089D285EB66AF659C903BBA390EB44754FA44132DA4D87B85DF3CF541C720

Function 00007FF7C6AF2380 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C6AF6DE0: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF7C6AF23DB), ref: 00007FF7C6AF6E5E
Part of subcall function 00007FF7C6AF6DE0: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF7C6AF23DB), ref: 00007FF7C6AF6E6C
Part of subcall function 00007FF7C6AF6DE0: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF7C6AF23DB), ref: 00007FF7C6AF6E82

Part of subcall function 00007FF7C6AF3BC0: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF7C6AF1D9B), ref: 00007FF7C6AF3C06

Part of subcall function 00007FF7C6AF5DE0: memcpy.VCRUNTIME140(?,?,?,00007FF7C6AF1DCA), ref: 00007FF7C6AF5E71

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2479
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF24B8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2506
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2554

Strings

, column , xrefs: 00007FF7C6AF2409
at line , xrefs: 00007FF7C6AF23CC

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturn
String ID: at line $, column
API String ID: 2665656946-191570568
Opcode ID: d0983bd92521087a8e5be1ac105ea3303ce96ed91825edf9d7cf04a7ce60f857
Instruction ID: 0f4498a2e1ddd2f2465763d0f9acafcb7ee026ead691f24594933ff89d4c3922
Opcode Fuzzy Hash: d0983bd92521087a8e5be1ac105ea3303ce96ed91825edf9d7cf04a7ce60f857
Instruction Fuzzy Hash: FD51B162B08B8285FB01EFB4D8847AE6361EB447F8F905231DA6D13BD9DE38D496D311

Function 00007FF7C6B3EE97 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3EEFD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B3EF4E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F00A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F0FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F10B

Strings

%%%02x, xrefs: 00007FF7C6B3EFB3

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: acaf533c9b02a22df90cb6937cc5f09ab0293da091bd2e38f79b1aa1673cba41
Instruction ID: f5c4de03666205237fd48e81487dd38fd53a04d3c131e57cd95cc378afc2b9b0
Opcode Fuzzy Hash: acaf533c9b02a22df90cb6937cc5f09ab0293da091bd2e38f79b1aa1673cba41
Instruction Fuzzy Hash: EF41E611B0D6D245FA63AF15699037BABD1AF41764FA80572EA9E07BC1DE3DE406C330

Function 00007FF7C6B3EE87 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3EEFD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B3EF4E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F00A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F0FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F10B

Strings

%%%02x, xrefs: 00007FF7C6B3EFB3

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 9018160128560bf160f102dc0a5f6b43d32cb967d005d2baeaa5b57a0aa2b8ab
Instruction ID: dbba8621bb67840617e297f2543145d6b1b56b06110da2c7b66bc6d3c273d054
Opcode Fuzzy Hash: 9018160128560bf160f102dc0a5f6b43d32cb967d005d2baeaa5b57a0aa2b8ab
Instruction Fuzzy Hash: 1A41F411B0D6D245FA63AF25689037BAB919F42774FA80572EA9E07BC1DE3DE446C330

Function 00007FF7C6B3EDEC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3EEFD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B3EF4E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F00A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F0FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F10B

Strings

%%%02x, xrefs: 00007FF7C6B3EFB3

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 91655befe4ac8bde96aa8536272d111c541fc7d99250b5eab45d734e24beec81
Instruction ID: 310ed45e7b912721a662f26a0eb537d3bfaa5b2e9a0683fcc51f998aa680847c
Opcode Fuzzy Hash: 91655befe4ac8bde96aa8536272d111c541fc7d99250b5eab45d734e24beec81
Instruction Fuzzy Hash: 1841D411B0D69245FA63AF15689037BAB919F01774FA80572EA9E07BC1DE3DE4468330

Function 00007FF7C6B3EDFA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3EEFD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B3EF4E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F00A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F0FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F10B

Strings

%%%02x, xrefs: 00007FF7C6B3EFB3

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: eb467119d4807bfe633ac64f9ef0f64fe5eb2a1a60914a2deca1cb2c7eebee91
Instruction ID: f2db154ddb824e9c0aff12041c5d6043dd802749568805b57a67d3b74a1e3344
Opcode Fuzzy Hash: eb467119d4807bfe633ac64f9ef0f64fe5eb2a1a60914a2deca1cb2c7eebee91
Instruction Fuzzy Hash: F941D411B0D69245FA63AF25689037BAB919F01774FA80572EA9E07BC1DE3DE4068330

Function 00007FF7C6B3EE08 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3EEFD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B3EF4E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F00A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F0FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F10B

Strings

%%%02x, xrefs: 00007FF7C6B3EFB3

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 7e4f1a27d4406cf0da9580c8572af78909bee43a943ce9043aa9e808ba7c33ee
Instruction ID: 02fcc0b0dd9473db66a699b867f2212a88658c4b515bbbbef07674a87233b610
Opcode Fuzzy Hash: 7e4f1a27d4406cf0da9580c8572af78909bee43a943ce9043aa9e808ba7c33ee
Instruction Fuzzy Hash: 6941D411F0D69245FA63AF15689037BAB919F01774FA80572EA9E07BC1DE3DE4468330

Function 00007FF7C6B3EEBD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3EEFD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B3EF4E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F00A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F0FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3F10B

Strings

%%%02x, xrefs: 00007FF7C6B3EFB3

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 7374f6e88013ab33a32115764ca09f5107120024a7b6f246328e38e0da701d89
Instruction ID: 0d1ace2f2c435a53bf2df48791468e7032ae7ed88e775df98f52c3831425261b
Opcode Fuzzy Hash: 7374f6e88013ab33a32115764ca09f5107120024a7b6f246328e38e0da701d89
Instruction Fuzzy Hash: D041E511B0D69244FA63AF15689037BAB919F05774FA80572EA9D07BC1DE3DE446C330

Function 00007FF7C6B23FA0 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7C6B24086
strchr.VCRUNTIME140 ref: 00007FF7C6B24099
strchr.VCRUNTIME140 ref: 00007FF7C6B240AB

Strings

Expect: 100-continue, xrefs: 00007FF7C6B24108
100-continue, xrefs: 00007FF7C6B240C6
Expect, xrefs: 00007FF7C6B24007
Expect:, xrefs: 00007FF7C6B2402E

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: strchr
String ID: 100-continue$Expect$Expect:$Expect: 100-continue
API String ID: 2830005266-711804848
Opcode ID: b26aef5820a1b639a4a6e20a67eeab20dc2990e17a46bf80524f322626a8b5d2
Instruction ID: 104da2e3fa86896bd6244d5cba4d29a09f86da3a2df506724df6fef86cc54ac2
Opcode Fuzzy Hash: b26aef5820a1b639a4a6e20a67eeab20dc2990e17a46bf80524f322626a8b5d2
Instruction Fuzzy Hash: 47411961B08AD281EA56FF19EC801FBF7D2DF557A4FA81030DA4D47B56DE2CE8818720

Function 00007FF7C6B47620 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47B09
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47BD2

Strings

%s%lx, xrefs: 00007FF7C6B4767D
Expire Date, xrefs: 00007FF7C6B47ADD
Public Key Algorithm, xrefs: 00007FF7C6B47B88
Public Key Algorithm: %s, xrefs: 00007FF7C6B47BA2
Expire Date: %s, xrefs: 00007FF7C6B47AF7

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$%s%lx$Expire Date$Public Key Algorithm
API String ID: 1294909896-3155708153
Opcode ID: d7da83844c2ccafce0fd7bb1610b1b4443f61906a8ce1f9ab57daf84a3ca0627
Instruction ID: fabd6275fb7ccb7e52c7fe723f2c0bbb64d5ae7eaa6c8e99065894a32b2cfba2
Opcode Fuzzy Hash: d7da83844c2ccafce0fd7bb1610b1b4443f61906a8ce1f9ab57daf84a3ca0627
Instruction Fuzzy Hash: 7041C361A0C79249EA12AF259C941FBA7A2AF09798FE44831DE4D1B74ADF3CE505C720

Function 00007FF7C6B1C370 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 106COMMON

Download Yara Rule

APIs

fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C6B1C4BA

Strings

the ioctl callback returned %d, xrefs: 00007FF7C6B1C465
ioctl callback returned error %d, xrefs: 00007FF7C6B1C47F
necessary data rewind wasn't possible, xrefs: 00007FF7C6B1C4C5
Cannot rewind mime/post data, xrefs: 00007FF7C6B1C4F0
seek callback returned error %d, xrefs: 00007FF7C6B1C40E

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: fseek
String ID: Cannot rewind mime/post data$ioctl callback returned error %d$necessary data rewind wasn't possible$seek callback returned error %d$the ioctl callback returned %d
API String ID: 623662203-959247533
Opcode ID: bd9f7f78e4f84973c2aba29898073870ee9511775c8c9933b5ec3c8f649c1814
Instruction ID: e7465df638981ab34047d1de2a0594eaf209e87d098f087558a4fa3c779e3635
Opcode Fuzzy Hash: bd9f7f78e4f84973c2aba29898073870ee9511775c8c9933b5ec3c8f649c1814
Instruction Fuzzy Hash: 0C418EA2B14A4242E755BF6598D13FA5352EF84BA4FE82031DE0D4B789DF3DE490C760

Function 00007FF7C6B47D1E Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B48109
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B48149
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4815C

Strings

Signature: %s, xrefs: 00007FF7C6B480F7
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7C6B47DB4
GMT, xrefs: 00007FF7C6B47D74
Signature, xrefs: 00007FF7C6B480DF

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Signature
API String ID: 2190258309-3662781045
Opcode ID: a63b8dca082d32fea707001d66e134939b7fa98d84c66f33755224d45865c3cc
Instruction ID: f90341f0de68e1de694f3ed36963585df69c27be42fbdf6e783a42de3d8e83c4
Opcode Fuzzy Hash: a63b8dca082d32fea707001d66e134939b7fa98d84c66f33755224d45865c3cc
Instruction Fuzzy Hash: 2E418362A1CB8281EB12AF25E8801FBE361FB45BA4FE80432DA4D17759DF3CD545C720

Function 00007FF7C6B46DEE Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 95COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B46E1F
memcpy.VCRUNTIME140 ref: 00007FF7C6B46E4A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B46F8E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47033

Strings

Signature Algorithm, xrefs: 00007FF7C6B47007
Signature Algorithm: %s, xrefs: 00007FF7C6B47021
Serial Number, xrefs: 00007FF7C6B46F62
Serial Number: %s, xrefs: 00007FF7C6B46F7C

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3401966785-517259162
Opcode ID: 09e21e266049012c20262d2df50b96adf1c72d8de72a8705b5aa046885bc715a
Instruction ID: 4535e82264eadd3c0b05c3524849fb5edb9823bb4a95c2b3a131139e24f11fb2
Opcode Fuzzy Hash: 09e21e266049012c20262d2df50b96adf1c72d8de72a8705b5aa046885bc715a
Instruction Fuzzy Hash: D041E4A1A0979244EB06AF259C842FBA7A2BF05BE8FD44432DE4D1B745EF3CE505C320

Function 00007FF7C6B497CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B49808
memcpy.VCRUNTIME140 ref: 00007FF7C6B4982D
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B49943
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B49957
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B499BE

Strings

TRUE, xrefs: 00007FF7C6B4991D

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: isupper$freemallocmemcpy
String ID: TRUE
API String ID: 2172629687-3412697401
Opcode ID: b8b97a6d8412b3318f153c43871ea6edef9c9b9bb13e98749b72f6c3056a2a6e
Instruction ID: d986b4657f9ba2b494c2ef952eafc72f8367dee123c22c43e8454fd9c56b0e64
Opcode Fuzzy Hash: b8b97a6d8412b3318f153c43871ea6edef9c9b9bb13e98749b72f6c3056a2a6e
Instruction Fuzzy Hash: 45310611E0D69249FB17FF258D8437AEB91AF12BB0FA40631C99E42AC6CE2E9441C324

Function 00007FF7C6B40440 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C6B2BF50: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B104C9,?,?,?,?,00007FF7C6B0F86B), ref: 00007FF7C6B2BF78
Part of subcall function 00007FF7C6B2BF50: GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF7C6B104C9,?,?,?,?,00007FF7C6B0F86B), ref: 00007FF7C6B2BF9E
Part of subcall function 00007FF7C6B2BF50: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B104C9,?,?,?,?,00007FF7C6B0F86B), ref: 00007FF7C6B2BFBF
Part of subcall function 00007FF7C6B2BF50: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B104C9,?,?,?,?,00007FF7C6B0F86B), ref: 00007FF7C6B2BFD0

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B404DF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B40528
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B40531

Strings

%s%s.netrc, xrefs: 00007FF7C6B4049F
%s%s_netrc, xrefs: 00007FF7C6B404F4
HOME, xrefs: 00007FF7C6B40479

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$realloc$EnvironmentVariable
String ID: %s%s.netrc$%s%s_netrc$HOME
API String ID: 4174189579-3384076093
Opcode ID: 3468211e5ffd3dd3fbaac2320bff844c1ff9f11412a5220914762c0670f7151f
Instruction ID: 26d623d1f9894595804d8db147363c70659a79027a962b1d5398b2d09ed023a7
Opcode Fuzzy Hash: 3468211e5ffd3dd3fbaac2320bff844c1ff9f11412a5220914762c0670f7151f
Instruction Fuzzy Hash: FA314121A09B4281DA12EF16BC801B7E3A1BB49BE4FA44536ED4C47755EF3CE445C710

Function 00007FF7C6B47F6D Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47FA8
memcpy.VCRUNTIME140 ref: 00007FF7C6B47FCE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B48109
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B48149
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4815C

Strings

Signature: %s, xrefs: 00007FF7C6B480F7
Signature, xrefs: 00007FF7C6B480DF

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: freemalloc$memcpy
String ID: Signature: %s$Signature
API String ID: 3519880569-1663925961
Opcode ID: d8432c5e83754a19ec62367b523874047ebbef75dd4ea11f7415766943bb1793
Instruction ID: 4ee6119c37a0104692e1fcc1b76d70cfc0d133efbc0c990ca1fc8ff4241651eb
Opcode Fuzzy Hash: d8432c5e83754a19ec62367b523874047ebbef75dd4ea11f7415766943bb1793
Instruction Fuzzy Hash: 4331C761B09BC241EE56AF159C842BBA3A1BF89BE4F940532DE5D17795EF3CD045C310

Function 00007FF7C6B47078 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B470AC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47599

Strings

TRUE, xrefs: 00007FF7C6B4709A
Start Date, xrefs: 00007FF7C6B4756D
FALSE, xrefs: 00007FF7C6B470A1
Start Date: %s, xrefs: 00007FF7C6B47587

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdupfree
String ID: Start Date: %s$FALSE$Start Date$TRUE
API String ID: 1865132094-176635895
Opcode ID: 57c3967dbf58f5e86202c2af06ca98ae99c6837b83d9aecf3b2799bac64784e4
Instruction ID: 250d254410566279ae6385def80e16734d8d66ba69eb6db7457b558357f7bdd6
Opcode Fuzzy Hash: 57c3967dbf58f5e86202c2af06ca98ae99c6837b83d9aecf3b2799bac64784e4
Instruction Fuzzy Hash: 0A21A1A2A0C7C285EA22AF259CC42FBA761FB057A4FD44432CA4D0B759DF3CD545C320

Function 00007FF7C6B15650 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B15685
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B156B1
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B156B9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B156DB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF7C6B129CC), ref: 00007FF7C6B156F2

Strings

Invalid zoneid: %s; %s, xrefs: 00007FF7C6B156C4

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$_errnostrerrorstrtoul
String ID: Invalid zoneid: %s; %s
API String ID: 439826447-2159854051
Opcode ID: 1a1fa8f1411846f4b920e1a85e92cfabe7478dd5a71a3bba3ed82df86f3a4e59
Instruction ID: 0857b4df0e965df22dea37a065bbcb987cd03614808e0ef43f12aa80d9e76b83
Opcode Fuzzy Hash: 1a1fa8f1411846f4b920e1a85e92cfabe7478dd5a71a3bba3ed82df86f3a4e59
Instruction Fuzzy Hash: 381186B2A09A4692EB02EF25ECD017AA371EFC5B64FA41031DB1D43654DF3DD885CB20

Function 00007FF7C6B15580 Relevance: 10.0, APIs: 8, Instructions: 36COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B15594
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B155AA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B155BE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B155D2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B155E6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B155FA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B1560E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B15622

Part of subcall function 00007FF7C6B3E520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B1563B,?,?,00000000,00007FF7C6B11083,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B3E535

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e237461de1852795f574fcb1003078346d3dd9e13ea2262ff5edf55e1f4054c3
Instruction ID: 3dbb6da9d04dda5539ff0de2b2439224e52a30c4ec4372c6027ef258c10a0305
Opcode Fuzzy Hash: e237461de1852795f574fcb1003078346d3dd9e13ea2262ff5edf55e1f4054c3
Instruction Fuzzy Hash: D0115336509F81C1D705AF21EDA40E973B4FBC9FAAB680535DE8E4F658DF3890968220

Function 00007FF7C6B0F060 Relevance: 10.0, APIs: 8, Instructions: 33COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12866), ref: 00007FF7C6B0F071
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12866), ref: 00007FF7C6B0F081
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12866), ref: 00007FF7C6B0F08F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12866), ref: 00007FF7C6B0F09D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12866), ref: 00007FF7C6B0F0AB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12866), ref: 00007FF7C6B0F0B9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12866), ref: 00007FF7C6B0F0C7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B12866), ref: 00007FF7C6B0F0D5

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e9718556f230408b39050c4fda179a342c22db6fae2d6417a93aff4701b8862a
Instruction ID: 422b5a648b62850102644a9099283650cbadcf551d546aa6494cc261ec5064c6
Opcode Fuzzy Hash: e9718556f230408b39050c4fda179a342c22db6fae2d6417a93aff4701b8862a
Instruction Fuzzy Hash: 75019236549B01C2D709AF21EDE413DB3B8FB88FA9B601525CE8E42718CF38D4A9C360

Function 00007FF7C6B0A7C0 Relevance: 10.0, APIs: 8, Instructions: 23COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0A7CD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0A7D7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0A7E1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0A7EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0A7F5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0A7FF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0A809
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B0A813

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 14c36e6917123ed588aaf446535d92d65793401b5c5b35afe473c486920a7b7c
Instruction ID: 912ff45684174655f229652b7cb5d2f47efb59ef3f0acce3211c4e8320af8c1e
Opcode Fuzzy Hash: 14c36e6917123ed588aaf446535d92d65793401b5c5b35afe473c486920a7b7c
Instruction Fuzzy Hash: FCF0F926A55901C2D719AF22ECA40396330FB88F75B641431CD4E46324CE3CD899C370

Function 00007FF7C6B12130 Relevance: 9.2, APIs: 6, Instructions: 161COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7C6B129AB), ref: 00007FF7C6B12147
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7C6B129AB), ref: 00007FF7C6B12178

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: 3a9a796d3cc3fd82f036d3f91a2991cb76c338f6a2b5b5f17456798b340d6fdd
Instruction ID: 8c36ce55dacca720c8cb8339145f6ba7ecfd2b3c0a6713a6b7785d57f69aa9de
Opcode Fuzzy Hash: 3a9a796d3cc3fd82f036d3f91a2991cb76c338f6a2b5b5f17456798b340d6fdd
Instruction Fuzzy Hash: 8E917B22609BC199D75A9F3498903AE77A1F755B28F580236CFAC0B396CF3991A4C731

Function 00007FF7C6B473EC Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4742F
memcpy.VCRUNTIME140 ref: 00007FF7C6B47455
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47528
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47599

Strings

Start Date, xrefs: 00007FF7C6B4756D
Start Date: %s, xrefs: 00007FF7C6B47587

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Start Date: %s$Start Date
API String ID: 3401966785-2389359183
Opcode ID: 34e5c72763e42051cfbda84bab8284cda62fdd8c1f63e8930861636883e0ac6f
Instruction ID: b7a02feb1695402d07d01d45cfd0fa8d433835da191067e9c37c4fed96943bf1
Opcode Fuzzy Hash: 34e5c72763e42051cfbda84bab8284cda62fdd8c1f63e8930861636883e0ac6f
Instruction Fuzzy Hash: 25415C51A092D206EB1F6F254C942BBAB52EB057F0FA44635CA5F0B7D5DD2CE045C731

Function 00007FF7C6AFC610 Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7C6AFC6FA
memcpy.VCRUNTIME140 ref: 00007FF7C6AFC709
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFC73D
memcpy.VCRUNTIME140 ref: 00007FF7C6AFC744
memcpy.VCRUNTIME140 ref: 00007FF7C6AFC753
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C6AFC778

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: 715abf93c41a573b0905af8c8636c62af5fde1eb4c5c9b3b3043f3e8eac994a8
Instruction ID: cf574d7dc1db4a74c2a0f371c2d14e3cad3965ffc0877453aa0c68b7c3047bf0
Opcode Fuzzy Hash: 715abf93c41a573b0905af8c8636c62af5fde1eb4c5c9b3b3043f3e8eac994a8
Instruction Fuzzy Hash: 4931D262709A4195EE16AF1699845BFE255AB44BF0FD40A32EE6E077D9CF3CE081C212

Function 00007FF7C6AF4EC0 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF7C6AF3C35,?,?,?,?,?,00007FF7C6AF1D9B), ref: 00007FF7C6AF4FB3
memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF7C6AF3C35,?,?,?,?,?,00007FF7C6AF1D9B), ref: 00007FF7C6AF4FC1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,?,0000000F,00007FF7C6AF3C35,?,?,?,?,?,00007FF7C6AF1D9B), ref: 00007FF7C6AF4FFA
memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF7C6AF3C35,?,?,?,?,?,00007FF7C6AF1D9B), ref: 00007FF7C6AF5004
memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF7C6AF3C35,?,?,?,?,?,00007FF7C6AF1D9B), ref: 00007FF7C6AF5012
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C6AF5041

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: 82bd6253c2263ff1e222eeeb728159793dc1b3357c8c4cffdcf0b82030c079ea
Instruction ID: 58ad21ed8f85a8041fcc39d4bba45d2244aaeffa4411ae61f3c783a067525fe6
Opcode Fuzzy Hash: 82bd6253c2263ff1e222eeeb728159793dc1b3357c8c4cffdcf0b82030c079ea
Instruction Fuzzy Hash: 0741D521709A8189EA22AF15A98466EE355EF04FF4F940631DF6D077C6CE3CE1418316

Function 00007FF7C6B18810 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32 ref: 00007FF7C6B188F5
VerSetConditionMask.KERNEL32 ref: 00007FF7C6B18904
VerSetConditionMask.KERNEL32 ref: 00007FF7C6B18916
VerSetConditionMask.KERNEL32 ref: 00007FF7C6B18928
VerSetConditionMask.KERNEL32 ref: 00007FF7C6B1893E
VerifyVersionInfoA.KERNEL32 ref: 00007FF7C6B18951

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: 0206b6b82437ce704ceb74b02827dbbef2d223c3bfee926cde9b537f3df271f5
Instruction ID: 0ff8147de88527d59cd4c89af2a51987d48300572fd5bf6d371470c4a96a0ec1
Opcode Fuzzy Hash: 0206b6b82437ce704ceb74b02827dbbef2d223c3bfee926cde9b537f3df271f5
Instruction Fuzzy Hash: 1B41D162E1C69287F231AF11A8947FBE3A1FBE5350F615235E9CD02A54DE3CE4809F10

Function 00007FF7C6B422B0 Relevance: 9.1, APIs: 6, Instructions: 93stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(00000000,?,?,00007FF7C6B4186F), ref: 00007FF7C6B422F6
strchr.VCRUNTIME140(00000000,?,?,00007FF7C6B4186F), ref: 00007FF7C6B42306
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,00007FF7C6B4186F), ref: 00007FF7C6B42330
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B42365
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B4238A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B423AC

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdupstrchr$mallocstrncpy
String ID:
API String ID: 2121287944-0
Opcode ID: 6aaf31aba90ecbb86e6624ce1630b9a97fc25a0569e9fc0a45527508b6ab918a
Instruction ID: 1efb5018cdc72020c3097de78368e00d15856f90300c6f0d4ec18db4c3350d94
Opcode Fuzzy Hash: 6aaf31aba90ecbb86e6624ce1630b9a97fc25a0569e9fc0a45527508b6ab918a
Instruction Fuzzy Hash: 1A31BA21A0DB8149EA66EF126DC037AB7A1FF45BA0F984634DE4E03785DF7CE4819310

Function 00007FF7C6B4D860 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4D909
memcpy.VCRUNTIME140 ref: 00007FF7C6B4D925
memcpy.VCRUNTIME140 ref: 00007FF7C6B4D93C
memcpy.VCRUNTIME140 ref: 00007FF7C6B4D957
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4D98A

Strings

PLAIN, xrefs: 00007FF7C6B4D86B

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: memcpy$freemalloc
String ID: PLAIN
API String ID: 3313557100-4000620671
Opcode ID: 62b349aeb9e93abf134cf3cbf95c0b7730c22738c00b7cf1f60d4a3d31f828d6
Instruction ID: ed3392c9b6b8d588bcc61f2d691a6c2fd3b6284df27f4053434eb4010bc913ad
Opcode Fuzzy Hash: 62b349aeb9e93abf134cf3cbf95c0b7730c22738c00b7cf1f60d4a3d31f828d6
Instruction Fuzzy Hash: 7D318566A08B8182EB129F15E8903BAA7A0FB45BE8F944631DF9D477D5DE3CD045C320

Function 00007FF7C6B46DAF Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 91COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B46F8E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47033

Strings

Signature Algorithm, xrefs: 00007FF7C6B47007
Signature Algorithm: %s, xrefs: 00007FF7C6B47021
Serial Number, xrefs: 00007FF7C6B46F62
Serial Number: %s, xrefs: 00007FF7C6B46F7C

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 1294909896-517259162
Opcode ID: 117089342d16b921665af78fb1d4f388f52ad94674f273b9ab57a4f189d8e30d
Instruction ID: 64bcbbc22236efa3dcbbb6bf2abe4680522927742cd85fed56fe2009bb27e296
Opcode Fuzzy Hash: 117089342d16b921665af78fb1d4f388f52ad94674f273b9ab57a4f189d8e30d
Instruction Fuzzy Hash: 4A41C4A1A097D249EB02AF259C841FBA761BB09BE8F984432DE4D1B749DF3CE545C320

Function 00007FF7C6B47695 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47B09
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47BD2

Strings

Expire Date, xrefs: 00007FF7C6B47ADD
Public Key Algorithm, xrefs: 00007FF7C6B47B88
Public Key Algorithm: %s, xrefs: 00007FF7C6B47BA2
Expire Date: %s, xrefs: 00007FF7C6B47AF7

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 1294909896-2901970132
Opcode ID: da94f6e1fca25d5e0f834fedef5c4a28fcafd92c6a0f9a247a662d239cdfd502
Instruction ID: 994fc5a806069994515878900efa561b3f2708697f59a88638257b4a02238061
Opcode Fuzzy Hash: da94f6e1fca25d5e0f834fedef5c4a28fcafd92c6a0f9a247a662d239cdfd502
Instruction Fuzzy Hash: E231A561A0878249EB16BF659C941FBA7A2BF097A8FD40831DE4D1B35ADF3CE505C320

Function 00007FF7C6B476E6 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C6B48810: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4885C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47B09
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47BD2

Part of subcall function 00007FF7C6B10250: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B102A2

Strings

Expire Date, xrefs: 00007FF7C6B47ADD
Public Key Algorithm, xrefs: 00007FF7C6B47B88
Public Key Algorithm: %s, xrefs: 00007FF7C6B47BA2
Expire Date: %s, xrefs: 00007FF7C6B47AF7

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: freemalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3061335427-2901970132
Opcode ID: 199c3950461e7cadc413a4fe8a7b3d02c8a004f389b647496e8145e38f65c82e
Instruction ID: 5fc7059d1b41614ae725b5f038ff4c2b942b4a455079bde897b89b35a5f7d8fa
Opcode Fuzzy Hash: 199c3950461e7cadc413a4fe8a7b3d02c8a004f389b647496e8145e38f65c82e
Instruction Fuzzy Hash: B331B561A0878249EB12BF659C941FBA7A2BF09798FD44836DE4D1B35ADF3CE505C320

Function 00007FF7C6B476B3 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C6B4A320: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4A355

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47B09
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47BD2

Part of subcall function 00007FF7C6B10250: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B102A2

Strings

Expire Date, xrefs: 00007FF7C6B47ADD
Public Key Algorithm, xrefs: 00007FF7C6B47B88
Public Key Algorithm: %s, xrefs: 00007FF7C6B47BA2
Expire Date: %s, xrefs: 00007FF7C6B47AF7

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: freemalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3061335427-2901970132
Opcode ID: f2636f00b6c246e5b72487c49eb57198fae0ebe395d602c57483347f9785e349
Instruction ID: 66795e805fbbac0d493703ce60ccf74908ddceefbccb3446d4bb328ca636ff8e
Opcode Fuzzy Hash: f2636f00b6c246e5b72487c49eb57198fae0ebe395d602c57483347f9785e349
Instruction Fuzzy Hash: 2131C761A0878249EB12BF659C941FBA7A2BF09798FD40836DE4D1B35ADF3CE505C320

Function 00007FF7C6B0B080 Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF7C6B0B0B3
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF7C6B0B0C7
CloseHandle.KERNEL32 ref: 00007FF7C6B0B0D4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF7C6B0B0F6
closesocket.WS2_32 ref: 00007FF7C6B0B114
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF7C6B0B12D

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: CriticalSectionfree$CloseEnterHandleLeaveclosesocket
String ID:
API String ID: 469868127-0
Opcode ID: 18488507ebf47aa3f81cc915b9bc4066f4a0cde027fa4b948603febc814268d2
Instruction ID: 95552fa0b79e593788f99ea35590a486341b1e3b6d2ea125507336f57e514a36
Opcode Fuzzy Hash: 18488507ebf47aa3f81cc915b9bc4066f4a0cde027fa4b948603febc814268d2
Instruction Fuzzy Hash: FA215176608A4186E725BF12E99027AB770FB49BA0FA44031CF8E03B54DF3DE4A5C320

Function 00007FF7C6B092B8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C6B277B0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B277D1

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B09381

Strings

Replaced, xrefs: 00007FF7C6B09611
FALSE, xrefs: 00007FF7C6B0935B
Added, xrefs: 00007FF7C6B0961D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7C6B09627

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _errno_strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 2151398962-2292467869
Opcode ID: 0ae4b97a199f047b081ac12dd6645710cf618c9e76112631401f63369a5234d0
Instruction ID: f182c8f8a3b8f0bab696d8645e47e9d6b422bc95eb9f96f8354479de74f721d0
Opcode Fuzzy Hash: 0ae4b97a199f047b081ac12dd6645710cf618c9e76112631401f63369a5234d0
Instruction Fuzzy Hash: F86152B190C78655FB73BF2598807BBABA0AF04764FA45036CB9D42691DE2CE884C320

Function 00007FF7C6B091AD Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C6B27700: strchr.VCRUNTIME140 ref: 00007FF7C6B27736

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B09381

Strings

Replaced, xrefs: 00007FF7C6B09611
FALSE, xrefs: 00007FF7C6B0935B
Added, xrefs: 00007FF7C6B0961D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7C6B09627

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdupstrchr
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 3727083984-2292467869
Opcode ID: 2448857944103da360fee4192b1bc80ca982a9085b879199da2b2a23097ce43e
Instruction ID: 8345dd804a7680eb10a6ffaa26fb76f8304f28cb20a206a018533567a9b53b5e
Opcode Fuzzy Hash: 2448857944103da360fee4192b1bc80ca982a9085b879199da2b2a23097ce43e
Instruction Fuzzy Hash: 8F6152B190D78255FB73BF2598C47BBABA0AF04764FA45035DB9D42691DF2CE884C320

Function 00007FF7C6B221B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B223BD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B223D5

Strings

Forcing HTTP/1.1 for NTLM, xrefs: 00007FF7C6B22279
The requested URL returned error: %d, xrefs: 00007FF7C6B2235E

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdupfree
String ID: Forcing HTTP/1.1 for NTLM$The requested URL returned error: %d
API String ID: 1865132094-1204028548
Opcode ID: 2fed8e5a578e9d2dd347dbf18e2fd834b54a3765b8f3de2622e07215a2fb8903
Instruction ID: 98290e4e8a67649c37292feac335fdaf54ef452067554717e750f184dfea47f1
Opcode Fuzzy Hash: 2fed8e5a578e9d2dd347dbf18e2fd834b54a3765b8f3de2622e07215a2fb8903
Instruction Fuzzy Hash: 8251A671A0CAC245FB76AE2499C03FBA7D2FB417A4FA80135DA4D8A695CE3DE4508731

Function 00007FF7C6AF2620 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C6AF4320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7C6AF1B59), ref: 00007FF7C6AF4351

Part of subcall function 00007FF7C6AF3C40: memcpy.VCRUNTIME140 ref: 00007FF7C6AF3C93

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF26F2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF2740
__std_exception_copy.VCRUNTIME140 ref: 00007FF7C6AF2790
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF27DD

Strings

out_of_range, xrefs: 00007FF7C6AF2666

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$__std_exception_copy
String ID: out_of_range
API String ID: 2484256320-3053435996
Opcode ID: a054d6d0206e7735cd63f20e8fae28d53d03665bfcb4b808f3c3828759b69a14
Instruction ID: 995486c8f3835fc2683596271fa09dbb8d33f0477b325cf8837cebbfbfbbb1f7
Opcode Fuzzy Hash: a054d6d0206e7735cd63f20e8fae28d53d03665bfcb4b808f3c3828759b69a14
Instruction Fuzzy Hash: 79518232A18B4199FB01DF64D8803EEB365EB447A8F905632EB5D03AD9DF38D595C311

Function 00007FF7C6B3F590 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B3F608
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B3F63A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B3F6AA

Part of subcall function 00007FF7C6B27910: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7C6B0A93A,?,?,?,?,?,?,?,00007FF7C6B0A707), ref: 00007FF7C6B27921

strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B3F725

Strings

0123456789abcdefABCDEF:., xrefs: 00007FF7C6B3F5FE

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _errno_strdupstrcspnstrncmpstrspn
String ID: 0123456789abcdefABCDEF:.
API String ID: 2191890455-446397347
Opcode ID: 8b91793fb89baf254a1147fd404901ed36fbcf06b34fcee35a7ab21ad8029aa2
Instruction ID: 03e8cdc2b95f602e84b0ca7905c59864239a71aa85722f2d0e2cdf17cfc620d1
Opcode Fuzzy Hash: 8b91793fb89baf254a1147fd404901ed36fbcf06b34fcee35a7ab21ad8029aa2
Instruction Fuzzy Hash: CB41F312B0CAC595EF239F249C803BBA799EB05764FE40132CA8D47A95DF2CE846C721

Function 00007FF7C6B49578 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B49943
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B49957
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B499BE

Strings

%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7C6B49626
GMT, xrefs: 00007FF7C6B495D4

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: isupper$free
String ID: %u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT
API String ID: 573759493-632690687
Opcode ID: 3115612e14700450b25862e957d51a54cc0d3ae71034bf91f442e8043894aa56
Instruction ID: cb5a6eb6bd1e1a9c8defd59b5714dc74b6dae150eb4e5106d523cb12f34f8e8a
Opcode Fuzzy Hash: 3115612e14700450b25862e957d51a54cc0d3ae71034bf91f442e8043894aa56
Instruction Fuzzy Hash: 6641A621A0DA8699FB17FF2599842BEEB91EB417A0FF80531C68E42685CF3DD545C324

Function 00007FF7C6AF4320 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7C6AF1B59), ref: 00007FF7C6AF4351
memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7C6AF1B59), ref: 00007FF7C6AF4416
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7C6AF1B59), ref: 00007FF7C6AF446A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C6AF4471

Part of subcall function 00007FF7C6B4F200: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7C6AF43FE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7C6AF1B59), ref: 00007FF7C6B4F21A

Strings

https://keyauth.win/api/1.2/, xrefs: 00007FF7C6AF4322

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID: https://keyauth.win/api/1.2/
API String ID: 1155477157-3933380396
Opcode ID: 047698fb533d08d4905527894e71dd851002da5f18b16563736fae44fcb9bbb0
Instruction ID: c0f2dabdc12ebab3a3d3ee5b95d0b9d4616f2ac3f58681ce46cded6f42452ea0
Opcode Fuzzy Hash: 047698fb533d08d4905527894e71dd851002da5f18b16563736fae44fcb9bbb0
Instruction Fuzzy Hash: 13311522B05A8549FE1AFE55998467E9240DF00FF4F940632DE3D17BD6DE3CE492831A

Function 00007FF7C6B1EF60 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B1EFCA
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B1F03B
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7C6B1F09B

Strings

:%u, xrefs: 00007FF7C6B1EFDE, 00007FF7C6B1F044
Hostname in DNS cache was stale, zapped, xrefs: 00007FF7C6B1F0C2

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: tolower$_time64
String ID: :%u$Hostname in DNS cache was stale, zapped
API String ID: 4068448496-2924501231
Opcode ID: 143fd01780e26b7d58e01dd25ceae51a593f778144c7c7680f26ad4a5848fd47
Instruction ID: 9db3bcd8de6a731b3ee06afa19b6c589e6c82cd6a8174814768d83e0858ba8da
Opcode Fuzzy Hash: 143fd01780e26b7d58e01dd25ceae51a593f778144c7c7680f26ad4a5848fd47
Instruction Fuzzy Hash: 2D41CCA2618A8291EB12EF11E8847FAE7A6FB44BA8FD44131EE5D07785DF3CD505C710

Function 00007FF7C6B00690 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF7C6AF11FC), ref: 00007FF7C6B0076F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF7C6AF11FC), ref: 00007FF7C6B007AC
memcpy.VCRUNTIME140(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF7C6AF11FC), ref: 00007FF7C6B007B6
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C6B007E9

Strings

https://keyauth.win/api/1.2/, xrefs: 00007FF7C6B00692

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: https://keyauth.win/api/1.2/
API String ID: 1775671525-3933380396
Opcode ID: 3168356573bd4a38300ec6f620fa6ed921566e8d4488472f6888dfbe56b71076
Instruction ID: 356855f1b7e50a5875776d5d87125243cf7e9342d2b0ac0efc21d06ef2b4fa76
Opcode Fuzzy Hash: 3168356573bd4a38300ec6f620fa6ed921566e8d4488472f6888dfbe56b71076
Instruction Fuzzy Hash: 5C3128A2B0978155EE12BF11A9807AEEA95AB44BE0FA80635DF6D077C5DF7CE051C310

Function 00007FF7C6B15D90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7C6B15E0E

Part of subcall function 00007FF7C6B02510: GetLastError.KERNEL32 ref: 00007FF7C6B02532
Part of subcall function 00007FF7C6B02510: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B0253A

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B15E2C
recv.WS2_32 ref: 00007FF7C6B15E57
WSAGetLastError.WS2_32 ref: 00007FF7C6B15E69

Strings

Recv failure: %s, xrefs: 00007FF7C6B15E95

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ErrorLast$_errnofreememcpyrecv
String ID: Recv failure: %s
API String ID: 267823591-4276829032
Opcode ID: 9d6c67b121adffc3412026e625fd140aecfb81f2280cb0c94a47cff33ee24c08
Instruction ID: b9f9071c70feff899fa3dab3c06e0ca993193b615191dea49ae5dfa46184e525
Opcode Fuzzy Hash: 9d6c67b121adffc3412026e625fd140aecfb81f2280cb0c94a47cff33ee24c08
Instruction Fuzzy Hash: 5531D0B3B06B4181EB16AF21ED802AAA361BB48FE8FA04131CE5D47384DE3CD555C350

Function 00007FF7C6B1C820 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B1C915
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1C974

Strings

Connection died, retrying a fresh connect, xrefs: 00007FF7C6B1C8FF
Connection died, tried %d times before giving up, xrefs: 00007FF7C6B1C8D8
REFUSED_STREAM, retrying a fresh connect, xrefs: 00007FF7C6B1C8AB

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdupfree
String ID: Connection died, retrying a fresh connect$Connection died, tried %d times before giving up$REFUSED_STREAM, retrying a fresh connect
API String ID: 1865132094-195851662
Opcode ID: f052526fbe1c7bb4e5e703e8e9ce2da2eba2212e651fdf38023dca0b961b5a2a
Instruction ID: 0d1e40d7365c75fb2aba22e9d30555d5bc778668575259e5cdb805e060c9acc7
Opcode Fuzzy Hash: f052526fbe1c7bb4e5e703e8e9ce2da2eba2212e651fdf38023dca0b961b5a2a
Instruction Fuzzy Hash: 5C41C572B08A8291E756DF25E8D03BEA7A1EB84B98F985031DB4D17799CF3CE491C710

Function 00007FF7C6B1A520 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1A5A9
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B1A63F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1A667

Strings

identity, xrefs: 00007FF7C6B1A563, 00007FF7C6B1A5D3, 00007FF7C6B1A638
Unrecognized content encoding type. libcurl understands %s content encodings., xrefs: 00007FF7C6B1A655

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: Unrecognized content encoding type. libcurl understands %s content encodings.$identity
API String ID: 3985033223-1703240927
Opcode ID: 1633eaf5a912578d2529eb4af58ebd7968cd6cada5de346386519326350d5ec2
Instruction ID: e1de7ca7a89aa6519a22d26a4ccd432e3fefb51da50224ac8c98ed2eee342a24
Opcode Fuzzy Hash: 1633eaf5a912578d2529eb4af58ebd7968cd6cada5de346386519326350d5ec2
Instruction Fuzzy Hash: 2B419262A09A4691EB17AF159D802BAE761EF45BF4FA54131CE5D07788EF3CE5418320

Function 00007FF7C6B49469 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B49490
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B49943
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B49957
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B499BE

Strings

FALSE, xrefs: 00007FF7C6B49485

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: isupper$_strdupfree
String ID: FALSE
API String ID: 3359907120-3701058176
Opcode ID: 3d57563d1b855af01bc4c21921b38cc212c3e0b4ce2c323734536b893a9b68b2
Instruction ID: 164aac177cddf19b5ca0c8166e10fce0336c068eb7b46d5486388af9088f879c
Opcode Fuzzy Hash: 3d57563d1b855af01bc4c21921b38cc212c3e0b4ce2c323734536b893a9b68b2
Instruction Fuzzy Hash: 2731B422E0D59649FB17FF289D8437AEB909B01774FE40631CA9E416C6CE2ED585C334

Function 00007FF7C6B30DE0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B30E1B
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B30E61
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B30EC6

Strings

RCPT TO:<%s@%s>, xrefs: 00007FF7C6B30E9D
RCPT TO:<%s>, xrefs: 00007FF7C6B30EAB

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdupfreestrpbrk
String ID: RCPT TO:<%s>$RCPT TO:<%s@%s>
API String ID: 1812939018-579818044
Opcode ID: e815b45f8a570b2c8a4c14a92917c46b5223af9341e62fca4d8e0810bd75e837
Instruction ID: 90bd7dd69f8898e5f96265ce45a59b8250f26ca27966c29c92f40995e8421f69
Opcode Fuzzy Hash: e815b45f8a570b2c8a4c14a92917c46b5223af9341e62fca4d8e0810bd75e837
Instruction Fuzzy Hash: 93316462B18FC181EB02EF15E8802BAE3A1EF95BA0F984231DA9D03795DF7CD545C310

Function 00007FF7C6B007F0 Relevance: 7.7, APIs: 5, Instructions: 178COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C6AF3D80: memcpy.VCRUNTIME140(?,?,0000000100000000,00007FF7C6B0084D), ref: 00007FF7C6AF3E32
Part of subcall function 00007FF7C6AF3D80: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C6AF3E57

Part of subcall function 00007FF7C6AF3D80: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,0000000100000000,00007FF7C6B0084D), ref: 00007FF7C6AF3E14

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B00A60
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B00A67
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B00A6E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B00A75
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B00A7C

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskmemcpy
String ID:
API String ID: 2318677668-0
Opcode ID: 9f46146c951a49f92051c973d7e39ca9965cce9c8bb2eabe31a5204598103894
Instruction ID: 7e35af49a416bb3d0f357f75e38391be32303d6b7f7c31c3610e2c790fb5e083
Opcode Fuzzy Hash: 9f46146c951a49f92051c973d7e39ca9965cce9c8bb2eabe31a5204598103894
Instruction Fuzzy Hash: 6761B2B2A04BC185EB12EF25E8887BEB765EB51BD4FA04035DA8D07A96DF7CD490C340

Function 00007FF7C6B44340 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C6B442A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B40D35), ref: 00007FF7C6B442C6
Part of subcall function 00007FF7C6B442A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B40D35), ref: 00007FF7C6B442E7
Part of subcall function 00007FF7C6B442A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B40D35), ref: 00007FF7C6B44302
Part of subcall function 00007FF7C6B442A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B40D35), ref: 00007FF7C6B44310
Part of subcall function 00007FF7C6B442A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B40D35), ref: 00007FF7C6B44322

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B443C6

Strings

NTLM, xrefs: 00007FF7C6B4437E, 00007FF7C6B44430
HTTP, xrefs: 00007FF7C6B4434A

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$malloc
String ID: HTTP$NTLM
API String ID: 2190258309-4188377180
Opcode ID: bf995e1f3cac52961f437791bec3973a026e7b4e2f068a386fd7dca7abe2d56b
Instruction ID: d33045756da614cd80130a31fb31ea72d47f863e8a5efe2feb887ffe37c776c0
Opcode Fuzzy Hash: bf995e1f3cac52961f437791bec3973a026e7b4e2f068a386fd7dca7abe2d56b
Instruction Fuzzy Hash: 9F615E32609B8686EB619F15E88067AF3A4FB88B94FA44136DF8D43B58DF3CD454CB10

Function 00007FF7C6B49D45 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B49D88
memcpy.VCRUNTIME140 ref: 00007FF7C6B49DAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B49E7B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B49ECF

Strings

TRUE, xrefs: 00007FF7C6B49ED9

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: TRUE
API String ID: 3401966785-3412697401
Opcode ID: f48f08caccf8b26bbd97807afafdf6ada356c13f4a1d7ea36f8a96ed9b522e72
Instruction ID: 4812c6712d4033e53f67525b0daebafe4e25ce2b083ad7813df4775fd9977eab
Opcode Fuzzy Hash: f48f08caccf8b26bbd97807afafdf6ada356c13f4a1d7ea36f8a96ed9b522e72
Instruction Fuzzy Hash: 8A416B22B5965241FF1BAE258DD437AAB52FB417F0FA44631CA6E433C5CD6CD08AC324

Function 00007FF7C6B4D5F0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 129stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF7C6B4D5B0), ref: 00007FF7C6B4D65F

Part of subcall function 00007FF7C6B27910: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7C6B0A93A,?,?,?,?,?,?,?,00007FF7C6B0A707), ref: 00007FF7C6B27921

Part of subcall function 00007FF7C6B27910: strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF7C6B27AC3
Part of subcall function 00007FF7C6B27910: strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF7C6B27AE0

strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF7C6B4D5B0), ref: 00007FF7C6B4D6CE
strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF7C6B4D5B0), ref: 00007FF7C6B4D6E8
strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF7C6B4D5B0), ref: 00007FF7C6B4D71E

Strings

xn--, xrefs: 00007FF7C6B4D705

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: strchr$_errno
String ID: xn--
API String ID: 2644425738-2826155999
Opcode ID: e287ed642fac84c6c99a20b16d8849af9dee8d0a3c75c8e632f959748c1931a2
Instruction ID: 9556506b4c9ca46844cc88938e59398f92da0231288b0402886ae51d26841506
Opcode Fuzzy Hash: e287ed642fac84c6c99a20b16d8849af9dee8d0a3c75c8e632f959748c1931a2
Instruction Fuzzy Hash: 4241A551B1D68205FF56BF219D943BAD6C69F85BE0FA48134EE0E877C6EE2DE4418320

Function 00007FF7C6B1B6E0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7C6B1B788
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1B808
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1B8B2

Strings

CONNECT phase completed!, xrefs: 00007FF7C6B1B8F3
allocate connect buffer!, xrefs: 00007FF7C6B1B82F

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: callocfreememset
String ID: CONNECT phase completed!$allocate connect buffer!
API String ID: 3505321882-591125384
Opcode ID: 536c09c15afed5c2e770c694565a6b02cce9094123cdbc371edf8993de9b5c2f
Instruction ID: d0b26699c8e20364a28bec841465e1f94d5ad8bff5bfb39b650b2bfffa45bb21
Opcode Fuzzy Hash: 536c09c15afed5c2e770c694565a6b02cce9094123cdbc371edf8993de9b5c2f
Instruction Fuzzy Hash: B05198B2B08A82A6E71AAF25D9C43FBB391FB44B94F944035CB5C07291DF78E565C320

Function 00007FF7C6B47263 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 125COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47599

Strings

Start Date, xrefs: 00007FF7C6B4756D
Start Date: %s, xrefs: 00007FF7C6B47587
GMT, xrefs: 00007FF7C6B4731E
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7C6B47391

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: Start Date: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Start Date
API String ID: 1294909896-619256714
Opcode ID: 3987fa8b224630f79572049042cc01745225540cceafd5efa0b5c9f484cff6d7
Instruction ID: 62d38480eb5fe2ffab8dd3638182240bd98e9192c83fdbf1c50b78f1791b8428
Opcode Fuzzy Hash: 3987fa8b224630f79572049042cc01745225540cceafd5efa0b5c9f484cff6d7
Instruction Fuzzy Hash: 7951D861A0C6D245EB229F149D842FBFBA5FB067A0FE44436DA8D17658CF3CD546CB20

Function 00007FF7C6B49059 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4909C
memcpy.VCRUNTIME140 ref: 00007FF7C6B490C2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B49199
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B49206

Strings

%s: %s, xrefs: 00007FF7C6B491F1

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: %s: %s
API String ID: 3401966785-1451338302
Opcode ID: 0f0f574aa99ae79040ac14f6e96b6ea81a96e6bdf7856ef94d0afc190f3405c1
Instruction ID: a69f0c0d550e6fdbc4cab69e2d6c60f80350e455a3508c2b9fc7fc63e9396099
Opcode Fuzzy Hash: 0f0f574aa99ae79040ac14f6e96b6ea81a96e6bdf7856ef94d0afc190f3405c1
Instruction Fuzzy Hash: B6416811A092E116FA2EBE065C983BBA791EB41BF0F64423ACE6F077C5DE2CD045C324

Function 00007FF7C6B2E460 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C6B277B0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6B277D1

memcpy.VCRUNTIME140 ref: 00007FF7C6B2E5D1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B2E5DF

Strings

Written %zu bytes, %I64u bytes are left for transfer, xrefs: 00007FF7C6B2E59D
Found %I64d bytes to download, xrefs: 00007FF7C6B2E532
Failed to parse FETCH response., xrefs: 00007FF7C6B2E4BE

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _errnofreememcpy
String ID: Failed to parse FETCH response.$Found %I64d bytes to download$Written %zu bytes, %I64u bytes are left for transfer
API String ID: 738009125-4268564757
Opcode ID: 41b7576d40f8dc317bb7e800fc9b24ff06fe4c2619ab9712cacc762c53e24574
Instruction ID: e1b22eae7231fc67a62f55a74e0a6abc7b47e5f055862ea8c066d9583347f7ed
Opcode Fuzzy Hash: 41b7576d40f8dc317bb7e800fc9b24ff06fe4c2619ab9712cacc762c53e24574
Instruction Fuzzy Hash: 1A51B662A0C7C642EB15AF66D8906FEE391FB457A4FA44035EB5C03A85DF7CE4578320

Function 00007FF7C6B471A0 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47599

Strings

%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7C6B4724F
GMT, xrefs: 00007FF7C6B471FC
Start Date, xrefs: 00007FF7C6B4756D
Start Date: %s, xrefs: 00007FF7C6B47587

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: Start Date: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Start Date
API String ID: 1294909896-2752585153
Opcode ID: 9cc2350aeaf70e53258d1469c2bb439d10ece2b47c65c66136739ec16f16cee2
Instruction ID: 9a59138dffe15dee5fde08f31c2b3f66ac0427f2efb5304ff68e0e4b4af102bb
Opcode Fuzzy Hash: 9cc2350aeaf70e53258d1469c2bb439d10ece2b47c65c66136739ec16f16cee2
Instruction Fuzzy Hash: 3A317561A0DB8295EB12AF249C901FBE752FB05BA4FE84432D64D1B259CF3CE545C721

Function 00007FF7C6B47F2E Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B48109
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B48149
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4815C

Strings

Signature: %s, xrefs: 00007FF7C6B480F7
Signature, xrefs: 00007FF7C6B480DF

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$Signature
API String ID: 2190258309-1663925961
Opcode ID: 1b2ce2f078dc1764adbe0214cbad6f7ab950a2263407c7e1631f39abe1496d79
Instruction ID: 4fbc4ad90b6212f4ea1b5ef056f5792a35764e4dd401dca1c30b3da92d25da74
Opcode Fuzzy Hash: 1b2ce2f078dc1764adbe0214cbad6f7ab950a2263407c7e1631f39abe1496d79
Instruction Fuzzy Hash: 3C21B166B08AC286EA169F25EC842FBA360FB48BE4F980532DE5D57795DF3CD141C710

Function 00007FF7C6B31FA0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3206B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B32084
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B32098

Strings

Failure sending QUIT command: %s, xrefs: 00007FF7C6B31FF3
QUIT, xrefs: 00007FF7C6B31FCF

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: Failure sending QUIT command: %s$QUIT
API String ID: 1294909896-1162443993
Opcode ID: 32ab6081050ec7b57ceaffbb92eb4c9b2c4b44f0ecb8492fbe3fdde06179ed59
Instruction ID: 3578dd24fc8b6e68983b1358e6043882720db3619ceb88f0b98f55ae93b14172
Opcode Fuzzy Hash: 32ab6081050ec7b57ceaffbb92eb4c9b2c4b44f0ecb8492fbe3fdde06179ed59
Instruction Fuzzy Hash: BF318D32B0CB8281EB56EF2598D02BBB7A5FB45BA4FA84031DA4D07A55DF3CE455C321

Function 00007FF7C6B473F4 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4742F
memcpy.VCRUNTIME140 ref: 00007FF7C6B47455
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47599

Strings

Start Date, xrefs: 00007FF7C6B4756D
Start Date: %s, xrefs: 00007FF7C6B47587

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: freemallocmemcpy
String ID: Start Date: %s$Start Date
API String ID: 3056473165-2389359183
Opcode ID: a49752c1b268cba94bad5d42c4cd861d4c645511885704efc1a12072e57d2a35
Instruction ID: 1258a5db2cfbff53506cc4821fa53c5c25854119dc47d6f467f7bf0eaaa7ea92
Opcode Fuzzy Hash: a49752c1b268cba94bad5d42c4cd861d4c645511885704efc1a12072e57d2a35
Instruction Fuzzy Hash: 4C213690A0878202EE17AF258D942FBA752AF05BF4FA84532CE1D0B7D4DE3CE505C320

Function 00007FF7C6B37E10 Relevance: 7.6, APIs: 5, Instructions: 62stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B37E41
strchr.VCRUNTIME140 ref: 00007FF7C6B37E6D
strchr.VCRUNTIME140 ref: 00007FF7C6B37E84
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B37EA3

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: strchr$_strdupmalloc
String ID:
API String ID: 4236146995-0
Opcode ID: 23d2600e0df1bca2b2eab056315383fbaa7b735b8cb14551c3fc620a2cdd1762
Instruction ID: f31b6c0dd19d9e0ff258c74d2059793486d0ff8663a400310ea609bc1fd8fe95
Opcode Fuzzy Hash: 23d2600e0df1bca2b2eab056315383fbaa7b735b8cb14551c3fc620a2cdd1762
Instruction Fuzzy Hash: 0F216262B16BC281EB86DF2598943A963E1EB45B64F580134DE4D0BB48EF39E491C335

Function 00007FF7C6B257A0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 206COMMON

Download Yara Rule

APIs

fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 00007FF7C6B25AF2

Strings

%3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s, xrefs: 00007FF7C6B25A85
%% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed, xrefs: 00007FF7C6B2583B
** Resuming transfer from byte position %I64d, xrefs: 00007FF7C6B25828

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: fflush
String ID: %3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s$ %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed$** Resuming transfer from byte position %I64d
API String ID: 497872470-664487449
Opcode ID: 8267623cc954ce741a5e6342c60f0e38dc44c988a8eb7d035955273e261eb266
Instruction ID: c9cc7a019313b7b601adaa552e8df9c682f9662bfa2ee46a344fce811b6961ea
Opcode Fuzzy Hash: 8267623cc954ce741a5e6342c60f0e38dc44c988a8eb7d035955273e261eb266
Instruction Fuzzy Hash: 19918062A06BC685DA61EF05E9847ABA3A5FB84BD0FD21032DE4D4BB95FF78D041D700

Function 00007FF7C6B327C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 120networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C6B4A510: memcpy.VCRUNTIME140 ref: 00007FF7C6B4A5B8
Part of subcall function 00007FF7C6B4A510: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4A5C9

WSAGetLastError.WS2_32 ref: 00007FF7C6B3292A

Strings

FTP response aborted due to select/poll error: %d, xrefs: 00007FF7C6B32938
We got a 421 - timeout!, xrefs: 00007FF7C6B3294E
FTP response timeout, xrefs: 00007FF7C6B32977

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ErrorLastfreememcpy
String ID: FTP response aborted due to select/poll error: %d$FTP response timeout$We got a 421 - timeout!
API String ID: 1248052217-2064316097
Opcode ID: 9bac9e874d9a31147d59dc5fed91453a349d4e033343be06d1f471d7723e87dd
Instruction ID: eb678c5f802a71edcc57640851d96a5c747dd056fab00537894d36c53c411356
Opcode Fuzzy Hash: 9bac9e874d9a31147d59dc5fed91453a349d4e033343be06d1f471d7723e87dd
Instruction Fuzzy Hash: C2418462B0CA8685F662BF259C803FBA390BF487A4FA44131DE5D87B85EE3CE4458710

Function 00007FF7C6B4949E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B49943
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B49957
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B499BE

Strings

%s%lx, xrefs: 00007FF7C6B49508

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: isupper$free
String ID: %s%lx
API String ID: 573759493-530121141
Opcode ID: 8765682e76ed94d39d5c70df0f0e168c2fc045c2c3aabd6e734a444a6a927930
Instruction ID: c18836629ae3f6bde708e27665861991ca5323ec8b0b536195721408841cbb27
Opcode Fuzzy Hash: 8765682e76ed94d39d5c70df0f0e168c2fc045c2c3aabd6e734a444a6a927930
Instruction Fuzzy Hash: A1310211E0D59689FB23BF248CD43BEEB919B02BA4FF44931C68E41A86CE2ED441C334

Function 00007FF7C6B4977F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B49943
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B49957
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B499BE

Strings

TRUE, xrefs: 00007FF7C6B4991D

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: isupper$free
String ID: TRUE
API String ID: 573759493-3412697401
Opcode ID: f22c5c381398739b7779f5b519544946c6a72d4e01227cd3d09eb783ae16524a
Instruction ID: 92ae2e067792497277fd70982bf51fb761416bf7ee7f07f3180a67023b6b942e
Opcode Fuzzy Hash: f22c5c381398739b7779f5b519544946c6a72d4e01227cd3d09eb783ae16524a
Instruction Fuzzy Hash: 8F31FC21A0D59689FB17EF259DC437AEF91EB01BB4FA80631C69E426CACF2DD541C324

Function 00007FF7C6B325A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32 ref: 00007FF7C6B325F2
accept.WS2_32 ref: 00007FF7C6B32611

Part of subcall function 00007FF7C6B24CA0: ioctlsocket.WS2_32 ref: 00007FF7C6B24CB9

Strings

Error accept()ing server connect, xrefs: 00007FF7C6B3262E
Connection accepted from server, xrefs: 00007FF7C6B3263F

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: acceptgetsocknameioctlsocket
String ID: Connection accepted from server$Error accept()ing server connect
API String ID: 36920154-2331703088
Opcode ID: ede1c47d754ce7e7c70c53af79d63c8f4fe9bcedcacbff240ff6520c82c860b9
Instruction ID: 29b34a4c9041fd2a33e655d120db581fd3fbf3effcd5478ae346334562a7a8a1
Opcode Fuzzy Hash: ede1c47d754ce7e7c70c53af79d63c8f4fe9bcedcacbff240ff6520c82c860b9
Instruction Fuzzy Hash: D231706170CA8186EA55EF22A8843ABB3A1FB48BB4FA40231DA6D477C5DF7DE505C710

Function 00007FF7C6B24140 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B23B79), ref: 00007FF7C6B241CD

Strings

Failed to alloc memory for big header!, xrefs: 00007FF7C6B241D8
Rejected %zu bytes header (max is %d)!, xrefs: 00007FF7C6B2416B

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: realloc
String ID: Failed to alloc memory for big header!$Rejected %zu bytes header (max is %d)!
API String ID: 471065373-1365219457
Opcode ID: 80064227217444d0cbc401085d9b0d9e317761327d8da2db05dd4d69225e7a9d
Instruction ID: ca1881b43f31bf3a702ded41cc20f42efc2432e69541d476dc35b065582b4563
Opcode Fuzzy Hash: 80064227217444d0cbc401085d9b0d9e317761327d8da2db05dd4d69225e7a9d
Instruction Fuzzy Hash: D1215E72B09A8586DB05AF26E9802AEA7A1FB48BD4F944031EB4D47B59DF38D4A1C340

Function 00007FF7C6B04323 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B043B2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B043CE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B043EB

Strings

:, xrefs: 00007FF7C6B043A6

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$_strdup
String ID: :
API String ID: 2653869212-336475711
Opcode ID: f29b11a0b0397464a597fb3ea39ddd504717da1f998e5a9d4931f48a6fdd9c5f
Instruction ID: f01535da4dc42eeae3a9667c408931d15550feafe002145b726c14c93a17b95b
Opcode Fuzzy Hash: f29b11a0b0397464a597fb3ea39ddd504717da1f998e5a9d4931f48a6fdd9c5f
Instruction Fuzzy Hash: A9217462609B85C5EB66AF15E9803AAF7A0FF447A0FA84131CF9D43794EF3CE4548720

Function 00007FF7C6B044A8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B043B2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B043CE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B043EB

Strings

:, xrefs: 00007FF7C6B043A6

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$_strdup
String ID: :
API String ID: 2653869212-336475711
Opcode ID: 87311d32ae9296bea575fe45e94f42ed7c2220f6e3d5247b2afc967d71d96164
Instruction ID: 65d49ff902d75ef1c20b2cabe80062be16ef65ab39a064880cc9e6a11a0f09e2
Opcode Fuzzy Hash: 87311d32ae9296bea575fe45e94f42ed7c2220f6e3d5247b2afc967d71d96164
Instruction Fuzzy Hash: 4A119372609B85C1EA66AF14E9803AAF7A0EF447B0FA84131CF9D43794EF3CE4548720

Function 00007FF7C6B2DEF0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

LIST "%s" *, xrefs: 00007FF7C6B2DF77
%s%s, xrefs: 00007FF7C6B2DF23

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID:
String ID: %s%s$LIST "%s" *
API String ID: 0-1744359683
Opcode ID: f26cce760aa3583b8ba7ee7fca6d197ba8dd6e6c78cf83b85a40555b260ca5f2
Instruction ID: 09f5ec936a47a44bab5ae3990bafb757da48cabfef0edfe0c60202a75a39663e
Opcode Fuzzy Hash: f26cce760aa3583b8ba7ee7fca6d197ba8dd6e6c78cf83b85a40555b260ca5f2
Instruction Fuzzy Hash: A5116021A09A8281EA56AF55E8C01BAA3A1EB44BE4FA40431EE0D17755DF3CE9868364

Function 00007FF7C6B3A4A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF7C6B3A4DD
WSAGetLastError.WS2_32 ref: 00007FF7C6B3A4E7

Strings

Sending data failed (%d), xrefs: 00007FF7C6B3A4ED
SENT, xrefs: 00007FF7C6B3A502

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ErrorLastsend
String ID: SENT$Sending data failed (%d)
API String ID: 1802528911-3459338696
Opcode ID: d2dc69695b0874c980e642b7739525bac1b53ceff5fd2637fc4b87a476b0ea95
Instruction ID: 78975fd1c3a36a810c257a5cb1f29568b952959edfe141829fdd3a4053457aec
Opcode Fuzzy Hash: d2dc69695b0874c980e642b7739525bac1b53ceff5fd2637fc4b87a476b0ea95
Instruction Fuzzy Hash: 2C01B133718F9285EB11AF2AEC8049ABB60FB84FE4BA95131CB5D43B15DE39D941C790

Function 00007FF7C6B47171 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B47174
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47599

Part of subcall function 00007FF7C6B10250: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B102A2

Strings

Start Date, xrefs: 00007FF7C6B4756D
Start Date: %s, xrefs: 00007FF7C6B47587

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: Start Date: %s$Start Date
API String ID: 3985033223-2389359183
Opcode ID: b24df60c55d2ab08a2b7f0e643e02db030e097835dc72833e9d84d978605e4bc
Instruction ID: e2f957820a78b92476a7ce7ce22b1a32bcb230e0444a65c5976b394647166aaa
Opcode Fuzzy Hash: b24df60c55d2ab08a2b7f0e643e02db030e097835dc72833e9d84d978605e4bc
Instruction Fuzzy Hash: B8012491A0C78246EA07AF244CD41FBA762AF057A4FE80831DA4E0B155CF2CE546C331

Function 00007FF7C6B220A0 Relevance: 6.3, APIs: 5, Instructions: 82stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7C6B22104
strchr.VCRUNTIME140 ref: 00007FF7C6B22117
strchr.VCRUNTIME140 ref: 00007FF7C6B22129
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B2215B
memcpy.VCRUNTIME140 ref: 00007FF7C6B22185

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: strchr$mallocmemcpy
String ID:
API String ID: 320687583-0
Opcode ID: 968c5a41d7fa0066955731bb5acbf83ea758fa4720a442de9bc8b38baa2f82a6
Instruction ID: 5f3bfa484a26a01a6acfe6bc812133123f843b6ea6ed93f175bdcd0036259f9d
Opcode Fuzzy Hash: 968c5a41d7fa0066955731bb5acbf83ea758fa4720a442de9bc8b38baa2f82a6
Instruction Fuzzy Hash: ED210411A0DAE201EE56AF1699A02BBE7D29F44BD4F984031EE9D47786DE3DE442C230

Function 00007FF7C6B215B0 Relevance: 6.3, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B219C5), ref: 00007FF7C6B215E8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B219C5), ref: 00007FF7C6B215F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B219C5), ref: 00007FF7C6B2166A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B219C5), ref: 00007FF7C6B2167B
memcpy.VCRUNTIME140(?,?,00000000,00007FF7C6B219C5), ref: 00007FF7C6B216A4

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$mallocmemcpy
String ID:
API String ID: 3401966785-0
Opcode ID: eb842fa6b7cab745b16baf7522a9b3906565401069e00974fb4f3864444e8b8c
Instruction ID: bde42dedf1c663efdf977fb340022f431bb9ff4bc134ae117fc861998b32d0c7
Opcode Fuzzy Hash: eb842fa6b7cab745b16baf7522a9b3906565401069e00974fb4f3864444e8b8c
Instruction Fuzzy Hash: 5D316132A09B8181EB16AF11E9D026EA3A1EB05BF4FA84631DF6D077C4DF3CD4408310

Function 00007FF7C6B442A0 Relevance: 6.3, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B40D35), ref: 00007FF7C6B442C6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B40D35), ref: 00007FF7C6B442E7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B40D35), ref: 00007FF7C6B44302
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B40D35), ref: 00007FF7C6B44310
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B40D35), ref: 00007FF7C6B44322

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b0a4e4de2bce31f97642ea06989e9971e88d375cc84a03477e8c1ea5c12148dc
Instruction ID: c04f573c8620c99adaf609f2de9cddfad62786656017b967d5acf872c6f66612
Opcode Fuzzy Hash: b0a4e4de2bce31f97642ea06989e9971e88d375cc84a03477e8c1ea5c12148dc
Instruction Fuzzy Hash: 9111C236619B4182DB09AF25EC9003DB3B4FF84FA8B644425CE4E47728CF38D895C360

Function 00007FF7C6B1A7C0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1A8E0
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1A926
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1A988

Strings

chunked, xrefs: 00007FF7C6B1A83E

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: calloc$free
String ID: chunked
API String ID: 171065143-1066005980
Opcode ID: bc62d0fb42dd4d6f5e32306f484104a7fafbcdf1de0ad033193cd1286a025fe2
Instruction ID: c779db857a7930d2ba3f859443c226c88bc6e155d4c8eebb8202dfbed94a569d
Opcode Fuzzy Hash: bc62d0fb42dd4d6f5e32306f484104a7fafbcdf1de0ad033193cd1286a025fe2
Instruction Fuzzy Hash: B651B762A0869255FB67AF129D90377E796AF04BE4FE54031DE5D07785DF2CF4428320

Function 00007FF7C6B48ED0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B49206

Strings

%s: %s, xrefs: 00007FF7C6B491F1
GMT, xrefs: 00007FF7C6B48F8E
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7C6B48FFA

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: %s: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s
API String ID: 1294909896-2632828617
Opcode ID: 1ded0be51314f8f6976ee9e1ef5601db707f3c8b1aacea9f823d6cd8dc6d2eea
Instruction ID: 463b3c29f547ffdc6e1ac26333e322019a64f346957650a28f61267ddd2cb0fa
Opcode Fuzzy Hash: 1ded0be51314f8f6976ee9e1ef5601db707f3c8b1aacea9f823d6cd8dc6d2eea
Instruction Fuzzy Hash: FA41D461A0D69285EA62AF15AD842BBF7A6FB45BB0FE44431DE8C03754CF3CE546C324

Function 00007FF7C6AFD4E0 Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C6AFD1A8), ref: 00007FF7C6AFD5BE
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C6AFD1A8), ref: 00007FF7C6AFD5EC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C6AFD1A8), ref: 00007FF7C6AFD655

Part of subcall function 00007FF7C6B4F200: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7C6AF43FE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7C6AF1B59), ref: 00007FF7C6B4F21A

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C6AFD662

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmallocmemcpymemset
String ID:
API String ID: 2942768764-0
Opcode ID: 68862f51c876c01a771af81d146815ef37c9f528d0eadea1144bad958e5a6efd
Instruction ID: 46dc6a1f198eadc33a427a35684cd3a9bba3113d02f15d87540d7603e3abe7ac
Opcode Fuzzy Hash: 68862f51c876c01a771af81d146815ef37c9f528d0eadea1144bad958e5a6efd
Instruction Fuzzy Hash: 4A41C072B15A8585EA17BF65D8846BEB390FB44BB8F948632DA2D077C4DF3CE0518312

Function 00007FF7C6AFEE30 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7C6AFEF3F

Part of subcall function 00007FF7C6B4F200: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7C6AF43FE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7C6AF1B59), ref: 00007FF7C6B4F21A

memcpy.VCRUNTIME140 ref: 00007FF7C6AFEF2C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AFEFAD
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C6AFEFBA

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 650fedd6b64bd72c813efdfb2ea69d4f37e5b431a9ff0f11a39698f21da11a5d
Instruction ID: ade46dcb9c58f0192adf5212e286a5dd87dc75325494da1f8f50029e0b2a863a
Opcode Fuzzy Hash: 650fedd6b64bd72c813efdfb2ea69d4f37e5b431a9ff0f11a39698f21da11a5d
Instruction Fuzzy Hash: D741B062715B8695E906EF25E8842AEE361BB04BF0F948632DB6D077C4DF38E492C311

Function 00007FF7C6B4A840 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00007FF7C6B2C9EB), ref: 00007FF7C6B4A89E

Strings

%s, xrefs: 00007FF7C6B4A874

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: %s
API String ID: 1294909896-3043279178
Opcode ID: fa4103d9e5611dfc5050198a5ec6abdf6970104d498d97fa1ce0eab18259a1b2
Instruction ID: 5d79f1074547fb8c36e5400b050b941e0411333f8514af97c9f8856dfaa5bcf8
Opcode Fuzzy Hash: fa4103d9e5611dfc5050198a5ec6abdf6970104d498d97fa1ce0eab18259a1b2
Instruction Fuzzy Hash: E3416632A18B4582D652DF15B8801AAB3A5FB95BE0F641135DF9E03BA5DF3CE495C310

Function 00007FF7C6AF4D60 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7C6AF4E3F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C6AF4E7C
memcpy.VCRUNTIME140 ref: 00007FF7C6AF4E86
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C6AF4EB3

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: e6cb56938965bdbde93adbf2d3e51d2c5f2de8ae510889bdf5c22b8418d0dcf2
Instruction ID: e8e615faac7f7896eb8a8680023c9ff0232eb5ad78c24d2c2d57056d1b0b72c5
Opcode Fuzzy Hash: e6cb56938965bdbde93adbf2d3e51d2c5f2de8ae510889bdf5c22b8418d0dcf2
Instruction Fuzzy Hash: 6331D222B0978159EA12EF15E9846AEA295EF05BF0F980631DF6D077CACE7CE0518316

Function 00007FF7C6B361DD Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B36214

Part of subcall function 00007FF7C6B15B00: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C6B15C25
Part of subcall function 00007FF7C6B15B00: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C6B15C40

Strings

Wildcard - START of "%s", xrefs: 00007FF7C6B3621D
Wildcard - "%s" skipped by user, xrefs: 00007FF7C6B3627D
%s%s, xrefs: 00007FF7C6B361E4

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: fwrite$free
String ID: %s%s$Wildcard - "%s" skipped by user$Wildcard - START of "%s"
API String ID: 3468156532-1133524294
Opcode ID: 3497c0f96625c22efeb627373da6876eab8d6fba06be918a41b29d56bd12ca7b
Instruction ID: a4227029f7a9cc4c506ef22dddab33a7138a6ffd2d86eaa8dcfecd68e1ecfd78
Opcode Fuzzy Hash: 3497c0f96625c22efeb627373da6876eab8d6fba06be918a41b29d56bd12ca7b
Instruction Fuzzy Hash: 25414F76B08E46C5E712EF15DCC41AEB3A0EB44BA5FA54036DE4E4B795EE38D444C320

Function 00007FF7C6B00590 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,0000006E00000006,?,FFFFFFFF,00007FF7C6AF11FC), ref: 00007FF7C6B005C8
memcpy.VCRUNTIME140(?,0000006E00000006,?,FFFFFFFF,00007FF7C6AF11FC), ref: 00007FF7C6B00669
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C6B00687

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task
String ID:
API String ID: 326894585-0
Opcode ID: c4992f707cb95da361e632dca4283fb3b9c1ba1f64749bcb6fcfa4b00bdece44
Instruction ID: 97ea1ec6c86536a8cd9cb2a274fc01830ddd681744be6aee12d40d4e98e59375
Opcode Fuzzy Hash: c4992f707cb95da361e632dca4283fb3b9c1ba1f64749bcb6fcfa4b00bdece44
Instruction Fuzzy Hash: 3A210762A09B5645FA17BF11AD8077EA6459B44BF4FA40730DE6D077C1DE3CA4D28310

Function 00007FF7C6B48E15 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B49206

Strings

%s: %s, xrefs: 00007FF7C6B491F1
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7C6B48EB9
GMT, xrefs: 00007FF7C6B48E69

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: %s: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT
API String ID: 1294909896-1153420294
Opcode ID: a2b50c2e140b00bea650a002ed11136e7f8620ef6a4d5c88263862dd61d64b1e
Instruction ID: 37cf229c956f95520e8aa23032a4e5680331df431a435e18a9f356c7bc60cecf
Opcode Fuzzy Hash: a2b50c2e140b00bea650a002ed11136e7f8620ef6a4d5c88263862dd61d64b1e
Instruction Fuzzy Hash: FE31A361A0CB8194E662AF51D8C46FBB391FB45BA0FE44032DA5D07245CF7CD946C324

Function 00007FF7C6B10250 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B102A2
memcpy.VCRUNTIME140 ref: 00007FF7C6B102DD

Part of subcall function 00007FF7C6B05630: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B05645

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B10312

Part of subcall function 00007FF7C6B05740: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B0FD40,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C6B01B71), ref: 00007FF7C6B05767
Part of subcall function 00007FF7C6B05740: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B0FD40,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C6B01B71), ref: 00007FF7C6B05773

Strings

%s:, xrefs: 00007FF7C6B102BC

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$malloc$memcpy
String ID: %s:
API String ID: 901724546-64597662
Opcode ID: 925860c30caf535c34a72db8d47f75cdea24508a4fb027a8b8d13c4272022d26
Instruction ID: 29caf6aedfbafd4115e377f80d6ad4d81056ddddc32a3146ccf995c9067fbcb1
Opcode Fuzzy Hash: 925860c30caf535c34a72db8d47f75cdea24508a4fb027a8b8d13c4272022d26
Instruction Fuzzy Hash: 4D21F362A08A9591DB02EF12ED845ABB7A4FB84BF4F980132EE5D07795DF3CD542C350

Function 00007FF7C6B49D4D Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B49D88
memcpy.VCRUNTIME140 ref: 00007FF7C6B49DAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B49ECF

Strings

TRUE, xrefs: 00007FF7C6B49ED9

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: freemallocmemcpy
String ID: TRUE
API String ID: 3056473165-3412697401
Opcode ID: 608d2a7abef432dfa65e809bab2771b5e880509c2d673a2e460d5a38f1f9ecdb
Instruction ID: aa816681f2ff4c508ae040fc22fcdb881d49eb6b890e91034443c009f767e328
Opcode Fuzzy Hash: 608d2a7abef432dfa65e809bab2771b5e880509c2d673a2e460d5a38f1f9ecdb
Instruction Fuzzy Hash: 4021E062B0964240EF17EF569D9037AA762BB45BF4FA44532CE1D037C4DE7DE0868324

Function 00007FF7C6B4954A Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B49551
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B49943
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B49957
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B499BE

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: isupper$_strdupfree
String ID:
API String ID: 3359907120-0
Opcode ID: 0a9663e3bc4c5042aee7542af291de8f425a7579eddad5fdbc4e8997d6914a8c
Instruction ID: 027b9e8591cc3d185a13b8706440e4eac99bc2b63a5195454c6815f3a1689ded
Opcode Fuzzy Hash: 0a9663e3bc4c5042aee7542af291de8f425a7579eddad5fdbc4e8997d6914a8c
Instruction Fuzzy Hash: CD21D111E0D59289FB17FF248DD437AEB919B11B64FE80531C5CE41A86CE2E9545C334

Function 00007FF7C6B49061 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4909C
memcpy.VCRUNTIME140 ref: 00007FF7C6B490C2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B49206

Strings

%s: %s, xrefs: 00007FF7C6B491F1

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: freemallocmemcpy
String ID: %s: %s
API String ID: 3056473165-1451338302
Opcode ID: 1ee5b0d9b8b81bf646d28eaa4e8b9dc2dedc90832e2a53a48bfe062fb2e88353
Instruction ID: a3dc17792c486730dc8d09bd0db7ada2176d07c6ca1150f4da778d86986dba2f
Opcode Fuzzy Hash: 1ee5b0d9b8b81bf646d28eaa4e8b9dc2dedc90832e2a53a48bfe062fb2e88353
Instruction Fuzzy Hash: 2F21CD51A0978241FA66BF02AD443BBA361AB85FF0FA84132CE2D07B95DE3CE4458324

Function 00007FF7C6B470BA Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B47599

Strings

%s%lx, xrefs: 00007FF7C6B47115
Start Date, xrefs: 00007FF7C6B4756D
Start Date: %s, xrefs: 00007FF7C6B47587

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID: Start Date: %s$%s%lx$Start Date
API String ID: 1294909896-3519493645
Opcode ID: cb11418ea5d2944402b0cb898bcd11af7d9d1ac715a4e8d1606f8bee554a1995
Instruction ID: 975fd55a5c36380cb7d5060661d47f5ca645fc5f2a4e3ab68d838271a8b9bde4
Opcode Fuzzy Hash: cb11418ea5d2944402b0cb898bcd11af7d9d1ac715a4e8d1606f8bee554a1995
Instruction Fuzzy Hash: FE212591B0D68245EE23AF248CD02FFA752AB067A4FE44831DA0E0B686DF2CE405C720

Function 00007FF7C6B192ED Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 56stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7C6B18FB8), ref: 00007FF7C6B19105
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7C6B18FB8), ref: 00007FF7C6B1911F

Strings

I32, xrefs: 00007FF7C6B190F5
I64, xrefs: 00007FF7C6B19115

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: 056cc2bcd62c57aa1527f8d25fd921d6101ad41fab0db1694665c4bb104d250f
Instruction ID: 71d0102df720b01958a93c77eb5c468bfe9a5882103c9a9e2b3ed7c27b1719f2
Opcode Fuzzy Hash: 056cc2bcd62c57aa1527f8d25fd921d6101ad41fab0db1694665c4bb104d250f
Instruction Fuzzy Hash: 8B21C672A0DA9252EB32BF20DCD06BAFBA59B05F58F9A4131CA4D432D5DE2CD605C760

Function 00007FF7C6B43140 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B43EA9,00000000,?,?,00007FF7C6B43466), ref: 00007FF7C6B43169
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B43EA9,00000000,?,?,00007FF7C6B43466), ref: 00007FF7C6B431A0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B43EA9,00000000,?,?,00007FF7C6B43466), ref: 00007FF7C6B431B2
memcpy.VCRUNTIME140(?,?,?,00007FF7C6B43EA9,00000000,?,?,00007FF7C6B43466), ref: 00007FF7C6B431DA

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: freemallocmemcpyrealloc
String ID:
API String ID: 3881842442-0
Opcode ID: f6ade716d9b7759c424a2b2bf7ce6763d0c140e5a3b0912f5556576ec473131f
Instruction ID: 046b9ea3117bfd73c70d0b3ebea9a006bbeee8f716118c89847c6853534e924b
Opcode Fuzzy Hash: f6ade716d9b7759c424a2b2bf7ce6763d0c140e5a3b0912f5556576ec473131f
Instruction Fuzzy Hash: 1A214D2670AB8182DB46DF16E89022AA3A0FB48FD8B988435EF5E47759DF38D4918710

Function 00007FF7C6B324C0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 54stringCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B324DD
strstr.VCRUNTIME140 ref: 00007FF7C6B3251C
strstr.VCRUNTIME140 ref: 00007FF7C6B32534

Strings

;type=, xrefs: 00007FF7C6B3250F, 00007FF7C6B3252D

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: strstr$calloc
String ID: ;type=
API String ID: 3224321581-3507045495
Opcode ID: 03e453eed3736bbed8c4a2eaa8b622df1740a1d5568da1af01c33e224b5b5dc5
Instruction ID: 816e3fca4cbf59540cf1e1865b20ba1f3a77efe2b0c6c0c7bdc4e6a0c3e6da8a
Opcode Fuzzy Hash: 03e453eed3736bbed8c4a2eaa8b622df1740a1d5568da1af01c33e224b5b5dc5
Instruction Fuzzy Hash: 1B21DB31A0CB8281D7569F15E8903AA77A0FB447A4F984131DB9E477D9DF3CE591C310

Function 00007FF7C6B2BF50 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B104C9,?,?,?,?,00007FF7C6B0F86B), ref: 00007FF7C6B2BF78
GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF7C6B104C9,?,?,?,?,00007FF7C6B0F86B), ref: 00007FF7C6B2BF9E
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B104C9,?,?,?,?,00007FF7C6B0F86B), ref: 00007FF7C6B2BFBF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B104C9,?,?,?,?,00007FF7C6B0F86B), ref: 00007FF7C6B2BFD0

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: realloc$EnvironmentVariablefree
String ID:
API String ID: 2828309815-0
Opcode ID: 45e1359fa90faf0bbf912280cc798ec753b30b8fb322a9ac87c63bfe08ba67eb
Instruction ID: 4d356f3dca82c2039aa499d797c5b4bed4fff494776292585330bc8fe7a6090f
Opcode Fuzzy Hash: 45e1359fa90faf0bbf912280cc798ec753b30b8fb322a9ac87c63bfe08ba67eb
Instruction Fuzzy Hash: 49113725B0DB8385E666AF1259D023BE3D2BF48BE4F644435DD4D43B94DE3CE4404B50

Function 00007FF7C6B4D330 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF7C6B4D36D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4D37D
WideCharToMultiByte.KERNEL32 ref: 00007FF7C6B4D3AC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4D3B9

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: 7632c42eccf4611e522adcbd58fe10c051f59463a377088735cb8c879fbe04bc
Instruction ID: 7854f0ba19c5d394785fe6242c528ae44c8a0456673c7617ed8767f50c980e5c
Opcode Fuzzy Hash: 7632c42eccf4611e522adcbd58fe10c051f59463a377088735cb8c879fbe04bc
Instruction Fuzzy Hash: AA115E32B09B4186EB259F62B84423EB7A0FB88FD0B984539DB8D43714DF38E5118750

Function 00007FF7C6B4D560 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B4D586
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B4D597
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4D5C6

Part of subcall function 00007FF7C6B4D5F0: strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF7C6B4D5B0), ref: 00007FF7C6B4D65F

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B4D5BD

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdupfree$strchr
String ID:
API String ID: 1739957132-0
Opcode ID: d21723dcd45607f4c0d9df671048792bd46c46d5342bef914f9fa96c5cf8fe03
Instruction ID: d5b238bd6c733de34e4007fd06e0040d319eb941758584a9c15a7f35764e21ae
Opcode Fuzzy Hash: d21723dcd45607f4c0d9df671048792bd46c46d5342bef914f9fa96c5cf8fe03
Instruction Fuzzy Hash: FA015251B0E68142FE5BAF5669D413A92E0AF48FE4F984434EE8E47B44EE2CD885C730

Function 00007FF7C6B0B140 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,?,?,00007FF7C6B0B0F2,?,?,?,00000000), ref: 00007FF7C6B0B151
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B0B0F2,?,?,?,00000000), ref: 00007FF7C6B0B15A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C6B0B0F2,?,?,?,00000000), ref: 00007FF7C6B0B164
closesocket.WS2_32 ref: 00007FF7C6B0B182

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free$CriticalDeleteSectionclosesocket
String ID:
API String ID: 3086658127-0
Opcode ID: bfdf7fb5e2d95c2c118e8f7e39064692ae8c22d79de84dc31bef82b2c3049bdc
Instruction ID: 87c08c570e1e1ec6dc928ad566908c35778e63a232a876aa87d0bffbe9b7da0a
Opcode Fuzzy Hash: bfdf7fb5e2d95c2c118e8f7e39064692ae8c22d79de84dc31bef82b2c3049bdc
Instruction Fuzzy Hash: 52017112D29B8283EB06EF31CCA01796360FFE9F38B516325DE6D011A59F78E5D48210

Function 00007FF7C6B191DA Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7C6B18FB8), ref: 00007FF7C6B19105
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7C6B18FB8), ref: 00007FF7C6B1911F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B19162

Strings

I32, xrefs: 00007FF7C6B190F5
I64, xrefs: 00007FF7C6B19115

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: 46b897fdb660f60e7b0e6336b61378d244077a93e4d378a59ff4250cf2e6f7e9
Instruction ID: 751921b7d5299a333f67792a183ad46642ae6d00d169e08a632de16b5f1fc95a
Opcode Fuzzy Hash: 46b897fdb660f60e7b0e6336b61378d244077a93e4d378a59ff4250cf2e6f7e9
Instruction Fuzzy Hash: 7EF02E7171D94351FA126F15DCD86B7A7999F06BA4F994031C91E833D4CD1CD200C730

Function 00007FF7C6B191E2 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7C6B18FB8), ref: 00007FF7C6B19105
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7C6B18FB8), ref: 00007FF7C6B1911F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B19162

Strings

I32, xrefs: 00007FF7C6B190F5
I64, xrefs: 00007FF7C6B19115

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: 56c783c9750a8c1120daef38fd2588ff2b8569f72e26d221cc052682e6ce8597
Instruction ID: a0458573a037a97b9949a8ca4ee8b3b59006df977604cdb1a5500cd4921869a8
Opcode Fuzzy Hash: 56c783c9750a8c1120daef38fd2588ff2b8569f72e26d221cc052682e6ce8597
Instruction Fuzzy Hash: B5F0E96171994251FA226F15DCD86B7A6999F06BA4F994031C91E822D4CD1CD200C730

Function 00007FF7C6B411D0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 227COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7C6B16586), ref: 00007FF7C6B411E4

Strings

%lx, xrefs: 00007FF7C6B414CA

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _errno
String ID: %lx
API String ID: 2918714741-1448181948
Opcode ID: 98c0969320312687023c200824468f69d39722c5e068b44edd1fb084a08802f4
Instruction ID: 42f50d404a61462f81fc252c52a6399b655d4e287a614d01eb9534f37e69c240
Opcode Fuzzy Hash: 98c0969320312687023c200824468f69d39722c5e068b44edd1fb084a08802f4
Instruction Fuzzy Hash: 1E814C22E1C1D145E76A9E249C9027FBBD0FB857E4F644236EA9F826C1DE3CD841DB20

Function 00007FF7C6B2CEF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?,00000000,00007FF7C6B2C8D3), ref: 00007FF7C6B2CFC2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?,00000000,00007FF7C6B2C8D3), ref: 00007FF7C6B2D013

Strings

(){ %*], xrefs: 00007FF7C6B2CF0D

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdupmalloc
String ID: (){ %*]
API String ID: 3515966317-731572209
Opcode ID: 8c808802b1c5fbd810ffde11559a1f67fb436bd7dfc4a9fda12db57491fb59d2
Instruction ID: 8fed3f5b43011bd591c260b403c4c0e750e74ab3e56bdc881df810ba29e1cb97
Opcode Fuzzy Hash: 8c808802b1c5fbd810ffde11559a1f67fb436bd7dfc4a9fda12db57491fb59d2
Instruction Fuzzy Hash: 2A31B41190D6D644FEA76F1558D037BABD29F56B74FF84131DA9E432C6CB2DB80A8230

Function 00007FF7C6B3E76F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B3E865
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B3E8C7

Strings

%ld, xrefs: 00007FF7C6B3E79C

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdupfree
String ID: %ld
API String ID: 1865132094-1112595699
Opcode ID: f039448b877425ce1848560b8524627d31cb3ccc3a2a92fe931b4c460ad34079
Instruction ID: f02b8bc9722b9b425ffdce3382cd03b0ec4e183e30debd3a0151e0acf1e410d2
Opcode Fuzzy Hash: f039448b877425ce1848560b8524627d31cb3ccc3a2a92fe931b4c460ad34079
Instruction Fuzzy Hash: FF315222F09A4281FA77AF55999437BA790AF84764FA54033EB4D07A85EF3CE447C720

Function 00007FF7C6B1A690 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B1A709
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B1A7A2

Strings

identity, xrefs: 00007FF7C6B1A6C4, 00007FF7C6B1A733, 00007FF7C6B1A79B

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdupmalloc
String ID: identity
API String ID: 3515966317-1788209604
Opcode ID: 85f4267b8dbe5b294c29c9fbd706f4a6724bce6c52117a3738dafb1db63b2293
Instruction ID: 54d376400cff253a3949539cca14b040b893a5e89b70bd891a51a6f307efd969
Opcode Fuzzy Hash: 85f4267b8dbe5b294c29c9fbd706f4a6724bce6c52117a3738dafb1db63b2293
Instruction Fuzzy Hash: 1331A866E09A4691EB179F159DC0376E7A1EF44BB4FA94231CE2D033D8EE2CE5418310

Function 00007FF7C6B17020 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

getsockopt.WS2_32 ref: 00007FF7C6B1709F
setsockopt.WS2_32 ref: 00007FF7C6B170CE

Strings

@, xrefs: 00007FF7C6B1702F

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: getsockoptsetsockopt
String ID: @
API String ID: 194641219-2726393805
Opcode ID: bc9f903c42daced68b01ba1b1855308e3950cc77d112b83277fad4204abff862
Instruction ID: 8dedce1c9684b279b58c3743c83b8cedcf1ed40f766c61842b1de6599ff38474
Opcode Fuzzy Hash: bc9f903c42daced68b01ba1b1855308e3950cc77d112b83277fad4204abff862
Instruction Fuzzy Hash: D41154B1A0828296F721DF10E884677F7A1FB85368FA44034DA8C47794DB7ED589CF11

Function 00007FF7C6B154D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B15515
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B1553C

Strings

%I64d-, xrefs: 00007FF7C6B15527

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdupfree
String ID: %I64d-
API String ID: 1865132094-19666937
Opcode ID: 26108baf463650988f77f9e0bae61ee72ee694359524d010a20125bbc6b7aa3e
Instruction ID: cd46360ce236d005aeaf37970b67b26900d009727e583f7ad181d9b132034d80
Opcode Fuzzy Hash: 26108baf463650988f77f9e0bae61ee72ee694359524d010a20125bbc6b7aa3e
Instruction Fuzzy Hash: 9311E5F2A06A82C1EB169F6498853F663A3EF54B68F6C1035CA0D4E265DF2C94968330

Function 00007FF7C6B08530 Relevance: 5.3, APIs: 4, Instructions: 287COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B087FA
memcpy.VCRUNTIME140 ref: 00007FF7C6B0892C
memcpy.VCRUNTIME140 ref: 00007FF7C6B08948

Part of subcall function 00007FF7C6B1DDE0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B06703,?,?,00000000,00007FF7C6B10FD2,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B1DE1C

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: freememcpy
String ID:
API String ID: 3223336191-0
Opcode ID: 6b382eee5c9112042274bb13768f2011407f7cc2c5b1ea9d35d9fc82458e51ba
Instruction ID: d275b491655a2d5f5b3588c940dc492b266002ed5817640f1c4997d0e568e971
Opcode Fuzzy Hash: 6b382eee5c9112042274bb13768f2011407f7cc2c5b1ea9d35d9fc82458e51ba
Instruction Fuzzy Hash: 05C18D72B08B028AEB16AF65D8807AE77A1BB45BB8F944235CE2D177C8DF38D505C750

Function 00007FF7C6B48DE8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C6B48DEF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B49206

Part of subcall function 00007FF7C6B10250: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C6B102A2

Strings

%s: %s, xrefs: 00007FF7C6B491F1

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: %s: %s
API String ID: 3985033223-1451338302
Opcode ID: 8197430fdd7f96bf1e249d20f9ac333874ed2baa61ad66073db214df1d12f47f
Instruction ID: 6430b26282372a9017659565e350b6c82132f16a15c1ba2cff4c89cd517d434b
Opcode Fuzzy Hash: 8197430fdd7f96bf1e249d20f9ac333874ed2baa61ad66073db214df1d12f47f
Instruction Fuzzy Hash: DFF04451A0D69191FA67BF52AC807F79350AB45BA0FE80431DE5D07356DF3CD5868324

Function 00007FF7C6B4D280 Relevance: 5.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7C6B403B8), ref: 00007FF7C6B4D2B1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7C6B403B8), ref: 00007FF7C6B4D2C4
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7C6B403B8), ref: 00007FF7C6B4D2EB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7C6B403B8), ref: 00007FF7C6B4D2F8

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: 197188614f96b9596c40bfb8b5e5e857ec197008835beb0a05cb902de00e003e
Instruction ID: e58c60050ddbf101145df7b6f17c4ff94559d198df26495790cbe7f077663d1f
Opcode Fuzzy Hash: 197188614f96b9596c40bfb8b5e5e857ec197008835beb0a05cb902de00e003e
Instruction Fuzzy Hash: 38117021B09B5282E721AF2AF89013BE7A0FF88BE4B980535DB5D47B58DF3CD8408710

Function 00007FF7C6B44850 Relevance: 5.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B4094E), ref: 00007FF7C6B44876
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B4094E), ref: 00007FF7C6B44897
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B4094E), ref: 00007FF7C6B448B2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B4094E), ref: 00007FF7C6B448C0

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 68a80319576730e4853389bc5b855315cca4aea61a5977db3876873a49d856f0
Instruction ID: 9aaec0dd9f33334ee45e2035f38e22e2f19ae5a24344fd39215c1df5076c3a83
Opcode Fuzzy Hash: 68a80319576730e4853389bc5b855315cca4aea61a5977db3876873a49d856f0
Instruction Fuzzy Hash: 6A11A536615B4182DB09AF26EC9003DB3B9FF94FA87640426CE5D43768CF38D8A4C3A0

Function 00007FF7C6B421F0 Relevance: 5.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B18415,?,?,00000000,00007FF7C6B110D1,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B42200
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B18415,?,?,00000000,00007FF7C6B110D1,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B42226
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B18415,?,?,00000000,00007FF7C6B110D1,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B42234
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C6B18415,?,?,00000000,00007FF7C6B110D1,?,?,00000000,00007FF7C6B11605), ref: 00007FF7C6B42242

Memory Dump Source

Source File: 00000000.00000002.1448564422.00007FF7C6AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C6AF0000, based on PE: true

Associated: 00000000.00000002.1448538636.00007FF7C6AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448622323.00007FF7C6B51000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448726230.00007FF7C6B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448764451.00007FF7C6B69000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c6af0000_Fa1QSXjTZD.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 3d4e180b605b687941d0f239e9d2843bdc8ed0da27605406103f0df9761bbfb7
Instruction ID: 50b67c4de54ebc646e7c6b5f302e724a6b22f6cb035832bd4731c34df280b9b3
Opcode Fuzzy Hash: 3d4e180b605b687941d0f239e9d2843bdc8ed0da27605406103f0df9761bbfb7
Instruction Fuzzy Hash: 5EF09C36615B0182DB099F25ED94039B3B4FF98F987654531CE9D47764CF38D4A5C360

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Tactics:	Lateral Movement
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Fa1QSXjTZD.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Phishing

Compliance

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Windows Analysis Report
Fa1QSXjTZD.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre